Analysis
-
max time kernel
128s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 02:50
Static task
static1
Behavioral task
behavioral1
Sample
195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe
Resource
win10v2004-en-20220113
General
-
Target
195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe
-
Size
36KB
-
MD5
9cde14dc0aebafb60af5a67654cb84a8
-
SHA1
5316dfbcb178e438f869746ca8a2edd4a2491c5c
-
SHA256
195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b
-
SHA512
af88ed25d6dbea45725d7cedc422f0fc83e5ba7f2a2478b3d2408305d8858c8aa5b533817073a3e6354578c988424adbb0d9dd0e8356a24dc1f6269ab913e082
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1652-56-0x0000000000B70000-0x0000000000B89000-memory.dmp family_sakula behavioral1/memory/1872-61-0x0000000000E60000-0x0000000000E79000-memory.dmp family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1872 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1956 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exepid process 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exedescription pid process Token: SeIncBasePriorityPrivilege 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.execmd.exedescription pid process target process PID 1652 wrote to memory of 1872 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe MediaCenter.exe PID 1652 wrote to memory of 1872 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe MediaCenter.exe PID 1652 wrote to memory of 1872 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe MediaCenter.exe PID 1652 wrote to memory of 1872 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe MediaCenter.exe PID 1652 wrote to memory of 1956 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe cmd.exe PID 1652 wrote to memory of 1956 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe cmd.exe PID 1652 wrote to memory of 1956 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe cmd.exe PID 1652 wrote to memory of 1956 1652 195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe cmd.exe PID 1956 wrote to memory of 1084 1956 cmd.exe PING.EXE PID 1956 wrote to memory of 1084 1956 cmd.exe PING.EXE PID 1956 wrote to memory of 1084 1956 cmd.exe PING.EXE PID 1956 wrote to memory of 1084 1956 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe"C:\Users\Admin\AppData\Local\Temp\195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1872 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1084
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
b11112a9f9d35a97d294cb618d3d21cc
SHA1363c17bb64eab9e5744a6067748773a9a35b55c6
SHA256a1d69d4415a12968bb69f7bd32634dba77e569c6f7b7fd888575816d1b4c08f0
SHA512285ae823dd102176507ac3893994daabe3e044fc1492a92016ada6febe33bc5d76bc2bdec7a67683984f923d62308ffcbca79bd9300b4c04a03e45a24053dfdd
-
MD5
b11112a9f9d35a97d294cb618d3d21cc
SHA1363c17bb64eab9e5744a6067748773a9a35b55c6
SHA256a1d69d4415a12968bb69f7bd32634dba77e569c6f7b7fd888575816d1b4c08f0
SHA512285ae823dd102176507ac3893994daabe3e044fc1492a92016ada6febe33bc5d76bc2bdec7a67683984f923d62308ffcbca79bd9300b4c04a03e45a24053dfdd
-
MD5
b11112a9f9d35a97d294cb618d3d21cc
SHA1363c17bb64eab9e5744a6067748773a9a35b55c6
SHA256a1d69d4415a12968bb69f7bd32634dba77e569c6f7b7fd888575816d1b4c08f0
SHA512285ae823dd102176507ac3893994daabe3e044fc1492a92016ada6febe33bc5d76bc2bdec7a67683984f923d62308ffcbca79bd9300b4c04a03e45a24053dfdd