Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-10-2022 02:36
Behavioral task
behavioral1
Sample
3cae1b420842e5bc4098dffac0dd44fa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3cae1b420842e5bc4098dffac0dd44fa.exe
Resource
win10v2004-20220812-en
General
-
Target
3cae1b420842e5bc4098dffac0dd44fa.exe
-
Size
89KB
-
MD5
3cae1b420842e5bc4098dffac0dd44fa
-
SHA1
321be89ffb70aa7c4cccfdb80df413b1c76c2230
-
SHA256
82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11
-
SHA512
838f25841dc233671dd007b94c871ef0bb42b6efff66ecf4a079e9cd406ecbc228fe4050702f14224d4d46e50905f6fab9a6e02f35c7904bc8f74563c8e2d1c8
-
SSDEEP
1536:voaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroWuxzug:Q0hpgz6xGhTjwHN30BE3D
Malware Config
Signatures
-
Sakula payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1628 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1696 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
3cae1b420842e5bc4098dffac0dd44fa.exepid process 1096 3cae1b420842e5bc4098dffac0dd44fa.exe 1096 3cae1b420842e5bc4098dffac0dd44fa.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3cae1b420842e5bc4098dffac0dd44fa.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 3cae1b420842e5bc4098dffac0dd44fa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3cae1b420842e5bc4098dffac0dd44fa.exedescription pid process Token: SeIncBasePriorityPrivilege 1096 3cae1b420842e5bc4098dffac0dd44fa.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3cae1b420842e5bc4098dffac0dd44fa.execmd.exedescription pid process target process PID 1096 wrote to memory of 1628 1096 3cae1b420842e5bc4098dffac0dd44fa.exe MediaCenter.exe PID 1096 wrote to memory of 1628 1096 3cae1b420842e5bc4098dffac0dd44fa.exe MediaCenter.exe PID 1096 wrote to memory of 1628 1096 3cae1b420842e5bc4098dffac0dd44fa.exe MediaCenter.exe PID 1096 wrote to memory of 1628 1096 3cae1b420842e5bc4098dffac0dd44fa.exe MediaCenter.exe PID 1096 wrote to memory of 1696 1096 3cae1b420842e5bc4098dffac0dd44fa.exe cmd.exe PID 1096 wrote to memory of 1696 1096 3cae1b420842e5bc4098dffac0dd44fa.exe cmd.exe PID 1096 wrote to memory of 1696 1096 3cae1b420842e5bc4098dffac0dd44fa.exe cmd.exe PID 1096 wrote to memory of 1696 1096 3cae1b420842e5bc4098dffac0dd44fa.exe cmd.exe PID 1696 wrote to memory of 292 1696 cmd.exe PING.EXE PID 1696 wrote to memory of 292 1696 cmd.exe PING.EXE PID 1696 wrote to memory of 292 1696 cmd.exe PING.EXE PID 1696 wrote to memory of 292 1696 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cae1b420842e5bc4098dffac0dd44fa.exe"C:\Users\Admin\AppData\Local\Temp\3cae1b420842e5bc4098dffac0dd44fa.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\3cae1b420842e5bc4098dffac0dd44fa.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:292
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
89KB
MD50f428350ee7737de4590ecb1c1695de9
SHA1a4c67d71f2f71228289652fc3864d6ac2aababc5
SHA256271be9c3df89b518eceeb3be77246d48313bd98299f9c5c76b23bc983521bfc1
SHA512a5224473cf4513545ea60c7dbb1c4ce2ecaa6632cd7f490bf3d1025715c26db2ba10458a6a6666a07ec9b13f74c275a7dab6c012023bd950b295dba2be798838
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
89KB
MD50f428350ee7737de4590ecb1c1695de9
SHA1a4c67d71f2f71228289652fc3864d6ac2aababc5
SHA256271be9c3df89b518eceeb3be77246d48313bd98299f9c5c76b23bc983521bfc1
SHA512a5224473cf4513545ea60c7dbb1c4ce2ecaa6632cd7f490bf3d1025715c26db2ba10458a6a6666a07ec9b13f74c275a7dab6c012023bd950b295dba2be798838
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
89KB
MD50f428350ee7737de4590ecb1c1695de9
SHA1a4c67d71f2f71228289652fc3864d6ac2aababc5
SHA256271be9c3df89b518eceeb3be77246d48313bd98299f9c5c76b23bc983521bfc1
SHA512a5224473cf4513545ea60c7dbb1c4ce2ecaa6632cd7f490bf3d1025715c26db2ba10458a6a6666a07ec9b13f74c275a7dab6c012023bd950b295dba2be798838
-
memory/292-61-0x0000000000000000-mapping.dmp
-
memory/1096-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB
-
memory/1628-57-0x0000000000000000-mapping.dmp
-
memory/1696-60-0x0000000000000000-mapping.dmp