Analysis
-
max time kernel
4294203s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
24-02-2022 11:03
Static task
static1
Behavioral task
behavioral1
Sample
7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe
Resource
win10-20220223-en
Behavioral task
behavioral3
Sample
7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe
Resource
win10v2004-en-20220113
General
-
Target
7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe
-
Size
150KB
-
MD5
202ca1b19f8ecc7e648043485ff91082
-
SHA1
df4be15599023beca2a24de920199fcd88f1f034
-
SHA256
7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452
-
SHA512
8ae627b9e0ba4d79b31bf4f36db947374f3904e405f77b293f2bb2fa6b87afb69cc0b694db661dc2d53b0f51bf2e2a60053628dabc99363c74c4f70cf1bc1554
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1652 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1732 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exepid process 1976 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exedescription pid process Token: SeIncBasePriorityPrivilege 1976 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.execmd.exedescription pid process target process PID 1976 wrote to memory of 1652 1976 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe MediaCenter.exe PID 1976 wrote to memory of 1652 1976 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe MediaCenter.exe PID 1976 wrote to memory of 1652 1976 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe MediaCenter.exe PID 1976 wrote to memory of 1652 1976 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe MediaCenter.exe PID 1976 wrote to memory of 1732 1976 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe cmd.exe PID 1976 wrote to memory of 1732 1976 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe cmd.exe PID 1976 wrote to memory of 1732 1976 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe cmd.exe PID 1976 wrote to memory of 1732 1976 7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe cmd.exe PID 1732 wrote to memory of 1120 1732 cmd.exe PING.EXE PID 1732 wrote to memory of 1120 1732 cmd.exe PING.EXE PID 1732 wrote to memory of 1120 1732 cmd.exe PING.EXE PID 1732 wrote to memory of 1120 1732 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe"C:\Users\Admin\AppData\Local\Temp\7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\7b8d0ee237e85d52c4ae65170c50a97437697299cb92badf91e7510f798bb452.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
a7e5469ebb4cd21c4f8f549407bce314
SHA16800fafef1a880860f14608365a90c4b6e0c6f54
SHA256837847b009c5d36beffef812d3a16ddc53520c86000dbf5490c87f3762d366c0
SHA51214f2b7b4d3ee4a771c05535039df7c74755e8a54bb920d496c4dc402f79081a35e200e8922913ae3c62182f2dcc36a83d408a6433e14c8a8cbec2bd620cb3d3e
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
a7e5469ebb4cd21c4f8f549407bce314
SHA16800fafef1a880860f14608365a90c4b6e0c6f54
SHA256837847b009c5d36beffef812d3a16ddc53520c86000dbf5490c87f3762d366c0
SHA51214f2b7b4d3ee4a771c05535039df7c74755e8a54bb920d496c4dc402f79081a35e200e8922913ae3c62182f2dcc36a83d408a6433e14c8a8cbec2bd620cb3d3e
-
memory/1976-54-0x0000000075641000-0x0000000075643000-memory.dmpFilesize
8KB