Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
23-03-2022 15:50
Static task
static1
Behavioral task
behavioral1
Sample
2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe
Resource
win10v2004-en-20220113
General
-
Target
2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe
-
Size
152KB
-
MD5
f7472ef3bf3eec34a8503a80c264a71d
-
SHA1
ce6c4e674052635bc019ef58e6da6873495d67dc
-
SHA256
2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1
-
SHA512
cd9c97347ff5f18a94aeb03a120eff7df189d6f4b5da2d42864b995b5ff2fbc2e121076bcea37c218bbe2323a07dc4f46417d244e2220a590bffed3c353b95e8
Malware Config
Signatures
-
Sakula Payload 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000300000001e7eb-131.dat family_sakula behavioral2/files/0x000300000001e7eb-132.dat family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid Process 2964 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exedescription pid Process Token: SeIncBasePriorityPrivilege 2440 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.execmd.exedescription pid Process procid_target PID 2440 wrote to memory of 2964 2440 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe 79 PID 2440 wrote to memory of 2964 2440 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe 79 PID 2440 wrote to memory of 2964 2440 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe 79 PID 2440 wrote to memory of 2104 2440 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe 85 PID 2440 wrote to memory of 2104 2440 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe 85 PID 2440 wrote to memory of 2104 2440 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe 85 PID 2104 wrote to memory of 4088 2104 cmd.exe 87 PID 2104 wrote to memory of 4088 2104 cmd.exe 87 PID 2104 wrote to memory of 4088 2104 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe"C:\Users\Admin\AppData\Local\Temp\2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2964
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4088
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
55d72d996f223f643f0bf427be37bc11
SHA18973ac29c299b3649e626a5d15a55c74f7005d07
SHA256041cf75bf51a81be9e6c3e95d4c285108ecadcfefa528613f7e8c4783e78883f
SHA5123671e7ee86192b5b0cb6443af52c8dc68603439838a0b709b93b27b747a583015c7be78c724d6ef1d3b4dc80a042fe29813936433c088cf6ccc8a687e0e71428
-
MD5
55d72d996f223f643f0bf427be37bc11
SHA18973ac29c299b3649e626a5d15a55c74f7005d07
SHA256041cf75bf51a81be9e6c3e95d4c285108ecadcfefa528613f7e8c4783e78883f
SHA5123671e7ee86192b5b0cb6443af52c8dc68603439838a0b709b93b27b747a583015c7be78c724d6ef1d3b4dc80a042fe29813936433c088cf6ccc8a687e0e71428