Analysis
-
max time kernel
123s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 22:30
Static task
static1
Behavioral task
behavioral1
Sample
88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe
Resource
win10-en-20211208
General
-
Target
88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe
-
Size
92KB
-
MD5
1472fffe307ad13669420021f9a2c722
-
SHA1
6fa088f9d4723693533fce1e0034726fd554753a
-
SHA256
88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962
-
SHA512
fc3b5afcf6531728cec3489e691468cf1bd7d7b8efa3e0b06a4dfcb1a35e8a5c0f5eaaecb0e1729658236875a1f685db769ef3064a1101a8cdcd34cc231c0d43
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2724 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" 88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exedescription pid process Token: SeIncBasePriorityPrivilege 2540 88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.execmd.exedescription pid process target process PID 2540 wrote to memory of 2724 2540 88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe AdobeUpdate.exe PID 2540 wrote to memory of 2724 2540 88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe AdobeUpdate.exe PID 2540 wrote to memory of 2724 2540 88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe AdobeUpdate.exe PID 2540 wrote to memory of 3148 2540 88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe cmd.exe PID 2540 wrote to memory of 3148 2540 88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe cmd.exe PID 2540 wrote to memory of 3148 2540 88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe cmd.exe PID 3148 wrote to memory of 3648 3148 cmd.exe PING.EXE PID 3148 wrote to memory of 3648 3148 cmd.exe PING.EXE PID 3148 wrote to memory of 3648 3148 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe"C:\Users\Admin\AppData\Local\Temp\88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\88dd93965cdb2eed912fe59d6d014309b8b1de08bd0471f6f60b275a5077a962.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d44dab8ae837cad935f237677c5bfa4b
SHA1559205d743957a01e5136bfa87dcaa426d5411fe
SHA2568de023c954592161bc01cd6ee49a177deed12ef50762eb34318d6ab334049540
SHA5125524a8de1a0db1648af2624c5c8699a96943ecfb120220e2d40fa9ff20d00e06afaccfd828c7c45fcefacd4261c59f01048a55855013f9145f5701566eed7022
-
MD5
d44dab8ae837cad935f237677c5bfa4b
SHA1559205d743957a01e5136bfa87dcaa426d5411fe
SHA2568de023c954592161bc01cd6ee49a177deed12ef50762eb34318d6ab334049540
SHA5125524a8de1a0db1648af2624c5c8699a96943ecfb120220e2d40fa9ff20d00e06afaccfd828c7c45fcefacd4261c59f01048a55855013f9145f5701566eed7022