In this example today, I did an upgrade from R70.20 to R70.40. First, I had to go and download the image from Check Point's website. Just choose the appropriate image you need. In my case today, I needed Check_Point_R70.40_Upgrade.Splat.tgz. I downloaded

Next, you want to click on 'Start upgrade". To the right of that, it tells you the image it will use to upgrade.
The upgrade varies in time, according to the version you are upgrading to, etc. It will go through the process of decompressing the file, extracting the file, takes a snapshot of the current system config, does the upgrade, then reboots the UTM-1.
Today, the UTM-1 rebooted and I logged in and it told me that the upgrade was successful when I logged in. I could see that when I went to the 'Information' page, where it tells you the version you are running.
Now, here is the tricky thing. I have seen this one thing in the past where it used to be (and I dont know if/when this changed) that you only had a certain amount of time to do the upgrade, which you choose at the beginning of the upgrade process. If you did not log in by the time the 'timeframe you selected' was up (15 minutes was default), then it would revert back to the old version you just tried to upgrade FROM. I can say though, that the last few Check Point UTMs I have upgraded did not allow me to name an amount of time to do the upgrade in. Im not sure why sometimes its like that and sometimes its not, but you will know what it is if you see it.
So that is how you do the Check Point UTM-1 upgrade.