upatre | 486bace70fc33408f1f8504e52c01806229a765a5341546292d0d744e2534844

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe
Size

13KB
MD5

44ba8ed64d6e67b0b203b2053e687f21
SHA1

2686960fe872658eb744bd6a99bcddb8dbfb2dd6
SHA256

486bace70fc33408f1f8504e52c01806229a765a5341546292d0d744e2534844
SHA512

751c6ee0db2717e6f37a306b33e190c6b76c065f8b06f2e8715d7e9cd2df0dcb27b83b38b510f4d32efad50886bd8a86cecb3d07cb704e35ae986e6587079d11
SSDEEP

384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjKkFlplVDuyUyGyylqFlyylkQ:v+dAURFxna4QAPQlYgkFlplVDuyUyGy5

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3956	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3956	1104	44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe	95
PID 1104 wrote to memory of 3956	1104	44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe	95
PID 1104 wrote to memory of 3956	1104	44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44ba8ed64d6e67b0b203b2053e687f21_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
13KB

MD5
d4adad39f22b3c982ec798ae1c365e7e

SHA1
5e5ad0eff75bea06c0a0cd3a1316282b197227ed

SHA256
b114f53ee56d8e76334b7ca661b6b7386fe4aa87a0083b5039ed3254ac78de0c

SHA512
224be6d88a783965b5acd4994781a969df4cad1a834ca4fecea889ff9ac2fa5e5e53a0edfabedfc9d0ad61919e955da929123eda5a4f4af34c74cfc8eb1d4bb8

Download Submit