Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
31-01-2022 00:16
Static task
static1
Behavioral task
behavioral1
Sample
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe
Resource
win10-en-20211208
General
-
Target
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe
-
Size
89KB
-
MD5
2adc305f890f51bd97edbece913abc33
-
SHA1
07b911db2b0718e2b0afcf6b8b2fd47d28934b85
-
SHA256
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788
-
SHA512
db3e879f10c414490368d3525275a16b7005d2abe9ebb8ed60692a67b8da9e6ed6cc4e47244cdc06c7c505ea500075fc8af07cb4d11660a61ced92805bbade75
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1180 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exedescription pid process Token: SeIncBasePriorityPrivilege 920 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.execmd.exedescription pid process target process PID 920 wrote to memory of 1180 920 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe MediaCenter.exe PID 920 wrote to memory of 1180 920 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe MediaCenter.exe PID 920 wrote to memory of 1180 920 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe MediaCenter.exe PID 920 wrote to memory of 1016 920 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe cmd.exe PID 920 wrote to memory of 1016 920 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe cmd.exe PID 920 wrote to memory of 1016 920 e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe cmd.exe PID 1016 wrote to memory of 1828 1016 cmd.exe PING.EXE PID 1016 wrote to memory of 1828 1016 cmd.exe PING.EXE PID 1016 wrote to memory of 1828 1016 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe"C:\Users\Admin\AppData\Local\Temp\e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1180 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\e7a3e3b6c1505bc81f1844632429dfb9111fb6da3b50bec2eea8a9c5b10c0788.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1828
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
8f6f94dcebff818bbd53c0c8e3ecb254
SHA18564fc1f0b6b8471ab6f50f09fba87718bf02b79
SHA256664bf7dd9d136d52b188aea55284111c008989e8871a6ec8164aafe15a07aa5d
SHA5126cdd2a16f16f0c5f7b1d67d348c909e89523650de3dba0916969aec86d20d8f535b9b0d85594cd93cf543446b639cbc00d523b7d6c18facfc523527feece8eca
-
MD5
8f6f94dcebff818bbd53c0c8e3ecb254
SHA18564fc1f0b6b8471ab6f50f09fba87718bf02b79
SHA256664bf7dd9d136d52b188aea55284111c008989e8871a6ec8164aafe15a07aa5d
SHA5126cdd2a16f16f0c5f7b1d67d348c909e89523650de3dba0916969aec86d20d8f535b9b0d85594cd93cf543446b639cbc00d523b7d6c18facfc523527feece8eca