upatre | 915d419715eef666c30a7aa6f1530f90e755b66ca4ae0f95c3ced979ecff0b7d

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-03-2024 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe
Size

14KB
MD5

2ee921b3054e3ca19ef6bc2b0a1f52a1
SHA1

5034c1198a0b929dbaef92fe0044513d6ad953e6
SHA256

915d419715eef666c30a7aa6f1530f90e755b66ca4ae0f95c3ced979ecff0b7d
SHA512

120238fa3cde2d7cd64b876bec3770b5e65fa65951ae6bbe956280cd1a156182b945bb02f4a029ce4a51443a0a7a1a707a8c127be10cd9213f2ce4f31b9fcb47
SSDEEP

384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjK7aylryylFyylYLlmylylyy9lmplyEJy:v+dAURFxna4QAPQlYg7aylryylFyylYG

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2028	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1964	2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe
1964	2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2028	1964	2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe	28
PID 1964 wrote to memory of 2028	1964	2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe	28
PID 1964 wrote to memory of 2028	1964	2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe	28
PID 1964 wrote to memory of 2028	1964	2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
14KB

MD5
237a1deea3d93b5606bdd0d575a89e81

SHA1
d5b075b4289e1c8d74dfd1b91b2a65ec4502dc14

SHA256
624147efd6bd177b64d43c535c9020ef5fe7a5820503b073331261ad883d684e

SHA512
d80ca776fc99812cc55f70f5d30d08c2651a676182022013239a7d3c7521d710045c0c2bdfea4ed31715b692162e627eb2b45a5938bbbef16cf2c047d2327960

Download Submit