Analysis
-
max time kernel
146s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 11:13
Behavioral task
behavioral1
Sample
08c1af6e6884de0651229437ebe83fb0_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
08c1af6e6884de0651229437ebe83fb0_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
08c1af6e6884de0651229437ebe83fb0_JC.exe
-
Size
99KB
-
MD5
08c1af6e6884de0651229437ebe83fb0
-
SHA1
700106680d5aaab9f54b22d9fc6e1e49ec39fd0c
-
SHA256
ee79d61bc66889174edd9533d7ab5aeb9b098b562ce0598bb3c5aa60495ce764
-
SHA512
23d0b90585b9182c58bc67fe2b4dd28a4e6017e9f99eb9572857dc8a8779474ca7b855c28622149cc61f59015d9b2975f96d9a8f21f975e79e0226f6b647aa7c
-
SSDEEP
1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrMx:c0hpgz6xGhZamyF30Bgx
Malware Config
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2424-0-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/3576-4-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/3576-6-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral2/memory/2424-7-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
08c1af6e6884de0651229437ebe83fb0_JC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation 08c1af6e6884de0651229437ebe83fb0_JC.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3576 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
08c1af6e6884de0651229437ebe83fb0_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 08c1af6e6884de0651229437ebe83fb0_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
08c1af6e6884de0651229437ebe83fb0_JC.exedescription pid process Token: SeIncBasePriorityPrivilege 2424 08c1af6e6884de0651229437ebe83fb0_JC.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
08c1af6e6884de0651229437ebe83fb0_JC.execmd.exedescription pid process target process PID 2424 wrote to memory of 3576 2424 08c1af6e6884de0651229437ebe83fb0_JC.exe MediaCenter.exe PID 2424 wrote to memory of 3576 2424 08c1af6e6884de0651229437ebe83fb0_JC.exe MediaCenter.exe PID 2424 wrote to memory of 3576 2424 08c1af6e6884de0651229437ebe83fb0_JC.exe MediaCenter.exe PID 2424 wrote to memory of 812 2424 08c1af6e6884de0651229437ebe83fb0_JC.exe cmd.exe PID 2424 wrote to memory of 812 2424 08c1af6e6884de0651229437ebe83fb0_JC.exe cmd.exe PID 2424 wrote to memory of 812 2424 08c1af6e6884de0651229437ebe83fb0_JC.exe cmd.exe PID 812 wrote to memory of 3740 812 cmd.exe PING.EXE PID 812 wrote to memory of 3740 812 cmd.exe PING.EXE PID 812 wrote to memory of 3740 812 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\08c1af6e6884de0651229437ebe83fb0_JC.exe"C:\Users\Admin\AppData\Local\Temp\08c1af6e6884de0651229437ebe83fb0_JC.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3576 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\08c1af6e6884de0651229437ebe83fb0_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD5121ea37f127d41783fb233b32ad7335c
SHA17b53a62712621285a2a063f7b90eed2368b1453d
SHA256f2e886ebcf6611e4996424c92ef3f8a923bee87612c4cc357c6af3d143a9b031
SHA5126c340a8e67188f18f143c822ceb3fa38f9cba62e17e582fbd67ff93ac987e05d424781f1b374dfc429aa6b241352affa80a6ac59949e8c6d61a99b49bb5787c9
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD5121ea37f127d41783fb233b32ad7335c
SHA17b53a62712621285a2a063f7b90eed2368b1453d
SHA256f2e886ebcf6611e4996424c92ef3f8a923bee87612c4cc357c6af3d143a9b031
SHA5126c340a8e67188f18f143c822ceb3fa38f9cba62e17e582fbd67ff93ac987e05d424781f1b374dfc429aa6b241352affa80a6ac59949e8c6d61a99b49bb5787c9
-
memory/2424-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2424-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3576-4-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3576-6-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB