Analysis
-
max time kernel
156s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
12-02-2022 09:30
Static task
static1
Behavioral task
behavioral1
Sample
09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe
Resource
win10v2004-en-20220112
General
-
Target
09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe
-
Size
116KB
-
MD5
a3f0692ce1d4edf148963905d51f8cfb
-
SHA1
08aae7620442a33456b81779884261534aeac280
-
SHA256
09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11
-
SHA512
99b753f736910646805e6746f587f49c7a14d6b8e50e8d44dbdcb7727844b3e0ce829fd2571ff88112196c51571ae583dc39869efe6f09b5de185a9dd1609949
Malware Config
Signatures
-
Sakula Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/768-132-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula behavioral2/memory/1836-133-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
-
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1836 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe -
Drops file in Windows directory 3 IoCs
Processes:
svchost.exeTiWorker.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 51 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4440" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4208" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4076" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132893083156440427" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "14.283403" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.000112" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.769312" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
TiWorker.exedescription pid process Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe Token: SeRestorePrivilege 4044 TiWorker.exe Token: SeSecurityPrivilege 4044 TiWorker.exe Token: SeBackupPrivilege 4044 TiWorker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.execmd.exedescription pid process target process PID 768 wrote to memory of 1836 768 09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe MediaCenter.exe PID 768 wrote to memory of 1836 768 09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe MediaCenter.exe PID 768 wrote to memory of 1836 768 09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe MediaCenter.exe PID 768 wrote to memory of 2232 768 09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe cmd.exe PID 768 wrote to memory of 2232 768 09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe cmd.exe PID 768 wrote to memory of 2232 768 09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe cmd.exe PID 2232 wrote to memory of 2000 2232 cmd.exe PING.EXE PID 2232 wrote to memory of 2000 2232 cmd.exe PING.EXE PID 2232 wrote to memory of 2000 2232 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe"C:\Users\Admin\AppData\Local\Temp\09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1836 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\09dee37389b54d0c2dfb4151921f4bc6f7741b384aaf24a08557b1d47bf2ef11.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2000
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2192
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2852
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4044
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
220ad77d5f5468769ccea501ba4acc26
SHA139ef496d2716beb98eccfa61090f9df3faea5ca3
SHA256d5d65cdd437e2a6c76b30cbffdecfb208c0bef5ce9708f0b599f9ed1dcdc2fe6
SHA512e0aa48ed9fa9771c2a598ba00eeae08d746739b05091c5e599890a71d9447b1cd8f43e8191838ccca09a7c92bf0f23302b45e1bf2efb2e23194340f2e6349969
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
220ad77d5f5468769ccea501ba4acc26
SHA139ef496d2716beb98eccfa61090f9df3faea5ca3
SHA256d5d65cdd437e2a6c76b30cbffdecfb208c0bef5ce9708f0b599f9ed1dcdc2fe6
SHA512e0aa48ed9fa9771c2a598ba00eeae08d746739b05091c5e599890a71d9447b1cd8f43e8191838ccca09a7c92bf0f23302b45e1bf2efb2e23194340f2e6349969
-
memory/768-132-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1836-133-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB