Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 00:16
Static task
static1
Behavioral task
behavioral1
Sample
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe
Resource
win10-en-20211208
General
-
Target
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe
-
Size
89KB
-
MD5
2adc305f890f51bd97edbece913abc33
-
SHA1
07b911db2b0718e2b0afcf6b8b2fd47d28934b85
-
SHA256
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788
-
SHA512
db3e879f10c414490368d3525275a16b7005d2abe9ebb8ed60692a67b8da9e6ed6cc4e47244cdc06c7c505ea500075fc8af07cb4d11660a61ced92805bbade75
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1252 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 812 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exepid process 944 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exedescription pid process Token: SeIncBasePriorityPrivilege 944 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.execmd.exedescription pid process target process PID 944 wrote to memory of 1252 944 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe MediaCenter.exe PID 944 wrote to memory of 1252 944 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe MediaCenter.exe PID 944 wrote to memory of 1252 944 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe MediaCenter.exe PID 944 wrote to memory of 1252 944 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe MediaCenter.exe PID 944 wrote to memory of 812 944 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe cmd.exe PID 944 wrote to memory of 812 944 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe cmd.exe PID 944 wrote to memory of 812 944 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe cmd.exe PID 944 wrote to memory of 812 944 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe cmd.exe PID 812 wrote to memory of 1864 812 cmd.exe PING.EXE PID 812 wrote to memory of 1864 812 cmd.exe PING.EXE PID 812 wrote to memory of 1864 812 cmd.exe PING.EXE PID 812 wrote to memory of 1864 812 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe"C:\Users\Admin\AppData\Local\Temp\e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1252 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1864
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
63aa66b4b63f495ae75a1776aa53bb24
SHA10001f6597bd147c5571af2188e485f12e73ee64a
SHA256ee2673a5d1007a6d494b58b87708f883ddafd95e3b92e2cd6050be2c7b893e74
SHA51295228b7fcf9b5a2127ff700d3016d717293224f8785c2a6748513f00935846ad4c29a59640da46c4ebdd0c1cfec7aa56315ba093daefd889e0bef103a930e3c9
-
MD5
63aa66b4b63f495ae75a1776aa53bb24
SHA10001f6597bd147c5571af2188e485f12e73ee64a
SHA256ee2673a5d1007a6d494b58b87708f883ddafd95e3b92e2cd6050be2c7b893e74
SHA51295228b7fcf9b5a2127ff700d3016d717293224f8785c2a6748513f00935846ad4c29a59640da46c4ebdd0c1cfec7aa56315ba093daefd889e0bef103a930e3c9