Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
22-01-2022 00:06
Static task
static1
Behavioral task
behavioral1
Sample
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe
Resource
win10-en-20211208
General
-
Target
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe
-
Size
92KB
-
MD5
ec85830342217b5d03f6bd26a703ce1a
-
SHA1
b63c0a89da5862f58068e10a7c9e2b624c98a9d3
-
SHA256
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2
-
SHA512
d8d5501127a888104e1a71b943f60926b0db7f9bfc4fabbb15a804d2490af74f0c65d50b9030d34da6ec124d55ddb6bc50ee784ee65ccac6ca2337c9c6985ec8
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2784 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exedescription pid process Token: SeIncBasePriorityPrivilege 2460 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.execmd.exedescription pid process target process PID 2460 wrote to memory of 2784 2460 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe AdobeUpdate.exe PID 2460 wrote to memory of 2784 2460 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe AdobeUpdate.exe PID 2460 wrote to memory of 2784 2460 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe AdobeUpdate.exe PID 2460 wrote to memory of 3584 2460 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe cmd.exe PID 2460 wrote to memory of 3584 2460 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe cmd.exe PID 2460 wrote to memory of 3584 2460 b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe cmd.exe PID 3584 wrote to memory of 1292 3584 cmd.exe PING.EXE PID 3584 wrote to memory of 1292 3584 cmd.exe PING.EXE PID 3584 wrote to memory of 1292 3584 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe"C:\Users\Admin\AppData\Local\Temp\b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\b6e361c3ca2ba8125e7179a31a2610b53505f3f2d756dfb3656f771c0d97dca2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1292
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
2c27a09806a36881c7b5715731cb5e37
SHA1490a01df0d8b6fcf166a45646bd97e998b7a33ea
SHA256eb7b2442b2755451c8c52c92d07126b22bf1148a74aafcf60249df835cc9f8e5
SHA512c10f96530442e1496994b5a603674e4ea0851c7bd5a6e03d47da0d5d18060953c8b1681405ae1d5ac055e664d3c7dc16838e965a3ca098128c4d703479453e28
-
MD5
2c27a09806a36881c7b5715731cb5e37
SHA1490a01df0d8b6fcf166a45646bd97e998b7a33ea
SHA256eb7b2442b2755451c8c52c92d07126b22bf1148a74aafcf60249df835cc9f8e5
SHA512c10f96530442e1496994b5a603674e4ea0851c7bd5a6e03d47da0d5d18060953c8b1681405ae1d5ac055e664d3c7dc16838e965a3ca098128c4d703479453e28