Analysis
-
max time kernel
159s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
12-02-2022 05:31
Static task
static1
Behavioral task
behavioral1
Sample
127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe
Resource
win10v2004-en-20220112
General
-
Target
127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe
-
Size
120KB
-
MD5
1908c0600cc9df5e3735b2790f631e5b
-
SHA1
17505ef620b6c7a104b99d795aa0470be7ab5743
-
SHA256
127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e
-
SHA512
1cec77b36f6841e21840f526edf4afb432a994b0d28ff262ac41c5b37905e80a7f149786501918a79b45d1fa0bcd1a82a8c29bea90ef978df4acdf60e43871dd
Malware Config
Signatures
-
Sakula Payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/772-132-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3712 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe -
Drops file in Windows directory 3 IoCs
Processes:
svchost.exeTiWorker.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 49 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "1.807189" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132892940454620357" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4088" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.167505" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4200" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exeTiWorker.exedescription pid process Token: SeIncBasePriorityPrivilege 772 127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe Token: SeBackupPrivilege 3360 TiWorker.exe Token: SeRestorePrivilege 3360 TiWorker.exe Token: SeSecurityPrivilege 3360 TiWorker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.execmd.exedescription pid process target process PID 772 wrote to memory of 3712 772 127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe MediaCenter.exe PID 772 wrote to memory of 3712 772 127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe MediaCenter.exe PID 772 wrote to memory of 3712 772 127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe MediaCenter.exe PID 772 wrote to memory of 1964 772 127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe cmd.exe PID 772 wrote to memory of 1964 772 127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe cmd.exe PID 772 wrote to memory of 1964 772 127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe cmd.exe PID 1964 wrote to memory of 3304 1964 cmd.exe PING.EXE PID 1964 wrote to memory of 3304 1964 cmd.exe PING.EXE PID 1964 wrote to memory of 3304 1964 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe"C:\Users\Admin\AppData\Local\Temp\127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\127961a581509b5e3a3b13403711a98b22a442afc3c66c893b056d988a65c70e.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3304
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:776
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3360
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
29b20119b86f20afda95414271d0cd69
SHA1fdcc1e495cb2b27f7de0dc00bfc1dc8f1c4cb301
SHA256b6bb1e2b8db96617fc16a891adc003c012f9a9f8a90a085930131dbc207f4245
SHA512a315f511ff661ac07cc5134a58436444e1e27f2fcfd0126f4ef056781ae0f99840196934c84ac9b6e3b07090373111e0ad9f74f407e95aefd43ea5bc95ad1dbf
-
MD5
29b20119b86f20afda95414271d0cd69
SHA1fdcc1e495cb2b27f7de0dc00bfc1dc8f1c4cb301
SHA256b6bb1e2b8db96617fc16a891adc003c012f9a9f8a90a085930131dbc207f4245
SHA512a315f511ff661ac07cc5134a58436444e1e27f2fcfd0126f4ef056781ae0f99840196934c84ac9b6e3b07090373111e0ad9f74f407e95aefd43ea5bc95ad1dbf