Analysis
-
max time kernel
122s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 11:06
Static task
static1
Behavioral task
behavioral1
Sample
05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe
Resource
win10v2004-en-20220113
General
-
Target
05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe
-
Size
191KB
-
MD5
f11c93d08e70982d10dee367e8785112
-
SHA1
9011970486cf0b5348ebeca8d66253b574e12242
-
SHA256
05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199
-
SHA512
701f99f86b96076b6415860aa61ae72a2e1d8f09958e13d03349fbabb0deb1b4c4c7156e3a47db7bd6fd745ffb0f7ed47035f4212d1282693a6a72705793459a
Malware Config
Signatures
-
Sakula Payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1660 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1320 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exepid process 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exedescription pid process Token: SeIncBasePriorityPrivilege 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.execmd.exedescription pid process target process PID 1468 wrote to memory of 1660 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe MediaCenter.exe PID 1468 wrote to memory of 1660 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe MediaCenter.exe PID 1468 wrote to memory of 1660 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe MediaCenter.exe PID 1468 wrote to memory of 1660 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe MediaCenter.exe PID 1468 wrote to memory of 1320 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe cmd.exe PID 1468 wrote to memory of 1320 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe cmd.exe PID 1468 wrote to memory of 1320 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe cmd.exe PID 1468 wrote to memory of 1320 1468 05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe cmd.exe PID 1320 wrote to memory of 392 1320 cmd.exe PING.EXE PID 1320 wrote to memory of 392 1320 cmd.exe PING.EXE PID 1320 wrote to memory of 392 1320 cmd.exe PING.EXE PID 1320 wrote to memory of 392 1320 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe"C:\Users\Admin\AppData\Local\Temp\05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1660 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\05523926b834b4a0310c2cdbe7be63c333a8f560782e0c34ca7eb28ecb1b3199.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:392
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
4478bef2b34e7bb8189ee6de8cbd7d59
SHA188ad20f683e4013f1f6dc0378c7d1b105983a1de
SHA2564e13d49bebc973b8b90279b06cf7d30cddb853718d2d487a4acc1f78b79b248c
SHA512a3c69f4e34779af1f3266aed13ef80d7c53ca1cacea72ec6cc06eb3c7d7fefd5fbe4acf20c27d58cd6a9f55f8e00de70a63f2746e444769e37be6e3a1bde73f6
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
4478bef2b34e7bb8189ee6de8cbd7d59
SHA188ad20f683e4013f1f6dc0378c7d1b105983a1de
SHA2564e13d49bebc973b8b90279b06cf7d30cddb853718d2d487a4acc1f78b79b248c
SHA512a3c69f4e34779af1f3266aed13ef80d7c53ca1cacea72ec6cc06eb3c7d7fefd5fbe4acf20c27d58cd6a9f55f8e00de70a63f2746e444769e37be6e3a1bde73f6
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
4478bef2b34e7bb8189ee6de8cbd7d59
SHA188ad20f683e4013f1f6dc0378c7d1b105983a1de
SHA2564e13d49bebc973b8b90279b06cf7d30cddb853718d2d487a4acc1f78b79b248c
SHA512a3c69f4e34779af1f3266aed13ef80d7c53ca1cacea72ec6cc06eb3c7d7fefd5fbe4acf20c27d58cd6a9f55f8e00de70a63f2746e444769e37be6e3a1bde73f6
-
memory/1468-54-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB