Analysis
-
max time kernel
108s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-10-2022 07:00
Behavioral task
behavioral1
Sample
10fa04bbf25570d83c37d5b7008fe85d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
10fa04bbf25570d83c37d5b7008fe85d.exe
Resource
win10v2004-20220812-en
General
-
Target
10fa04bbf25570d83c37d5b7008fe85d.exe
-
Size
88KB
-
MD5
10fa04bbf25570d83c37d5b7008fe85d
-
SHA1
7f6c136b0cc97cfdd0ba5e27ec03a0ea4c87193f
-
SHA256
e84e3f69364a3aa00fee5e5f24744d77ac01c026b004756ca65e19a891f4de54
-
SHA512
8fbab615e94f86612ce7e696e6f5a0457c9a0c18ccaa286b4769315350861e14e125041b828d22a3abcfbe727020d414577e70a522bfb29b9221683ebd562612
-
SSDEEP
1536:Boaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroyPTEzg:y0hpgz6xGhTjwHN30BEybEk
Malware Config
Signatures
-
Sakula payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1252 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1580 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
10fa04bbf25570d83c37d5b7008fe85d.exepid process 1768 10fa04bbf25570d83c37d5b7008fe85d.exe 1768 10fa04bbf25570d83c37d5b7008fe85d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
10fa04bbf25570d83c37d5b7008fe85d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 10fa04bbf25570d83c37d5b7008fe85d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
10fa04bbf25570d83c37d5b7008fe85d.exedescription pid process Token: SeIncBasePriorityPrivilege 1768 10fa04bbf25570d83c37d5b7008fe85d.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
10fa04bbf25570d83c37d5b7008fe85d.execmd.exedescription pid process target process PID 1768 wrote to memory of 1252 1768 10fa04bbf25570d83c37d5b7008fe85d.exe MediaCenter.exe PID 1768 wrote to memory of 1252 1768 10fa04bbf25570d83c37d5b7008fe85d.exe MediaCenter.exe PID 1768 wrote to memory of 1252 1768 10fa04bbf25570d83c37d5b7008fe85d.exe MediaCenter.exe PID 1768 wrote to memory of 1252 1768 10fa04bbf25570d83c37d5b7008fe85d.exe MediaCenter.exe PID 1768 wrote to memory of 1580 1768 10fa04bbf25570d83c37d5b7008fe85d.exe cmd.exe PID 1768 wrote to memory of 1580 1768 10fa04bbf25570d83c37d5b7008fe85d.exe cmd.exe PID 1768 wrote to memory of 1580 1768 10fa04bbf25570d83c37d5b7008fe85d.exe cmd.exe PID 1768 wrote to memory of 1580 1768 10fa04bbf25570d83c37d5b7008fe85d.exe cmd.exe PID 1580 wrote to memory of 1512 1580 cmd.exe PING.EXE PID 1580 wrote to memory of 1512 1580 cmd.exe PING.EXE PID 1580 wrote to memory of 1512 1580 cmd.exe PING.EXE PID 1580 wrote to memory of 1512 1580 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\10fa04bbf25570d83c37d5b7008fe85d.exe"C:\Users\Admin\AppData\Local\Temp\10fa04bbf25570d83c37d5b7008fe85d.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\10fa04bbf25570d83c37d5b7008fe85d.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
88KB
MD58322dd20cb7fb9c947d5de64410c53f8
SHA120697eb8efd91c68804373142bb762dfb04d4d2b
SHA256ebdf1d16944d9096aa0779975ef8783f1f4b698dd6e88c85c2a80e6465a68dd9
SHA512a787c9539c436fa10b7387cc29b3a8cb931eb3121d761575f2625607a140a55a4bf088ce02f4da612f27303f308e98d403d269c8a06b923e816b0e991577cd0f
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
88KB
MD58322dd20cb7fb9c947d5de64410c53f8
SHA120697eb8efd91c68804373142bb762dfb04d4d2b
SHA256ebdf1d16944d9096aa0779975ef8783f1f4b698dd6e88c85c2a80e6465a68dd9
SHA512a787c9539c436fa10b7387cc29b3a8cb931eb3121d761575f2625607a140a55a4bf088ce02f4da612f27303f308e98d403d269c8a06b923e816b0e991577cd0f
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
88KB
MD58322dd20cb7fb9c947d5de64410c53f8
SHA120697eb8efd91c68804373142bb762dfb04d4d2b
SHA256ebdf1d16944d9096aa0779975ef8783f1f4b698dd6e88c85c2a80e6465a68dd9
SHA512a787c9539c436fa10b7387cc29b3a8cb931eb3121d761575f2625607a140a55a4bf088ce02f4da612f27303f308e98d403d269c8a06b923e816b0e991577cd0f
-
memory/1252-57-0x0000000000000000-mapping.dmp
-
memory/1512-61-0x0000000000000000-mapping.dmp
-
memory/1580-60-0x0000000000000000-mapping.dmp
-
memory/1768-54-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB