Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
12-02-2022 09:18
Static task
static1
Behavioral task
behavioral1
Sample
0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe
Resource
win10v2004-en-20220112
General
-
Target
0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe
-
Size
92KB
-
MD5
08899e9f590078050999c75c94a6878b
-
SHA1
92c981a580c64e8cfe4f73dd64c242de8306cf91
-
SHA256
0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d
-
SHA512
b54bf9e4f40c3a480c58df87148b80924a8ea70bba080a8b67f7f0c8f4d67cca4397678566bf0d5a1d75d680e714c1fd5785fb5055c705584debed074df9d9b8
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
-
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1816 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe -
Drops file in Windows directory 3 IoCs
Processes:
svchost.exeTiWorker.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 51 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4092" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "7.499400" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4364" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.166566" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4156" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "33.362016" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132893075498089841" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
TiWorker.exe0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exedescription pid process Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeIncBasePriorityPrivilege 3872 0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe Token: SeBackupPrivilege 3848 TiWorker.exe Token: SeRestorePrivilege 3848 TiWorker.exe Token: SeSecurityPrivilege 3848 TiWorker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.execmd.exedescription pid process target process PID 3872 wrote to memory of 1816 3872 0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe MediaCenter.exe PID 3872 wrote to memory of 1816 3872 0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe MediaCenter.exe PID 3872 wrote to memory of 1816 3872 0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe MediaCenter.exe PID 3872 wrote to memory of 1280 3872 0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe cmd.exe PID 3872 wrote to memory of 1280 3872 0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe cmd.exe PID 3872 wrote to memory of 1280 3872 0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe cmd.exe PID 1280 wrote to memory of 2868 1280 cmd.exe PING.EXE PID 1280 wrote to memory of 2868 1280 cmd.exe PING.EXE PID 1280 wrote to memory of 2868 1280 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe"C:\Users\Admin\AppData\Local\Temp\0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0a7716f1181b101b8796a6b4dea2fee17b815378939afae70f1f71626ef9935d.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2868
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3412
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1180
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
f1df7a9d9c1620cb2f9a8760dc2fcd54
SHA1c9419f7c17c794fb5aacb4d6c89bf19de9327ca7
SHA256bf36863579ebf4cf55618c7a7cd535aeab488f0a7c615bd5135bb0bd21272fc8
SHA512226cc220572834af509da712a956cf828e70472110483e649085748771970381b1e65559c66af4352e3fee0fb0335bb3b2380fe49f9def679f3dcd6215f202cf
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
f1df7a9d9c1620cb2f9a8760dc2fcd54
SHA1c9419f7c17c794fb5aacb4d6c89bf19de9327ca7
SHA256bf36863579ebf4cf55618c7a7cd535aeab488f0a7c615bd5135bb0bd21272fc8
SHA512226cc220572834af509da712a956cf828e70472110483e649085748771970381b1e65559c66af4352e3fee0fb0335bb3b2380fe49f9def679f3dcd6215f202cf