Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-10-2022 02:20
Static task
static1
Behavioral task
behavioral1
Sample
1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe
Resource
win10v2004-20220812-en
General
-
Target
1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe
-
Size
60KB
-
MD5
7e634cea60fb51966c21d3f901d6cc5e
-
SHA1
4cf6b630dd4664054a378b6643a72863e212ccd3
-
SHA256
1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208
-
SHA512
6b7ee088d790712ff1fa2e7b7e4efa9e23bf5e9445cf752151acaaddbbc7522f25862a492618b803986d65fce2fa5570b99ab6f56592842e1223d74eeb3c0b5b
-
SSDEEP
1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/v:iEoIlwIguEA4c5DgA9DOyq0eFn
Malware Config
Signatures
-
Sakula payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/768-60-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/1536-63-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/768-66-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1536 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 832 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exepid process 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exedescription pid process Token: SeIncBasePriorityPrivilege 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.execmd.exedescription pid process target process PID 768 wrote to memory of 1536 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe MediaCenter.exe PID 768 wrote to memory of 1536 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe MediaCenter.exe PID 768 wrote to memory of 1536 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe MediaCenter.exe PID 768 wrote to memory of 1536 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe MediaCenter.exe PID 768 wrote to memory of 832 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe cmd.exe PID 768 wrote to memory of 832 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe cmd.exe PID 768 wrote to memory of 832 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe cmd.exe PID 768 wrote to memory of 832 768 1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe cmd.exe PID 832 wrote to memory of 428 832 cmd.exe PING.EXE PID 832 wrote to memory of 428 832 cmd.exe PING.EXE PID 832 wrote to memory of 428 832 cmd.exe PING.EXE PID 832 wrote to memory of 428 832 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe"C:\Users\Admin\AppData\Local\Temp\1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\1fe1369697e4c5376449bacd262c6fe2c8966624c6407d7128da98d42d3c0208.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
60KB
MD50799d06905d7951a9eb75fb2d2b09402
SHA1c1de984399bcbcd166b0380c208d9f9e5d199122
SHA256e4f2efdb2bd9b5161f93d09e0364dfeb2916f7a415bc5528b639589ad76fb9e1
SHA51218115c9e6c047a0856d47beda9f632df127f3197153fc892506aaaf95f0b521119230ebfc77f7c631cd15e5530778eee95c651b7be37f0bfe361c0f52406732e
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
60KB
MD50799d06905d7951a9eb75fb2d2b09402
SHA1c1de984399bcbcd166b0380c208d9f9e5d199122
SHA256e4f2efdb2bd9b5161f93d09e0364dfeb2916f7a415bc5528b639589ad76fb9e1
SHA51218115c9e6c047a0856d47beda9f632df127f3197153fc892506aaaf95f0b521119230ebfc77f7c631cd15e5530778eee95c651b7be37f0bfe361c0f52406732e
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
60KB
MD50799d06905d7951a9eb75fb2d2b09402
SHA1c1de984399bcbcd166b0380c208d9f9e5d199122
SHA256e4f2efdb2bd9b5161f93d09e0364dfeb2916f7a415bc5528b639589ad76fb9e1
SHA51218115c9e6c047a0856d47beda9f632df127f3197153fc892506aaaf95f0b521119230ebfc77f7c631cd15e5530778eee95c651b7be37f0bfe361c0f52406732e
-
memory/428-67-0x0000000000000000-mapping.dmp
-
memory/768-64-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/768-62-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/768-61-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/768-60-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/768-54-0x0000000076871000-0x0000000076873000-memory.dmpFilesize
8KB
-
memory/768-66-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/832-65-0x0000000000000000-mapping.dmp
-
memory/1536-63-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1536-57-0x0000000000000000-mapping.dmp