Analysis
-
max time kernel
173s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
12-02-2022 03:46
Static task
static1
Behavioral task
behavioral1
Sample
16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe
Resource
win10v2004-en-20220112
General
-
Target
16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe
-
Size
150KB
-
MD5
75cb4f8b882a933ddd6f5374523e3c3a
-
SHA1
050e2475b0ec72da8e1db082a645b4f889b4095a
-
SHA256
16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d
-
SHA512
a463097a0183d30e2b243d793e9b4992560faab8ae52384840ccfd10b07848d74dfe6a7cd4a82454784919f86e822f009f009a25906794e8e6dc373d68ce51cb
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
-
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2580 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe -
Drops file in Windows directory 3 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 50 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "16.691486" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "1.801799" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4144" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "1.999887" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132892876888405269" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4368" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4360" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
TiWorker.exe16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exedescription pid process Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeIncBasePriorityPrivilege 2280 16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe Token: SeBackupPrivilege 2024 TiWorker.exe Token: SeRestorePrivilege 2024 TiWorker.exe Token: SeSecurityPrivilege 2024 TiWorker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.execmd.exedescription pid process target process PID 2280 wrote to memory of 2580 2280 16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe MediaCenter.exe PID 2280 wrote to memory of 2580 2280 16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe MediaCenter.exe PID 2280 wrote to memory of 2580 2280 16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe MediaCenter.exe PID 2280 wrote to memory of 400 2280 16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe cmd.exe PID 2280 wrote to memory of 400 2280 16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe cmd.exe PID 2280 wrote to memory of 400 2280 16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe cmd.exe PID 400 wrote to memory of 2800 400 cmd.exe PING.EXE PID 400 wrote to memory of 2800 400 cmd.exe PING.EXE PID 400 wrote to memory of 2800 400 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe"C:\Users\Admin\AppData\Local\Temp\16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\16d65a39c8b640d539450f57f0fb8b76537597ecf3f784b976a33f4d2a35e60d.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2800
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2564
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1692
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2024
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
e54f675b0955a69cb6d6ef97a11fb982
SHA1574be217d59b8811250cdfe8d92e4ab810b7d0df
SHA25699ad7130a9d46e1dffe8c30dee62456be7c982e0b88e4e117567d11c715e924d
SHA512adaaab8d6fd7e6b54812634d5cfb96351eba4f7717dc05f7a838d4fce2890278fa0de489d2b8e84d89df6af534fac9458bb814aa01d5fc895ec6430ef509a5a6
-
MD5
e54f675b0955a69cb6d6ef97a11fb982
SHA1574be217d59b8811250cdfe8d92e4ab810b7d0df
SHA25699ad7130a9d46e1dffe8c30dee62456be7c982e0b88e4e117567d11c715e924d
SHA512adaaab8d6fd7e6b54812634d5cfb96351eba4f7717dc05f7a838d4fce2890278fa0de489d2b8e84d89df6af534fac9458bb814aa01d5fc895ec6430ef509a5a6