Analysis
-
max time kernel
132s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 09:52
Static task
static1
Behavioral task
behavioral1
Sample
08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe
Resource
win10v2004-en-20220113
General
-
Target
08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe
-
Size
58KB
-
MD5
bd4291c76f60abdc1df6ec8d80ed9e74
-
SHA1
75a964bfc9e13234f41070d85e64b9590c0497a7
-
SHA256
08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78
-
SHA512
aec6a46321bfcb92e2b62910dda927db53462f08955a81c451f124c13643ec88e6c6c5a3a7fcf7637d22abd33216cd0c8c28a3ba7ae4c544e8087e7bb092c1ec
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1636 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1944 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exepid process 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exedescription pid process Token: SeIncBasePriorityPrivilege 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.execmd.exedescription pid process target process PID 1684 wrote to memory of 1636 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe MediaCenter.exe PID 1684 wrote to memory of 1636 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe MediaCenter.exe PID 1684 wrote to memory of 1636 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe MediaCenter.exe PID 1684 wrote to memory of 1636 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe MediaCenter.exe PID 1684 wrote to memory of 1944 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe cmd.exe PID 1684 wrote to memory of 1944 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe cmd.exe PID 1684 wrote to memory of 1944 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe cmd.exe PID 1684 wrote to memory of 1944 1684 08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe cmd.exe PID 1944 wrote to memory of 752 1944 cmd.exe PING.EXE PID 1944 wrote to memory of 752 1944 cmd.exe PING.EXE PID 1944 wrote to memory of 752 1944 cmd.exe PING.EXE PID 1944 wrote to memory of 752 1944 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe"C:\Users\Admin\AppData\Local\Temp\08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\08cba56f32aebc2afb890dbb99d9083fdcbc9375d421468a7f4e52de0002ad78.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
07b70f0c4a7991411bb218ce5db82253
SHA151eb20614779e736a500571468882bb0b06e2e0c
SHA256cdc6d4b8ad6b7f69df1121a0ca01ad7cfcfad33da08494279f02436d3405d970
SHA512ee204569133725135cbe0633b95ac1bd65bf40e15606daa04fd902c7495bb33cfbba97c2f7e551ed20dd4c66f2b3ed44b37ff20806e60d9038a4bf178fc0e83d
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
07b70f0c4a7991411bb218ce5db82253
SHA151eb20614779e736a500571468882bb0b06e2e0c
SHA256cdc6d4b8ad6b7f69df1121a0ca01ad7cfcfad33da08494279f02436d3405d970
SHA512ee204569133725135cbe0633b95ac1bd65bf40e15606daa04fd902c7495bb33cfbba97c2f7e551ed20dd4c66f2b3ed44b37ff20806e60d9038a4bf178fc0e83d
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
07b70f0c4a7991411bb218ce5db82253
SHA151eb20614779e736a500571468882bb0b06e2e0c
SHA256cdc6d4b8ad6b7f69df1121a0ca01ad7cfcfad33da08494279f02436d3405d970
SHA512ee204569133725135cbe0633b95ac1bd65bf40e15606daa04fd902c7495bb33cfbba97c2f7e551ed20dd4c66f2b3ed44b37ff20806e60d9038a4bf178fc0e83d
-
memory/1684-54-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB