Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 15:00
Behavioral task
behavioral1
Sample
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe
Resource
win10v2004-20221111-en
General
-
Target
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe
-
Size
216KB
-
MD5
aeed90702457d219e5ee5040f10a7f4f
-
SHA1
d5e324245c11febe7d973e87135dd8e43f661c5d
-
SHA256
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30
-
SHA512
416824775fd93462a785be5e63e5835b992f82e756262bf2e043e529f333ac8432172a032d86ac18d21abfd3d38d6ee478a2a71fc21617596552485b33a139c1
-
SSDEEP
3072:d29DkEGRQixVSjLB130BYgjXjpEnQ77uZwOuz/xS3iGpZMq:d29qRfVSnr30B7Xj/GwBxE1+q
Malware Config
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/1636-59-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula behavioral1/memory/1736-61-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula behavioral1/memory/1736-62-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula behavioral1/memory/1636-64-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1736 MediaCenter.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral1/memory/1636-59-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1736-61-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1736-62-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1636-64-0x0000000000400000-0x0000000000425000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1660 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exepid process 1636 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exedescription pid process Token: SeIncBasePriorityPrivilege 1636 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.execmd.exedescription pid process target process PID 1636 wrote to memory of 1736 1636 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe MediaCenter.exe PID 1636 wrote to memory of 1736 1636 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe MediaCenter.exe PID 1636 wrote to memory of 1736 1636 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe MediaCenter.exe PID 1636 wrote to memory of 1736 1636 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe MediaCenter.exe PID 1636 wrote to memory of 1660 1636 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe cmd.exe PID 1636 wrote to memory of 1660 1636 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe cmd.exe PID 1636 wrote to memory of 1660 1636 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe cmd.exe PID 1636 wrote to memory of 1660 1636 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe cmd.exe PID 1660 wrote to memory of 1664 1660 cmd.exe PING.EXE PID 1660 wrote to memory of 1664 1660 cmd.exe PING.EXE PID 1660 wrote to memory of 1664 1660 cmd.exe PING.EXE PID 1660 wrote to memory of 1664 1660 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe"C:\Users\Admin\AppData\Local\Temp\fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
216KB
MD5ec4c61891fb7eba2391720f828a84965
SHA1132f22da476d6a867fcb7dc542bf088af51eadf2
SHA256f92f3b6608f8844fd622fd9921515276ee0b317871a7ee6414fbebc1b30bc26e
SHA51209c343d956557b7422aad38aee3710e6607e7bb46e2065924f8fa708b68b4897fd7e974ddb50b1977622dfe5f13b9220fecfde3459c0d53ff714025da7004e52
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
216KB
MD5ec4c61891fb7eba2391720f828a84965
SHA1132f22da476d6a867fcb7dc542bf088af51eadf2
SHA256f92f3b6608f8844fd622fd9921515276ee0b317871a7ee6414fbebc1b30bc26e
SHA51209c343d956557b7422aad38aee3710e6607e7bb46e2065924f8fa708b68b4897fd7e974ddb50b1977622dfe5f13b9220fecfde3459c0d53ff714025da7004e52
-
memory/1636-54-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/1636-59-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1636-60-0x0000000000230000-0x0000000000255000-memory.dmpFilesize
148KB
-
memory/1636-64-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1660-63-0x0000000000000000-mapping.dmp
-
memory/1664-65-0x0000000000000000-mapping.dmp
-
memory/1736-56-0x0000000000000000-mapping.dmp
-
memory/1736-61-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1736-62-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB