Analysis
-
max time kernel
151s -
max time network
181s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 10:38
Static task
static1
Behavioral task
behavioral1
Sample
06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe
Resource
win10v2004-en-20220112
General
-
Target
06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe
-
Size
58KB
-
MD5
0478e741edadc55f40f508504e338a4f
-
SHA1
a1bd15b62e9d7d1351ca06c03ea55a976b52f5a7
-
SHA256
06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d
-
SHA512
4948f446e451ab42a8f6d4b40854c02987c08b6297d1d8f71c0dde03d974ca228da1256f6781e90facd443a8ee25520b7ce73a8bb32246945988982894d4caf0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1612 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 240 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exepid process 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exedescription pid process Token: SeIncBasePriorityPrivilege 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.execmd.exedescription pid process target process PID 1664 wrote to memory of 1612 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe MediaCenter.exe PID 1664 wrote to memory of 1612 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe MediaCenter.exe PID 1664 wrote to memory of 1612 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe MediaCenter.exe PID 1664 wrote to memory of 1612 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe MediaCenter.exe PID 1664 wrote to memory of 240 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe cmd.exe PID 1664 wrote to memory of 240 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe cmd.exe PID 1664 wrote to memory of 240 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe cmd.exe PID 1664 wrote to memory of 240 1664 06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe cmd.exe PID 240 wrote to memory of 1736 240 cmd.exe PING.EXE PID 240 wrote to memory of 1736 240 cmd.exe PING.EXE PID 240 wrote to memory of 1736 240 cmd.exe PING.EXE PID 240 wrote to memory of 1736 240 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe"C:\Users\Admin\AppData\Local\Temp\06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\06a8d98cb91c66cd5be42bcbae18727ca8cd449d9e56b53df5fd27c2b5ec157d.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1736
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
07b70f0c4a7991411bb218ce5db82253
SHA151eb20614779e736a500571468882bb0b06e2e0c
SHA256cdc6d4b8ad6b7f69df1121a0ca01ad7cfcfad33da08494279f02436d3405d970
SHA512ee204569133725135cbe0633b95ac1bd65bf40e15606daa04fd902c7495bb33cfbba97c2f7e551ed20dd4c66f2b3ed44b37ff20806e60d9038a4bf178fc0e83d
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
07b70f0c4a7991411bb218ce5db82253
SHA151eb20614779e736a500571468882bb0b06e2e0c
SHA256cdc6d4b8ad6b7f69df1121a0ca01ad7cfcfad33da08494279f02436d3405d970
SHA512ee204569133725135cbe0633b95ac1bd65bf40e15606daa04fd902c7495bb33cfbba97c2f7e551ed20dd4c66f2b3ed44b37ff20806e60d9038a4bf178fc0e83d
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
07b70f0c4a7991411bb218ce5db82253
SHA151eb20614779e736a500571468882bb0b06e2e0c
SHA256cdc6d4b8ad6b7f69df1121a0ca01ad7cfcfad33da08494279f02436d3405d970
SHA512ee204569133725135cbe0633b95ac1bd65bf40e15606daa04fd902c7495bb33cfbba97c2f7e551ed20dd4c66f2b3ed44b37ff20806e60d9038a4bf178fc0e83d
-
memory/1664-55-0x00000000763F1000-0x00000000763F3000-memory.dmpFilesize
8KB