upatre | 1d22294427d545d706834a2fc6144d57ebb35a22a4f1609fb667dbbba240d37b

Analysis

max time kernel
150s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe
Size

13KB
MD5

f5f40657d309a0ea205244a2a23e1c39
SHA1

062e77b9b7d716ee1d4f89b19fdb5eb76de0d6ca
SHA256

1d22294427d545d706834a2fc6144d57ebb35a22a4f1609fb667dbbba240d37b
SHA512

e320810fc1b6ce5d8e0bfc3b4eec4550a181d221d8f0ca782a45feba9c7c1b1509b2dc6d994033b2289ce2dacead88b17ca0f75bae86d59e420401ca64f9689d
SSDEEP

384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjK7aylryylFyylYLlmylylyy8yyCJ:v+dAURFxna4QAPQlYg7aylryylFyylY2

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4680	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 4680	1676	f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe	84
PID 1676 wrote to memory of 4680	1676	f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe	84
PID 1676 wrote to memory of 4680	1676	f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5f40657d309a0ea205244a2a23e1c39_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
13KB

MD5
686b973e8bd961928a0cdf19fc90c2e5

SHA1
4dd04102ff3100e27c48fe27a966c7e452e314a2

SHA256
7c69afe9f12c660a965c8ce01e6e8981b78d7e9ad745bce9120a083a13cfb84b

SHA512
c946c45d475be294aff8a61dafffb29ec142d102a043d915cf5b3aa6573175c3445d2517d5e6e14caf44f4626d7160cf4798cafe88977d0b4cd486a399ed55e8

Download Submit