upatre | 915d419715eef666c30a7aa6f1530f90e755b66ca4ae0f95c3ced979ecff0b7d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe
Size 14KB
Sample240330-abn5tsdc43
SHA256 915d419715eef666c30a7aa6f1530f90e755b66ca4ae0f95c3ced979ecff0b7d
MD5 2ee921b3054e3ca19ef6bc2b0a1f52a1
SHA1 5034c1198a0b929dbaef92fe0044513d6ad953e6
SHA512 120238fa3cde2d7cd64b876bec3770b5e65fa65951ae6bbe956280cd1a156182b945bb02f4a029ce4a51443a0a7a1a707a8c127be10cd9213f2ce4f31b9fcb47
SSDEEP 384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjK7aylryylFyylYLlmylylyy9lmplyEJy:v+dAURFxna4QAPQlYg7aylryylFyylYG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1684	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1684	4972	2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe	85
PID 4972 wrote to memory of 1684	4972	2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe	85
PID 4972 wrote to memory of 1684	4972	2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

szgfw.exe

Path C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Size 14KB
SHA256 624147efd6bd177b64d43c535c9020ef5fe7a5820503b073331261ad883d684e
MD5 237a1deea3d93b5606bdd0d575a89e81
SHA1 d5b075b4289e1c8d74dfd1b91b2a65ec4502dc14
SHA512 d80ca776fc99812cc55f70f5d30d08c2651a676182022013239a7d3c7521d710045c0c2bdfea4ed31715b692162e627eb2b45a5938bbbef16cf2c047d2327960
SSDEEP 384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjK7aylryylFyylYLlmylylyy9lmplyEJF:v+dAURFxna4QAPQlYg7aylryylFyylY5
MD5 SHA1 SHA512 SSDEEP

Submit Download