Analysis
-
max time kernel
134s -
max time network
190s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 23:54
Static task
static1
Behavioral task
behavioral1
Sample
e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe
Resource
win10-en-20211208
General
-
Target
e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe
-
Size
92KB
-
MD5
fbd85dad36fe13d46eaca7d7f2d50b0b
-
SHA1
ebcd3b4728151786661eab9640b6cb83665cf10b
-
SHA256
e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0
-
SHA512
572b67083fe5060ea643d710b80ca0a3210827e5de81bdda8973eabafeef015598ea9da220ac24deebe59a607ae83162f714a9f828dee75b9767e4c69eb2ff02
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 3020 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exedescription pid process Token: SeIncBasePriorityPrivilege 1104 e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.execmd.exedescription pid process target process PID 1104 wrote to memory of 3020 1104 e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe AdobeUpdate.exe PID 1104 wrote to memory of 3020 1104 e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe AdobeUpdate.exe PID 1104 wrote to memory of 3020 1104 e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe AdobeUpdate.exe PID 1104 wrote to memory of 1580 1104 e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe cmd.exe PID 1104 wrote to memory of 1580 1104 e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe cmd.exe PID 1104 wrote to memory of 1580 1104 e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe cmd.exe PID 1580 wrote to memory of 2768 1580 cmd.exe PING.EXE PID 1580 wrote to memory of 2768 1580 cmd.exe PING.EXE PID 1580 wrote to memory of 2768 1580 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe"C:\Users\Admin\AppData\Local\Temp\e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2768
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
72ef80f6b0c1a47d31c484a70102da6d
SHA17bb39695b3725405cbc15d4f2d619b95785e9f3c
SHA256005163f5ad610630788d4227b9ac99574c38951f55ec8a8ff22c1e3b2c7706a0
SHA5129c6e95f7caa6219cbeb940b920d79f83da33f17f438d98c8d50435d0daa2dd86bd016476b2ac6ad01eff32e319e3dc59c626055199700d5aab2474033c1e3b89
-
MD5
72ef80f6b0c1a47d31c484a70102da6d
SHA17bb39695b3725405cbc15d4f2d619b95785e9f3c
SHA256005163f5ad610630788d4227b9ac99574c38951f55ec8a8ff22c1e3b2c7706a0
SHA5129c6e95f7caa6219cbeb940b920d79f83da33f17f438d98c8d50435d0daa2dd86bd016476b2ac6ad01eff32e319e3dc59c626055199700d5aab2474033c1e3b89