Analysis
-
max time kernel
117s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2022 05:42
Behavioral task
behavioral1
Sample
MediaCenter.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
MediaCenter.exe
Resource
win10v2004-20220812-en
General
-
Target
MediaCenter.exe
-
Size
89KB
-
MD5
0f428350ee7737de4590ecb1c1695de9
-
SHA1
a4c67d71f2f71228289652fc3864d6ac2aababc5
-
SHA256
271be9c3df89b518eceeb3be77246d48313bd98299f9c5c76b23bc983521bfc1
-
SHA512
a5224473cf4513545ea60c7dbb1c4ce2ecaa6632cd7f490bf3d1025715c26db2ba10458a6a6666a07ec9b13f74c275a7dab6c012023bd950b295dba2be798838
-
SSDEEP
1536:voaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroWuxzuc:Q0hpgz6xGhTjwHN30BE3/
Malware Config
Signatures
-
Sakula payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2480 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MediaCenter.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MediaCenter.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" MediaCenter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MediaCenter.exedescription pid process Token: SeIncBasePriorityPrivilege 4280 MediaCenter.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
MediaCenter.execmd.exedescription pid process target process PID 4280 wrote to memory of 2480 4280 MediaCenter.exe MediaCenter.exe PID 4280 wrote to memory of 2480 4280 MediaCenter.exe MediaCenter.exe PID 4280 wrote to memory of 2480 4280 MediaCenter.exe MediaCenter.exe PID 4280 wrote to memory of 2524 4280 MediaCenter.exe cmd.exe PID 4280 wrote to memory of 2524 4280 MediaCenter.exe cmd.exe PID 4280 wrote to memory of 2524 4280 MediaCenter.exe cmd.exe PID 2524 wrote to memory of 3832 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 3832 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 3832 2524 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\MediaCenter.exe"C:\Users\Admin\AppData\Local\Temp\MediaCenter.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
89KB
MD5fd36cdf100c95baa5c39e9a47a65dbca
SHA1012cf84ce6812850bfb4299149fa42ee54c1b9c2
SHA256717417974f87ad0168c85c716847c30cfbe62c9843dbb1754ce9c2a9cc32f30a
SHA512d7041416cd6fbf468403789bafceb68ef49273a3075b5980151b723305a3b93401934f4a08260898201570e4e31c0f329f6302ee54d1e7ca313287ec011bb366
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
89KB
MD5fd36cdf100c95baa5c39e9a47a65dbca
SHA1012cf84ce6812850bfb4299149fa42ee54c1b9c2
SHA256717417974f87ad0168c85c716847c30cfbe62c9843dbb1754ce9c2a9cc32f30a
SHA512d7041416cd6fbf468403789bafceb68ef49273a3075b5980151b723305a3b93401934f4a08260898201570e4e31c0f329f6302ee54d1e7ca313287ec011bb366
-
memory/2480-132-0x0000000000000000-mapping.dmp
-
memory/2524-135-0x0000000000000000-mapping.dmp
-
memory/3832-136-0x0000000000000000-mapping.dmp