Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 10:24
Static task
static1
Behavioral task
behavioral1
Sample
0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe
Resource
win10v2004-en-20220112
General
-
Target
0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe
-
Size
192KB
-
MD5
95ed730e1cf85d9176838a55f477b3fc
-
SHA1
fbfdb2d4f7fc39e036c6df43640cffd580df4c4b
-
SHA256
0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9
-
SHA512
4c8d425e71b6a76d2f69126496f29f5ab5603d8adb408c79ff81cc1a69edcd3ce15615fd6883eb36438e61cfb17bce600d5169efd50f85fb1e253c3ed726ad5b
Malware Config
Signatures
-
Sakula Payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1288 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1040 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exepid process 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exedescription pid process Token: SeIncBasePriorityPrivilege 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.execmd.exedescription pid process target process PID 1468 wrote to memory of 1288 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe MediaCenter.exe PID 1468 wrote to memory of 1288 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe MediaCenter.exe PID 1468 wrote to memory of 1288 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe MediaCenter.exe PID 1468 wrote to memory of 1288 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe MediaCenter.exe PID 1468 wrote to memory of 1040 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe cmd.exe PID 1468 wrote to memory of 1040 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe cmd.exe PID 1468 wrote to memory of 1040 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe cmd.exe PID 1468 wrote to memory of 1040 1468 0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe cmd.exe PID 1040 wrote to memory of 1100 1040 cmd.exe PING.EXE PID 1040 wrote to memory of 1100 1040 cmd.exe PING.EXE PID 1040 wrote to memory of 1100 1040 cmd.exe PING.EXE PID 1040 wrote to memory of 1100 1040 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe"C:\Users\Admin\AppData\Local\Temp\0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0756429af2cd0532e7ee1f0c08686de1152176ec0fb77dd4194728f36ab849e9.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1100
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
e570e6aa57a71bf4603804647ec155cd
SHA1d2ee5cc99cb9f606b19d300c36dab5d61c1bf568
SHA256c723b13f3f56dd7fb98adf8a41641bab29083bbfb5b48bef8c764eabafd217e8
SHA512e04e680c5b1b9a8d921b74ab8cba6c3216e34e95ef8bb6d87bdfe9cfe00a46fe0fbcb72533d0dfec5bb65d614478afc2d3708065d2e95116511d4f504233e3c2
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
e570e6aa57a71bf4603804647ec155cd
SHA1d2ee5cc99cb9f606b19d300c36dab5d61c1bf568
SHA256c723b13f3f56dd7fb98adf8a41641bab29083bbfb5b48bef8c764eabafd217e8
SHA512e04e680c5b1b9a8d921b74ab8cba6c3216e34e95ef8bb6d87bdfe9cfe00a46fe0fbcb72533d0dfec5bb65d614478afc2d3708065d2e95116511d4f504233e3c2
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
e570e6aa57a71bf4603804647ec155cd
SHA1d2ee5cc99cb9f606b19d300c36dab5d61c1bf568
SHA256c723b13f3f56dd7fb98adf8a41641bab29083bbfb5b48bef8c764eabafd217e8
SHA512e04e680c5b1b9a8d921b74ab8cba6c3216e34e95ef8bb6d87bdfe9cfe00a46fe0fbcb72533d0dfec5bb65d614478afc2d3708065d2e95116511d4f504233e3c2
-
memory/1468-54-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB