Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 15:06
Behavioral task
behavioral1
Sample
c707e190d65c58e8ea738388879202bc_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c707e190d65c58e8ea738388879202bc_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
c707e190d65c58e8ea738388879202bc_JC.exe
-
Size
92KB
-
MD5
c707e190d65c58e8ea738388879202bc
-
SHA1
c7c67f5278183c72abe574ec73039a3dde3a9469
-
SHA256
6e4606db35e67d5c39dede0e0acae67b0fc150581d0268263dc0ac15cbd86aae
-
SHA512
c3025d3818efc21cae7d59282713f3222f0fd912615572b8e0867882a4e884a843b52e24ad542400e994c1696cfc0ef4c82081fe17fcf687d9cac1cbc435741e
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr0:9bfVk29te2jqxCEtg30BQ
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2456 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2824 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
Processes:
c707e190d65c58e8ea738388879202bc_JC.exeAdobeUpdate.exepid process 2752 c707e190d65c58e8ea738388879202bc_JC.exe 2824 AdobeUpdate.exe 2824 AdobeUpdate.exe 2824 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c707e190d65c58e8ea738388879202bc_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" c707e190d65c58e8ea738388879202bc_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c707e190d65c58e8ea738388879202bc_JC.exedescription pid process Token: SeIncBasePriorityPrivilege 2752 c707e190d65c58e8ea738388879202bc_JC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
c707e190d65c58e8ea738388879202bc_JC.execmd.exedescription pid process target process PID 2752 wrote to memory of 2824 2752 c707e190d65c58e8ea738388879202bc_JC.exe AdobeUpdate.exe PID 2752 wrote to memory of 2824 2752 c707e190d65c58e8ea738388879202bc_JC.exe AdobeUpdate.exe PID 2752 wrote to memory of 2824 2752 c707e190d65c58e8ea738388879202bc_JC.exe AdobeUpdate.exe PID 2752 wrote to memory of 2824 2752 c707e190d65c58e8ea738388879202bc_JC.exe AdobeUpdate.exe PID 2752 wrote to memory of 2824 2752 c707e190d65c58e8ea738388879202bc_JC.exe AdobeUpdate.exe PID 2752 wrote to memory of 2824 2752 c707e190d65c58e8ea738388879202bc_JC.exe AdobeUpdate.exe PID 2752 wrote to memory of 2824 2752 c707e190d65c58e8ea738388879202bc_JC.exe AdobeUpdate.exe PID 2752 wrote to memory of 2456 2752 c707e190d65c58e8ea738388879202bc_JC.exe cmd.exe PID 2752 wrote to memory of 2456 2752 c707e190d65c58e8ea738388879202bc_JC.exe cmd.exe PID 2752 wrote to memory of 2456 2752 c707e190d65c58e8ea738388879202bc_JC.exe cmd.exe PID 2752 wrote to memory of 2456 2752 c707e190d65c58e8ea738388879202bc_JC.exe cmd.exe PID 2456 wrote to memory of 2500 2456 cmd.exe PING.EXE PID 2456 wrote to memory of 2500 2456 cmd.exe PING.EXE PID 2456 wrote to memory of 2500 2456 cmd.exe PING.EXE PID 2456 wrote to memory of 2500 2456 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c707e190d65c58e8ea738388879202bc_JC.exe"C:\Users\Admin\AppData\Local\Temp\c707e190d65c58e8ea738388879202bc_JC.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\c707e190d65c58e8ea738388879202bc_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5ee5e2acce5b8269d5d1386c76b7dd598
SHA196e06e64983b4b03cc89b99ba5b49e0a36c27a30
SHA256c6d08d27e4bef5052c24ea16af65e7160ae08cafa788192d25f7df497a5a1b8b
SHA51231288a16e7f049524fbb36a6bc72c2b24efb2fbaf33537b9a34b88fd3947db6604b73f03d9a9966f9e2c48f94aa34df0d9afb5deac8915ce2fd28d99a83f9034
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5ee5e2acce5b8269d5d1386c76b7dd598
SHA196e06e64983b4b03cc89b99ba5b49e0a36c27a30
SHA256c6d08d27e4bef5052c24ea16af65e7160ae08cafa788192d25f7df497a5a1b8b
SHA51231288a16e7f049524fbb36a6bc72c2b24efb2fbaf33537b9a34b88fd3947db6604b73f03d9a9966f9e2c48f94aa34df0d9afb5deac8915ce2fd28d99a83f9034
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5ee5e2acce5b8269d5d1386c76b7dd598
SHA196e06e64983b4b03cc89b99ba5b49e0a36c27a30
SHA256c6d08d27e4bef5052c24ea16af65e7160ae08cafa788192d25f7df497a5a1b8b
SHA51231288a16e7f049524fbb36a6bc72c2b24efb2fbaf33537b9a34b88fd3947db6604b73f03d9a9966f9e2c48f94aa34df0d9afb5deac8915ce2fd28d99a83f9034
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5ee5e2acce5b8269d5d1386c76b7dd598
SHA196e06e64983b4b03cc89b99ba5b49e0a36c27a30
SHA256c6d08d27e4bef5052c24ea16af65e7160ae08cafa788192d25f7df497a5a1b8b
SHA51231288a16e7f049524fbb36a6bc72c2b24efb2fbaf33537b9a34b88fd3947db6604b73f03d9a9966f9e2c48f94aa34df0d9afb5deac8915ce2fd28d99a83f9034
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5ee5e2acce5b8269d5d1386c76b7dd598
SHA196e06e64983b4b03cc89b99ba5b49e0a36c27a30
SHA256c6d08d27e4bef5052c24ea16af65e7160ae08cafa788192d25f7df497a5a1b8b
SHA51231288a16e7f049524fbb36a6bc72c2b24efb2fbaf33537b9a34b88fd3947db6604b73f03d9a9966f9e2c48f94aa34df0d9afb5deac8915ce2fd28d99a83f9034
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5ee5e2acce5b8269d5d1386c76b7dd598
SHA196e06e64983b4b03cc89b99ba5b49e0a36c27a30
SHA256c6d08d27e4bef5052c24ea16af65e7160ae08cafa788192d25f7df497a5a1b8b
SHA51231288a16e7f049524fbb36a6bc72c2b24efb2fbaf33537b9a34b88fd3947db6604b73f03d9a9966f9e2c48f94aa34df0d9afb5deac8915ce2fd28d99a83f9034