Analysis
-
max time kernel
125s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 11:33
Static task
static1
Behavioral task
behavioral1
Sample
041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe
Resource
win10v2004-en-20220112
General
-
Target
041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe
-
Size
101KB
-
MD5
c4a0411e035d4e538e295b19af6554c7
-
SHA1
0727a1eabe9b6f782b69dd8ae15929208c81f50c
-
SHA256
041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60
-
SHA512
5fc58033b82e1551a36d547c27d258fea8ffafcbae24a969ef074e3b20df18bb7f3ac4092b89fc1f253acf686b02464c356223631069af02bba74f15e8a25dd7
Malware Config
Signatures
-
Sakula Payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1656 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2008 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exepid process 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exedescription pid process Token: SeIncBasePriorityPrivilege 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.execmd.exedescription pid process target process PID 1920 wrote to memory of 1656 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe MediaCenter.exe PID 1920 wrote to memory of 1656 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe MediaCenter.exe PID 1920 wrote to memory of 1656 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe MediaCenter.exe PID 1920 wrote to memory of 1656 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe MediaCenter.exe PID 1920 wrote to memory of 2008 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe cmd.exe PID 1920 wrote to memory of 2008 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe cmd.exe PID 1920 wrote to memory of 2008 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe cmd.exe PID 1920 wrote to memory of 2008 1920 041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe cmd.exe PID 2008 wrote to memory of 2000 2008 cmd.exe PING.EXE PID 2008 wrote to memory of 2000 2008 cmd.exe PING.EXE PID 2008 wrote to memory of 2000 2008 cmd.exe PING.EXE PID 2008 wrote to memory of 2000 2008 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe"C:\Users\Admin\AppData\Local\Temp\041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\041ef5263504ab8fbb972529b2f7c861bb04175c9aa7b9cbb2a7c8a2c672de60.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2000
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
6acfe00619ea1e985d9709bdb7ddf2d0
SHA19c739c57596368379e71f40443f1df635c2f6972
SHA256b1759c9f411fc1f962122ce86d40716b51f552fdd01cef8a195fb32ad9e1a865
SHA512e4be9a4f7a5b599a8f7586bf6fd22224b68ac99da40e23d7d8b6a87b653db3fef9096bcb400f91f2461b9746aabdea28b4e6a278b80311944ffaf9ceed833298
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
6acfe00619ea1e985d9709bdb7ddf2d0
SHA19c739c57596368379e71f40443f1df635c2f6972
SHA256b1759c9f411fc1f962122ce86d40716b51f552fdd01cef8a195fb32ad9e1a865
SHA512e4be9a4f7a5b599a8f7586bf6fd22224b68ac99da40e23d7d8b6a87b653db3fef9096bcb400f91f2461b9746aabdea28b4e6a278b80311944ffaf9ceed833298
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
6acfe00619ea1e985d9709bdb7ddf2d0
SHA19c739c57596368379e71f40443f1df635c2f6972
SHA256b1759c9f411fc1f962122ce86d40716b51f552fdd01cef8a195fb32ad9e1a865
SHA512e4be9a4f7a5b599a8f7586bf6fd22224b68ac99da40e23d7d8b6a87b653db3fef9096bcb400f91f2461b9746aabdea28b4e6a278b80311944ffaf9ceed833298
-
memory/1920-54-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB