Analysis
-
max time kernel
365s -
max time network
417s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 15:00
Behavioral task
behavioral1
Sample
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe
Resource
win10v2004-20221111-en
General
-
Target
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe
-
Size
216KB
-
MD5
aeed90702457d219e5ee5040f10a7f4f
-
SHA1
d5e324245c11febe7d973e87135dd8e43f661c5d
-
SHA256
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30
-
SHA512
416824775fd93462a785be5e63e5835b992f82e756262bf2e043e529f333ac8432172a032d86ac18d21abfd3d38d6ee478a2a71fc21617596552485b33a139c1
-
SSDEEP
3072:d29DkEGRQixVSjLB130BYgjXjpEnQ77uZwOuz/xS3iGpZMq:d29qRfVSnr30B7Xj/GwBxE1+q
Malware Config
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2680-132-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/3264-136-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula behavioral2/memory/2680-137-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula behavioral2/memory/2680-139-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3264 MediaCenter.exe -
Processes:
resource yara_rule behavioral2/memory/2680-132-0x0000000000400000-0x0000000000425000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral2/memory/3264-136-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2680-137-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2680-139-0x0000000000400000-0x0000000000425000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exedescription pid process Token: SeIncBasePriorityPrivilege 2680 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.execmd.exedescription pid process target process PID 2680 wrote to memory of 3264 2680 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe MediaCenter.exe PID 2680 wrote to memory of 3264 2680 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe MediaCenter.exe PID 2680 wrote to memory of 3264 2680 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe MediaCenter.exe PID 2680 wrote to memory of 4492 2680 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe cmd.exe PID 2680 wrote to memory of 4492 2680 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe cmd.exe PID 2680 wrote to memory of 4492 2680 fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe cmd.exe PID 4492 wrote to memory of 4288 4492 cmd.exe PING.EXE PID 4492 wrote to memory of 4288 4492 cmd.exe PING.EXE PID 4492 wrote to memory of 4288 4492 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe"C:\Users\Admin\AppData\Local\Temp\fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\fea30fb740e6b44de81dc35bbb4e2ffac8d9f5dcb31cfa5808a69f4ccb32eb30.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
216KB
MD5ec1ab608525b729cd6fa18a51fad6478
SHA1ecc75724c528b94c3eb6441e180da741983b089b
SHA2569bf502ea798314b53cca2590b782454248ddf9c28437bafe85290430209c8782
SHA51294a816e5a04c3a43db03acb3b692ee6d16ca9a82c673e453f454572048658fdf636348b6fc861c423351811d5bacee4bd7121ef0603c82d296027e80422d6617
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
216KB
MD5ec1ab608525b729cd6fa18a51fad6478
SHA1ecc75724c528b94c3eb6441e180da741983b089b
SHA2569bf502ea798314b53cca2590b782454248ddf9c28437bafe85290430209c8782
SHA51294a816e5a04c3a43db03acb3b692ee6d16ca9a82c673e453f454572048658fdf636348b6fc861c423351811d5bacee4bd7121ef0603c82d296027e80422d6617
-
memory/2680-132-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2680-137-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2680-139-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3264-133-0x0000000000000000-mapping.dmp
-
memory/3264-136-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4288-140-0x0000000000000000-mapping.dmp
-
memory/4492-138-0x0000000000000000-mapping.dmp