Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
23-03-2022 09:34
Static task
static1
Behavioral task
behavioral1
Sample
2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe
Resource
win10v2004-en-20220113
General
-
Target
2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe
-
Size
60KB
-
MD5
51d60455b6e1b9f562564450dc2dd2d3
-
SHA1
33cb9adfbb9e8b6d753df9389bfa6c081cb1ab33
-
SHA256
2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825
-
SHA512
93c3b1d535ca7fdfc017532e327473eba0505252fb871fe962113b9835f6b98f8b587fe55e49493214c27f06013a99874dd20743f9a40050df8db5d4d0b97501
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2112 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exedescription pid process Token: SeIncBasePriorityPrivilege 1664 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.execmd.exedescription pid process target process PID 1664 wrote to memory of 2112 1664 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe MediaCenter.exe PID 1664 wrote to memory of 2112 1664 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe MediaCenter.exe PID 1664 wrote to memory of 2112 1664 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe MediaCenter.exe PID 1664 wrote to memory of 4248 1664 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe cmd.exe PID 1664 wrote to memory of 4248 1664 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe cmd.exe PID 1664 wrote to memory of 4248 1664 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe cmd.exe PID 4248 wrote to memory of 4372 4248 cmd.exe PING.EXE PID 4248 wrote to memory of 4372 4248 cmd.exe PING.EXE PID 4248 wrote to memory of 4372 4248 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe"C:\Users\Admin\AppData\Local\Temp\2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
975106accb5f0ab415e66adfc5b275c6
SHA11aedb7755fbfe0ba100c1da7b30fe2fb83be2f71
SHA256a04329334ffd7ed4c944ea5e37b7f1dc2d69f4fac34b3e5538e757f018aa0bae
SHA512aa13e23bd8e479ce1d0303414ac1c8421e21d3e62291e9147c11845b9cc2086e22b53da5e5e96802f6a8952ed66301293b631c1580da8620575db6f48874b984
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
975106accb5f0ab415e66adfc5b275c6
SHA11aedb7755fbfe0ba100c1da7b30fe2fb83be2f71
SHA256a04329334ffd7ed4c944ea5e37b7f1dc2d69f4fac34b3e5538e757f018aa0bae
SHA512aa13e23bd8e479ce1d0303414ac1c8421e21d3e62291e9147c11845b9cc2086e22b53da5e5e96802f6a8952ed66301293b631c1580da8620575db6f48874b984
-
memory/2112-130-0x0000000000000000-mapping.dmp
-
memory/4248-133-0x0000000000000000-mapping.dmp
-
memory/4372-134-0x0000000000000000-mapping.dmp