Analysis
-
max time kernel
186s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
12-02-2022 04:56
General
-
Target
13ffc08eaadcd0cd657f4a970e44c7266bd9cec16755595985ad218f5be124dd.exe
-
Size
60KB
-
MD5
b0fc0d8258025c8138b7c0f780383c3d
-
SHA1
335724c68aeaebc6b8155cb472979f6998df6e2f
-
SHA256
13ffc08eaadcd0cd657f4a970e44c7266bd9cec16755595985ad218f5be124dd
-
SHA512
4947bca4b299a5ec2278643f67a74e70c51fd035da1f6b1c95b7db33ea6fd843cf369c9d1676da8aa044e66d4ee57ffbf423b5db4ddd5c5af360786e0a4eaee8
Malware Config
Signatures
-
Sakula
Sakula is a remote access trojan with various capabilities.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 49 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13ffc08eaadcd0cd657f4a970e44c7266bd9cec16755595985ad218f5be124dd.exe"C:\Users\Admin\AppData\Local\Temp\13ffc08eaadcd0cd657f4a970e44c7266bd9cec16755595985ad218f5be124dd.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\13ffc08eaadcd0cd657f4a970e44c7266bd9cec16755595985ad218f5be124dd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
bb53e9983903c04fb329d29cac2f47cd
SHA1622f114360ff4ed04eb611b2f9617d6ef8cf7df0
SHA256adf9a94d0980c86fdc726b4ae5d3b452989f2b15791e06533bbddf1e626b63b7
SHA512c9bb544a65a0ea1b49e10d2fe566a1a49dc762f3e1194ac2b10b0ce62e312cddf4a77da0722395d4d7adfd8a39ec90d23079512abfaf9551d3d55973fd9f8744
-
MD5
bb53e9983903c04fb329d29cac2f47cd
SHA1622f114360ff4ed04eb611b2f9617d6ef8cf7df0
SHA256adf9a94d0980c86fdc726b4ae5d3b452989f2b15791e06533bbddf1e626b63b7
SHA512c9bb544a65a0ea1b49e10d2fe566a1a49dc762f3e1194ac2b10b0ce62e312cddf4a77da0722395d4d7adfd8a39ec90d23079512abfaf9551d3d55973fd9f8744