Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-10-2022 01:30
Static task
static1
Behavioral task
behavioral1
Sample
2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe
Resource
win10v2004-20220812-en
General
-
Target
2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe
-
Size
60KB
-
MD5
5ab7de48ac345e48999dd6482b8d6040
-
SHA1
14abda48ae1deda82b0ddfe63ac74bc027157df6
-
SHA256
2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1
-
SHA512
c6f382d1353779ad7d2cd5001514d4f8f475f2fb3fd09c509e3cea8e0941287ec744a5ea38d01e83fb02aa27df2e7f1c9468f795a6559ac3fab7beb74aff7b8c
-
SSDEEP
1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/i:iEoIlwIguEA4c5DgA9DOyq0eF6
Malware Config
Signatures
-
Sakula payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1092-60-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/1508-63-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/1092-65-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1508 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1488 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exepid process 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exedescription pid process Token: SeIncBasePriorityPrivilege 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.execmd.exedescription pid process target process PID 1092 wrote to memory of 1508 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe MediaCenter.exe PID 1092 wrote to memory of 1508 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe MediaCenter.exe PID 1092 wrote to memory of 1508 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe MediaCenter.exe PID 1092 wrote to memory of 1508 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe MediaCenter.exe PID 1092 wrote to memory of 1488 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe cmd.exe PID 1092 wrote to memory of 1488 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe cmd.exe PID 1092 wrote to memory of 1488 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe cmd.exe PID 1092 wrote to memory of 1488 1092 2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe cmd.exe PID 1488 wrote to memory of 1068 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 1068 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 1068 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 1068 1488 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe"C:\Users\Admin\AppData\Local\Temp\2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\2347b68306afeeccc693c08ed36c8ea73ff24aade49d7ddad4299566dcc1a0b1.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1068
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
60KB
MD552fc1d1be74503d0074ddf1229d72774
SHA130a70baaf100f30d87a331e615883657cbe10d0e
SHA2562dc9602f882f7886e150caaafcce0ad2d914c215037e68305a79cf21bbe5b778
SHA5129f7dec728f9f4e1f6464df9ed92e746036844758454b88728d46c0adbcf3ccc5b583fa46a5e7f37a5100498227b4390f140da73e8fcd68739112dd5384bdf7c6
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
60KB
MD552fc1d1be74503d0074ddf1229d72774
SHA130a70baaf100f30d87a331e615883657cbe10d0e
SHA2562dc9602f882f7886e150caaafcce0ad2d914c215037e68305a79cf21bbe5b778
SHA5129f7dec728f9f4e1f6464df9ed92e746036844758454b88728d46c0adbcf3ccc5b583fa46a5e7f37a5100498227b4390f140da73e8fcd68739112dd5384bdf7c6
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
60KB
MD552fc1d1be74503d0074ddf1229d72774
SHA130a70baaf100f30d87a331e615883657cbe10d0e
SHA2562dc9602f882f7886e150caaafcce0ad2d914c215037e68305a79cf21bbe5b778
SHA5129f7dec728f9f4e1f6464df9ed92e746036844758454b88728d46c0adbcf3ccc5b583fa46a5e7f37a5100498227b4390f140da73e8fcd68739112dd5384bdf7c6
-
memory/1068-66-0x0000000000000000-mapping.dmp
-
memory/1092-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1092-62-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/1092-61-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/1092-60-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1092-65-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1488-64-0x0000000000000000-mapping.dmp
-
memory/1508-57-0x0000000000000000-mapping.dmp
-
memory/1508-63-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB