Analysis
-
max time kernel
172s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
12-02-2022 08:06
Static task
static1
Behavioral task
behavioral1
Sample
0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe
Resource
win10v2004-en-20220112
General
-
Target
0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe
-
Size
216KB
-
MD5
cbfe923d42b26516f01e97635ae0c88d
-
SHA1
328d59e05a3aefaf4bed86c98dff64f396b9cc02
-
SHA256
0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09
-
SHA512
fb0fbd91b340917bad95bda9462c2fe18cd66685666a86d453ba762d3ea462f67f6bf4e40128b15645aaf192470122fd1235b5c92447dcb45557f2b9abdba4d7
Malware Config
Signatures
-
Sakula Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/2372-132-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula behavioral2/memory/3516-133-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
-
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3516 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe -
Drops file in Windows directory 3 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 49 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.378172" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4172" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.005370" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4312" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132893034454818648" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exeTiWorker.exedescription pid process Token: SeIncBasePriorityPrivilege 2372 0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe Token: SeBackupPrivilege 3476 TiWorker.exe Token: SeRestorePrivilege 3476 TiWorker.exe Token: SeSecurityPrivilege 3476 TiWorker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.execmd.exedescription pid process target process PID 2372 wrote to memory of 3516 2372 0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe MediaCenter.exe PID 2372 wrote to memory of 3516 2372 0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe MediaCenter.exe PID 2372 wrote to memory of 3516 2372 0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe MediaCenter.exe PID 2372 wrote to memory of 3004 2372 0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe cmd.exe PID 2372 wrote to memory of 3004 2372 0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe cmd.exe PID 2372 wrote to memory of 3004 2372 0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe cmd.exe PID 3004 wrote to memory of 3028 3004 cmd.exe PING.EXE PID 3004 wrote to memory of 3028 3004 cmd.exe PING.EXE PID 3004 wrote to memory of 3028 3004 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe"C:\Users\Admin\AppData\Local\Temp\0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3516 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0bb1747bb8b3ae57c3d7158eccced68ccd306d65b8073eca5b0a95a536fcac09.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3028
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3552
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:696
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3476
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
04e93b8439e85888d894e69b5bcc2af9
SHA1db3dfcfc155f7f999459bee65db20a75e6ad215d
SHA2560f1e7b7bcd51415e8b914285c61cd98a799bf359959399cca4ffc83412b61303
SHA5127366d7193f86223b387276ae27ce6e4f0dd21bebf2c7a203b4956c41402aa2e2becbc58b85b125da0d6f825ac53714020d2c21ca60e1823de92e4c7fc6652bd1
-
MD5
04e93b8439e85888d894e69b5bcc2af9
SHA1db3dfcfc155f7f999459bee65db20a75e6ad215d
SHA2560f1e7b7bcd51415e8b914285c61cd98a799bf359959399cca4ffc83412b61303
SHA5127366d7193f86223b387276ae27ce6e4f0dd21bebf2c7a203b4956c41402aa2e2becbc58b85b125da0d6f825ac53714020d2c21ca60e1823de92e4c7fc6652bd1