Analysis
-
max time kernel
177s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
12-02-2022 08:03
Static task
static1
Behavioral task
behavioral1
Sample
0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe
Resource
win10v2004-en-20220112
General
-
Target
0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe
-
Size
160KB
-
MD5
ea5e5936f486ad81b5aef29df98e4c64
-
SHA1
cc6e6fb74252d0c9ea1b6248b1d0dab6741b56ef
-
SHA256
0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304
-
SHA512
624a89eff33a8c94541cb75cb8f49a202057fc2fc45aa4ec310c73e93cc658ca1ddc9b31d7491d8d4ea0583bf7d64962ce88eecd5f4933e651560be8dbfdb77f
Malware Config
Signatures
-
Sakula Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/3324-132-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula behavioral2/memory/396-133-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
-
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 396 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe -
Drops file in Windows directory 3 IoCs
Processes:
svchost.exeTiWorker.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 49 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4288" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4072" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "6.522313" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132893032287610068" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.083292" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
TiWorker.exe0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exedescription pid process Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeIncBasePriorityPrivilege 3324 0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe Token: SeBackupPrivilege 1724 TiWorker.exe Token: SeRestorePrivilege 1724 TiWorker.exe Token: SeSecurityPrivilege 1724 TiWorker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.execmd.exedescription pid process target process PID 3324 wrote to memory of 396 3324 0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe MediaCenter.exe PID 3324 wrote to memory of 396 3324 0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe MediaCenter.exe PID 3324 wrote to memory of 396 3324 0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe MediaCenter.exe PID 3324 wrote to memory of 3260 3324 0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe cmd.exe PID 3324 wrote to memory of 3260 3324 0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe cmd.exe PID 3324 wrote to memory of 3260 3324 0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe cmd.exe PID 3260 wrote to memory of 1224 3260 cmd.exe PING.EXE PID 3260 wrote to memory of 1224 3260 cmd.exe PING.EXE PID 3260 wrote to memory of 1224 3260 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe"C:\Users\Admin\AppData\Local\Temp\0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:396 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0bd70383a40e0113087506393e46b6ff44908554c120c61dca1d8edfbc787304.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1224
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:396
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1596
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
dd0948e89f4dad334e9227753e2c2506
SHA1f929df69310a171a6e539d0862791e2dd10adaa8
SHA256caaa9144248ccb35f5af949eef3b9da28b48f83796bf9b9ead10202d5b341d8d
SHA51293e59a4acea48e33ddfc05ef1744f0350d9f5eb7db58f058b37ff803880c267d6e65f95f3158dd49c7f44617f15e6116dedf8d13a3baf1088508572f28f87802
-
MD5
dd0948e89f4dad334e9227753e2c2506
SHA1f929df69310a171a6e539d0862791e2dd10adaa8
SHA256caaa9144248ccb35f5af949eef3b9da28b48f83796bf9b9ead10202d5b341d8d
SHA51293e59a4acea48e33ddfc05ef1744f0350d9f5eb7db58f058b37ff803880c267d6e65f95f3158dd49c7f44617f15e6116dedf8d13a3baf1088508572f28f87802