Analysis
-
max time kernel
131s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-10-2022 05:42
Behavioral task
behavioral1
Sample
MediaCenter.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
MediaCenter.exe
Resource
win10v2004-20220812-en
General
-
Target
MediaCenter.exe
-
Size
89KB
-
MD5
0f428350ee7737de4590ecb1c1695de9
-
SHA1
a4c67d71f2f71228289652fc3864d6ac2aababc5
-
SHA256
271be9c3df89b518eceeb3be77246d48313bd98299f9c5c76b23bc983521bfc1
-
SHA512
a5224473cf4513545ea60c7dbb1c4ce2ecaa6632cd7f490bf3d1025715c26db2ba10458a6a6666a07ec9b13f74c275a7dab6c012023bd950b295dba2be798838
-
SSDEEP
1536:voaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroWuxzuc:Q0hpgz6xGhTjwHN30BE3/
Malware Config
Signatures
-
Sakula payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1904 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 368 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
MediaCenter.exepid process 1044 MediaCenter.exe 1044 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MediaCenter.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" MediaCenter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MediaCenter.exedescription pid process Token: SeIncBasePriorityPrivilege 1044 MediaCenter.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MediaCenter.execmd.exedescription pid process target process PID 1044 wrote to memory of 1904 1044 MediaCenter.exe MediaCenter.exe PID 1044 wrote to memory of 1904 1044 MediaCenter.exe MediaCenter.exe PID 1044 wrote to memory of 1904 1044 MediaCenter.exe MediaCenter.exe PID 1044 wrote to memory of 1904 1044 MediaCenter.exe MediaCenter.exe PID 1044 wrote to memory of 368 1044 MediaCenter.exe cmd.exe PID 1044 wrote to memory of 368 1044 MediaCenter.exe cmd.exe PID 1044 wrote to memory of 368 1044 MediaCenter.exe cmd.exe PID 1044 wrote to memory of 368 1044 MediaCenter.exe cmd.exe PID 368 wrote to memory of 860 368 cmd.exe PING.EXE PID 368 wrote to memory of 860 368 cmd.exe PING.EXE PID 368 wrote to memory of 860 368 cmd.exe PING.EXE PID 368 wrote to memory of 860 368 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\MediaCenter.exe"C:\Users\Admin\AppData\Local\Temp\MediaCenter.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\MediaCenter.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
89KB
MD58028ee8c5518482c874d415f6cd9613b
SHA164854fd072613b2dd75ee725207eec214baf93e0
SHA256d1c07fa8c37038f57e511586c2711302ec3b31f8fe178c4fbeeb8984a18a5225
SHA512f9b514b807fa9add7367ef50761efc469ff6f0e589dc36113a2b36a69d87b268e256ff199ece94a4d9768a6051654693adade03edba055a5922d46fc5b26c889
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
89KB
MD58028ee8c5518482c874d415f6cd9613b
SHA164854fd072613b2dd75ee725207eec214baf93e0
SHA256d1c07fa8c37038f57e511586c2711302ec3b31f8fe178c4fbeeb8984a18a5225
SHA512f9b514b807fa9add7367ef50761efc469ff6f0e589dc36113a2b36a69d87b268e256ff199ece94a4d9768a6051654693adade03edba055a5922d46fc5b26c889
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
89KB
MD58028ee8c5518482c874d415f6cd9613b
SHA164854fd072613b2dd75ee725207eec214baf93e0
SHA256d1c07fa8c37038f57e511586c2711302ec3b31f8fe178c4fbeeb8984a18a5225
SHA512f9b514b807fa9add7367ef50761efc469ff6f0e589dc36113a2b36a69d87b268e256ff199ece94a4d9768a6051654693adade03edba055a5922d46fc5b26c889
-
memory/368-60-0x0000000000000000-mapping.dmp
-
memory/860-61-0x0000000000000000-mapping.dmp
-
memory/1044-54-0x0000000075501000-0x0000000075503000-memory.dmpFilesize
8KB
-
memory/1904-57-0x0000000000000000-mapping.dmp