upatre | 5f0a30e4304945e1885d63daf5f67b3d19b3df409d264301c53854eaacda5b19

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe
Size

13KB
MD5

63111c203d09d7e94323ddd3ddbb9152
SHA1

2c8d694a35552a3ef5b98e9bf8f53796ec9f1089
SHA256

5f0a30e4304945e1885d63daf5f67b3d19b3df409d264301c53854eaacda5b19
SHA512

698397db499fbf4dbcbcb8a3db3909066aa7047faa168de545c554aefb03c79a187c46dafa47c299c7f3e9b41372b1bf7c23ae3c822f40ecf8c8af5fc8ccaff9
SSDEEP

384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjKkFlplVDuyUylyylylylyylPh8yQ:v+dAURFxna4QAPQlYgkFlplVDuyUylyv

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1252	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe
2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1252	2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe	28
PID 2220 wrote to memory of 1252	2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe	28
PID 2220 wrote to memory of 1252	2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe	28
PID 2220 wrote to memory of 1252	2220	63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63111c203d09d7e94323ddd3ddbb9152_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
13KB

MD5
a81cbb6cb1d8c00b0fe21cd8b1d3b475

SHA1
01120c4d598870b1ca388045b2f085128468b851

SHA256
582a9fff366d4125e0384659ca0d99af9f62f658951b3e45e1c751bb6c1b3400

SHA512
fdd28a750c0cdb6c2f9c0eef483c6d67ebb92a021d55ad61b042b01254c3697b2ccfdbee3e94ecffbd7ed4670107eb595ca7c0f5b1c2e46b5791a62fe8cba92f

Download Submit