Analysis
-
max time kernel
179s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
12-02-2022 10:08
Static task
static1
Behavioral task
behavioral1
Sample
0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe
Resource
win10v2004-en-20220112
General
-
Target
0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe
-
Size
216KB
-
MD5
fb6030327e8709c598b822188f1f9766
-
SHA1
d3da2b879bc8dc259668e497c03b7b6e6cb8a2b2
-
SHA256
0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99
-
SHA512
88e5ca2001462242d13ece6bafa95e15afb23b692b50ce775e3c27862127dba27643bee7f7e7355b776206ddbce6dcd3223ff3647880cf70c6a3bde5b0d42307
Malware Config
Signatures
-
Sakula Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/3808-132-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula behavioral2/memory/3032-133-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3032 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe -
Drops file in Windows directory 3 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 50 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132893113114980574" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.299399" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.300752" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4336" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4192" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4320" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exeTiWorker.exedescription pid process Token: SeIncBasePriorityPrivilege 3808 0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe Token: SeBackupPrivilege 4052 TiWorker.exe Token: SeRestorePrivilege 4052 TiWorker.exe Token: SeSecurityPrivilege 4052 TiWorker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.execmd.exedescription pid process target process PID 3808 wrote to memory of 3032 3808 0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe MediaCenter.exe PID 3808 wrote to memory of 3032 3808 0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe MediaCenter.exe PID 3808 wrote to memory of 3032 3808 0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe MediaCenter.exe PID 3808 wrote to memory of 1552 3808 0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe cmd.exe PID 3808 wrote to memory of 1552 3808 0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe cmd.exe PID 3808 wrote to memory of 1552 3808 0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe cmd.exe PID 1552 wrote to memory of 3860 1552 cmd.exe PING.EXE PID 1552 wrote to memory of 3860 1552 cmd.exe PING.EXE PID 1552 wrote to memory of 3860 1552 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe"C:\Users\Admin\AppData\Local\Temp\0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0804ddb0949f63423c0bba5d1eef4008c0c995354ddbc0be7b42a84a3077ba99.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3860
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3460
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3724
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4052
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
554501f5cf63bb59b0522b4bd943f16a
SHA15c2760afc0153ef799d953302345e1b149a5b849
SHA256b0c92ce552ce9dd28c43c5f7bb3695ab3fc3b0e4e7d040c609a39bb453f0fe5e
SHA512e51a82502046e9011eecc8270fb1035000117fec9e26fdad8c49c7fcb96178122dd42742c6d58c1ed2e4a1aeb1ebcebc80ac03c126a2065f91d0e4933137cb4e
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
554501f5cf63bb59b0522b4bd943f16a
SHA15c2760afc0153ef799d953302345e1b149a5b849
SHA256b0c92ce552ce9dd28c43c5f7bb3695ab3fc3b0e4e7d040c609a39bb453f0fe5e
SHA512e51a82502046e9011eecc8270fb1035000117fec9e26fdad8c49c7fcb96178122dd42742c6d58c1ed2e4a1aeb1ebcebc80ac03c126a2065f91d0e4933137cb4e
-
memory/3032-133-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3808-132-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB