upatre | e78a86a2c1f47cf0a5bf5906f6b4087716747636a850bd33f9a0efa774f739d8

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe
Size

33KB
MD5

687cedc46c9a39e7c8f4b7a81dec547c
SHA1

dd57176f55e871127f93d653363763138effbb54
SHA256

e78a86a2c1f47cf0a5bf5906f6b4087716747636a850bd33f9a0efa774f739d8
SHA512

dffb9388ad5d23ba7d675d308fbb65f30c08e7e7842b010f1202bff7075decce22776599f01ceb54340103b71522d48e2b9ab70eb9c8258ed16f4d0ac28ccae6
SSDEEP

768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh95kRCalKv6lyyyQ:GY9jw/dUT62rGdiUOWWrNla

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1940	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe
1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1940	1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 1940	1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 1940	1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 1940	1932	687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\687cedc46c9a39e7c8f4b7a81dec547c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
33KB

MD5
628209a9f7ac02d4ddd86a41e88bdccb

SHA1
b0712a7e92ca831ef56d23c5bdfbe086470b144e

SHA256
d5805d2473f2482ef9783fcb871d07beed33ed2a5b642d5ad50dbf282f4b1cb0

SHA512
168e838a3991285a1fff5415d200e64a27bc354d6b43b52ddadf204d778a03b439b1f154341eef0728dc8484e072cdf9f2dfc47b18e97428c0f927eeb0454455

Download Submit
memory/1932-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1932-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download