Analysis
-
max time kernel
167s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
12-02-2022 03:00
Static task
static1
Behavioral task
behavioral1
Sample
18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe
Resource
win10v2004-en-20220112
General
-
Target
18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe
-
Size
100KB
-
MD5
633106a3684ff74c024334120b22991c
-
SHA1
5496a3cd81722cd99a92c26ae21f9666af02ed80
-
SHA256
18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c
-
SHA512
918ffbba177f1bafa334bdbf6c1db47881a0420ab48b68d6d4aa46c1a1e100e3345934626b7413fc2e91e5ef4a3c22e5bbe94d0861c5eea71d8123d9e55d8ca5
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2376 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe -
Drops file in Windows directory 3 IoCs
Processes:
svchost.exeTiWorker.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 53 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "12.904467" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132892849013656892" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4076" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "9.996379" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4240" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.028313" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exeTiWorker.exedescription pid process Token: SeIncBasePriorityPrivilege 3348 18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe Token: SeBackupPrivilege 364 TiWorker.exe Token: SeRestorePrivilege 364 TiWorker.exe Token: SeSecurityPrivilege 364 TiWorker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.execmd.exedescription pid process target process PID 3348 wrote to memory of 2376 3348 18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe MediaCenter.exe PID 3348 wrote to memory of 2376 3348 18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe MediaCenter.exe PID 3348 wrote to memory of 2376 3348 18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe MediaCenter.exe PID 3348 wrote to memory of 1916 3348 18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe cmd.exe PID 3348 wrote to memory of 1916 3348 18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe cmd.exe PID 3348 wrote to memory of 1916 3348 18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe cmd.exe PID 1916 wrote to memory of 2084 1916 cmd.exe PING.EXE PID 1916 wrote to memory of 2084 1916 cmd.exe PING.EXE PID 1916 wrote to memory of 2084 1916 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe"C:\Users\Admin\AppData\Local\Temp\18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\18d19f5386fcb5e3795d29bb256aadb27c223ab1a972c9ceb72d0916ae671c0c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2084
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3180
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2468
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:364
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
0766867c7859eb7c8f71042ef6beadb3
SHA121c4a0a779c0f9fcb64ab9ab3ad9700ed9528c51
SHA256be30614f18345c356385e7a26d614c2606f90053a647182cb03552ede381894d
SHA5126a9aa17fd8432f69cbb7abc07ab539b33e525762c0336ce8f9a7efb167a812ddde428ebbf38e94ec27d65ab71d2360e5d919166121c1e44a2bba1c554062d61a
-
MD5
0766867c7859eb7c8f71042ef6beadb3
SHA121c4a0a779c0f9fcb64ab9ab3ad9700ed9528c51
SHA256be30614f18345c356385e7a26d614c2606f90053a647182cb03552ede381894d
SHA5126a9aa17fd8432f69cbb7abc07ab539b33e525762c0336ce8f9a7efb167a812ddde428ebbf38e94ec27d65ab71d2360e5d919166121c1e44a2bba1c554062d61a