Analysis
-
max time kernel
4294184s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
23-03-2022 09:34
Static task
static1
Behavioral task
behavioral1
Sample
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe
Resource
win10v2004-en-20220113
General
-
Target
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe
-
Size
101KB
-
MD5
b88832d57dba1e71d93b09509de8fb8d
-
SHA1
5eae328759f664289f757b71af2a5aafee9f8605
-
SHA256
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2
-
SHA512
be0ffefeb9f1436a6852522b6fd703dac7d15ca6266d82420e0500da817340a06220debd5836e52c7ab89a92f3ba8ea6e7f9ab2d9e2b603519a58d992a26c255
Malware Config
Signatures
-
Sakula Payload 3 IoCs
Processes:
resource yara_rule behavioral1/files/0x0007000000015561-56.dat family_sakula behavioral1/files/0x0007000000015561-58.dat family_sakula behavioral1/files/0x0007000000015561-55.dat family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid Process 1816 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 1504 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exepid Process 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exedescription pid Process Token: SeIncBasePriorityPrivilege 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.execmd.exedescription pid Process procid_target PID 1980 wrote to memory of 1816 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 27 PID 1980 wrote to memory of 1816 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 27 PID 1980 wrote to memory of 1816 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 27 PID 1980 wrote to memory of 1816 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 27 PID 1980 wrote to memory of 1504 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 30 PID 1980 wrote to memory of 1504 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 30 PID 1980 wrote to memory of 1504 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 30 PID 1980 wrote to memory of 1504 1980 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 30 PID 1504 wrote to memory of 1056 1504 cmd.exe 32 PID 1504 wrote to memory of 1056 1504 cmd.exe 32 PID 1504 wrote to memory of 1056 1504 cmd.exe 32 PID 1504 wrote to memory of 1056 1504 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe"C:\Users\Admin\AppData\Local\Temp\dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1816
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1056
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
10e7120433035b58ca5187070e01c386
SHA135b174398661b22a62743b25ea485a419aecd1eb
SHA256c4c9488e8dac6ae141028528ff7e989e6c9f95df659df261d867823280de292b
SHA512c7a945c55b684b222848625fd331e732692e7cebfc193c5f5fc6bd28b65d8d203f28591ce6190f7fdf7e44be6de9191ad5599190aedc10a319a2a6ccb5cd0227
-
MD5
10e7120433035b58ca5187070e01c386
SHA135b174398661b22a62743b25ea485a419aecd1eb
SHA256c4c9488e8dac6ae141028528ff7e989e6c9f95df659df261d867823280de292b
SHA512c7a945c55b684b222848625fd331e732692e7cebfc193c5f5fc6bd28b65d8d203f28591ce6190f7fdf7e44be6de9191ad5599190aedc10a319a2a6ccb5cd0227
-
MD5
10e7120433035b58ca5187070e01c386
SHA135b174398661b22a62743b25ea485a419aecd1eb
SHA256c4c9488e8dac6ae141028528ff7e989e6c9f95df659df261d867823280de292b
SHA512c7a945c55b684b222848625fd331e732692e7cebfc193c5f5fc6bd28b65d8d203f28591ce6190f7fdf7e44be6de9191ad5599190aedc10a319a2a6ccb5cd0227