Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22-01-2022 00:06
Static task
static1
Behavioral task
behavioral1
Sample
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe
Resource
win10-en-20211208
General
-
Target
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe
-
Size
92KB
-
MD5
ec85830342217b5d03f6bd26a703ce1a
-
SHA1
b63c0a89da5862f58068e10a7c9e2b624c98a9d3
-
SHA256
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2
-
SHA512
d8d5501127a888104e1a71b943f60926b0db7f9bfc4fabbb15a804d2490af74f0c65d50b9030d34da6ec124d55ddb6bc50ee784ee65ccac6ca2337c9c6985ec8
Malware Config
Signatures
-
Sakula Payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 1720 AdobeUpdate.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1640 cmd.exe -
Loads dropped DLL 4 IoCs
Processes:
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exeAdobeUpdate.exepid process 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe 1720 AdobeUpdate.exe 1720 AdobeUpdate.exe 1720 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exedescription pid process Token: SeIncBasePriorityPrivilege 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.execmd.exedescription pid process target process PID 760 wrote to memory of 1720 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe AdobeUpdate.exe PID 760 wrote to memory of 1720 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe AdobeUpdate.exe PID 760 wrote to memory of 1720 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe AdobeUpdate.exe PID 760 wrote to memory of 1720 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe AdobeUpdate.exe PID 760 wrote to memory of 1720 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe AdobeUpdate.exe PID 760 wrote to memory of 1720 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe AdobeUpdate.exe PID 760 wrote to memory of 1720 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe AdobeUpdate.exe PID 760 wrote to memory of 1640 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe cmd.exe PID 760 wrote to memory of 1640 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe cmd.exe PID 760 wrote to memory of 1640 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe cmd.exe PID 760 wrote to memory of 1640 760 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe cmd.exe PID 1640 wrote to memory of 1100 1640 cmd.exe PING.EXE PID 1640 wrote to memory of 1100 1640 cmd.exe PING.EXE PID 1640 wrote to memory of 1100 1640 cmd.exe PING.EXE PID 1640 wrote to memory of 1100 1640 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe"C:\Users\Admin\AppData\Local\Temp\b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1100
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
b4ae0fc0d087352cac0a7b163b699a24
SHA137157ac06becc12097e76d4276e610b1e21c5b37
SHA25660240828ec37e8a2c0b33a6dcf2c5e38edcf49f2d5b1686b5fb932e4083f347c
SHA5129712e8cdb54e1533a72e4232f0b7da4cffbac09422a070d14eb001c1e55ca33e26cf13c93251a797cd4c2831d32265018a87f8f53ddd3a1d4c87826009e1029c
-
MD5
b4ae0fc0d087352cac0a7b163b699a24
SHA137157ac06becc12097e76d4276e610b1e21c5b37
SHA25660240828ec37e8a2c0b33a6dcf2c5e38edcf49f2d5b1686b5fb932e4083f347c
SHA5129712e8cdb54e1533a72e4232f0b7da4cffbac09422a070d14eb001c1e55ca33e26cf13c93251a797cd4c2831d32265018a87f8f53ddd3a1d4c87826009e1029c
-
MD5
b4ae0fc0d087352cac0a7b163b699a24
SHA137157ac06becc12097e76d4276e610b1e21c5b37
SHA25660240828ec37e8a2c0b33a6dcf2c5e38edcf49f2d5b1686b5fb932e4083f347c
SHA5129712e8cdb54e1533a72e4232f0b7da4cffbac09422a070d14eb001c1e55ca33e26cf13c93251a797cd4c2831d32265018a87f8f53ddd3a1d4c87826009e1029c
-
MD5
b4ae0fc0d087352cac0a7b163b699a24
SHA137157ac06becc12097e76d4276e610b1e21c5b37
SHA25660240828ec37e8a2c0b33a6dcf2c5e38edcf49f2d5b1686b5fb932e4083f347c
SHA5129712e8cdb54e1533a72e4232f0b7da4cffbac09422a070d14eb001c1e55ca33e26cf13c93251a797cd4c2831d32265018a87f8f53ddd3a1d4c87826009e1029c
-
MD5
b4ae0fc0d087352cac0a7b163b699a24
SHA137157ac06becc12097e76d4276e610b1e21c5b37
SHA25660240828ec37e8a2c0b33a6dcf2c5e38edcf49f2d5b1686b5fb932e4083f347c
SHA5129712e8cdb54e1533a72e4232f0b7da4cffbac09422a070d14eb001c1e55ca33e26cf13c93251a797cd4c2831d32265018a87f8f53ddd3a1d4c87826009e1029c
-
MD5
b4ae0fc0d087352cac0a7b163b699a24
SHA137157ac06becc12097e76d4276e610b1e21c5b37
SHA25660240828ec37e8a2c0b33a6dcf2c5e38edcf49f2d5b1686b5fb932e4083f347c
SHA5129712e8cdb54e1533a72e4232f0b7da4cffbac09422a070d14eb001c1e55ca33e26cf13c93251a797cd4c2831d32265018a87f8f53ddd3a1d4c87826009e1029c