Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
23-03-2022 09:34
Static task
static1
Behavioral task
behavioral1
Sample
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe
Resource
win10v2004-en-20220113
General
-
Target
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe
-
Size
101KB
-
MD5
b88832d57dba1e71d93b09509de8fb8d
-
SHA1
5eae328759f664289f757b71af2a5aafee9f8605
-
SHA256
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2
-
SHA512
be0ffefeb9f1436a6852522b6fd703dac7d15ca6266d82420e0500da817340a06220debd5836e52c7ab89a92f3ba8ea6e7f9ab2d9e2b603519a58d992a26c255
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x0003000000000721-131.dat family_sakula behavioral2/files/0x0003000000000721-132.dat family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid Process 5100 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exedescription pid Process Token: SeIncBasePriorityPrivilege 3004 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.execmd.exedescription pid Process procid_target PID 3004 wrote to memory of 5100 3004 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 80 PID 3004 wrote to memory of 5100 3004 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 80 PID 3004 wrote to memory of 5100 3004 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 80 PID 3004 wrote to memory of 2672 3004 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 86 PID 3004 wrote to memory of 2672 3004 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 86 PID 3004 wrote to memory of 2672 3004 dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe 86 PID 2672 wrote to memory of 1440 2672 cmd.exe 88 PID 2672 wrote to memory of 1440 2672 cmd.exe 88 PID 2672 wrote to memory of 1440 2672 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe"C:\Users\Admin\AppData\Local\Temp\dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:5100
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\dae0b1a00a0f6f79177dafd7090b3c3f1c2d4e8956a0dd7a5d3eef9ca04ab3b2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1440
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
7e0a030fad5682ba7c1511a27b9a9a8f
SHA150ca858ef34c8ea6fa42d6453c31a16373e56c01
SHA256c1a0371a508d4edb574322a58ea18a259fa69a4635883ad1e6d2de39940bf72c
SHA51216752efc21db2b75e2c2b97c906172470123e6457a0fd02628e1eba0834427e8d3ad9886994eb92ffb3d379cd02043636c9dfbd8fcb4196df12809aac078eec3
-
MD5
7e0a030fad5682ba7c1511a27b9a9a8f
SHA150ca858ef34c8ea6fa42d6453c31a16373e56c01
SHA256c1a0371a508d4edb574322a58ea18a259fa69a4635883ad1e6d2de39940bf72c
SHA51216752efc21db2b75e2c2b97c906172470123e6457a0fd02628e1eba0834427e8d3ad9886994eb92ffb3d379cd02043636c9dfbd8fcb4196df12809aac078eec3