Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-10-2022 02:20
Static task
static1
Behavioral task
behavioral1
Sample
c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe
Resource
win10v2004-20220812-en
General
-
Target
c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe
-
Size
60KB
-
MD5
cfb618ea09382a4e7a68c3dd6a4732b3
-
SHA1
9156cb63276c50d24fa11f4dc6c2c65c01db2bb9
-
SHA256
c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4
-
SHA512
ff373843fe5d698316076cde9a087216ac62aefda35408a998ee407e0d9813d6a8b2025788cdfe6e3e7d3dc07a433afe7e8eb6140c0923292d3aaaa30f303f5e
-
SSDEEP
1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/X:iEoIlwIguEA4c5DgA9DOyq0eFP
Malware Config
Signatures
-
Sakula payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1048-60-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/1988-63-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/1048-66-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1988 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 672 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exepid process 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exedescription pid process Token: SeIncBasePriorityPrivilege 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.execmd.exedescription pid process target process PID 1048 wrote to memory of 1988 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe MediaCenter.exe PID 1048 wrote to memory of 1988 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe MediaCenter.exe PID 1048 wrote to memory of 1988 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe MediaCenter.exe PID 1048 wrote to memory of 1988 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe MediaCenter.exe PID 1048 wrote to memory of 672 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe cmd.exe PID 1048 wrote to memory of 672 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe cmd.exe PID 1048 wrote to memory of 672 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe cmd.exe PID 1048 wrote to memory of 672 1048 c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe cmd.exe PID 672 wrote to memory of 1012 672 cmd.exe PING.EXE PID 672 wrote to memory of 1012 672 cmd.exe PING.EXE PID 672 wrote to memory of 1012 672 cmd.exe PING.EXE PID 672 wrote to memory of 1012 672 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe"C:\Users\Admin\AppData\Local\Temp\c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\c2264f2d6a6e0108caa212d4c3c786f6d77ac907b02abf1ccf9d74f9439890f4.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
60KB
MD56960866eb3d04a5d58850cae1171e6fe
SHA1228cd7384221d34ae4bfec40c47f6245caa0beea
SHA25670377765076e39f305fca2060120599fdbab888ccad8f411ff75442c270b2f10
SHA5124abc8cd5f9f51f45ac954083eecb0d0b2daea97f16b478d45efa14f2eef343b7f3d241f9d8ed3b4331c16ff2f3039b8b3e314a49f815dec8c97e31c95d0642ba
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
60KB
MD56960866eb3d04a5d58850cae1171e6fe
SHA1228cd7384221d34ae4bfec40c47f6245caa0beea
SHA25670377765076e39f305fca2060120599fdbab888ccad8f411ff75442c270b2f10
SHA5124abc8cd5f9f51f45ac954083eecb0d0b2daea97f16b478d45efa14f2eef343b7f3d241f9d8ed3b4331c16ff2f3039b8b3e314a49f815dec8c97e31c95d0642ba
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
60KB
MD56960866eb3d04a5d58850cae1171e6fe
SHA1228cd7384221d34ae4bfec40c47f6245caa0beea
SHA25670377765076e39f305fca2060120599fdbab888ccad8f411ff75442c270b2f10
SHA5124abc8cd5f9f51f45ac954083eecb0d0b2daea97f16b478d45efa14f2eef343b7f3d241f9d8ed3b4331c16ff2f3039b8b3e314a49f815dec8c97e31c95d0642ba
-
memory/672-65-0x0000000000000000-mapping.dmp
-
memory/1012-67-0x0000000000000000-mapping.dmp
-
memory/1048-61-0x00000000001B0000-0x00000000001CA000-memory.dmpFilesize
104KB
-
memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1048-62-0x00000000001B0000-0x00000000001CA000-memory.dmpFilesize
104KB
-
memory/1048-64-0x00000000001B0000-0x00000000001CA000-memory.dmpFilesize
104KB
-
memory/1048-60-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1048-66-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1988-63-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1988-57-0x0000000000000000-mapping.dmp