Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 12:59
Behavioral task
behavioral1
Sample
2b7044d1887a308585a8e27e0c8897c9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2b7044d1887a308585a8e27e0c8897c9.exe
Resource
win10v2004-20231215-en
General
-
Target
2b7044d1887a308585a8e27e0c8897c9.exe
-
Size
80KB
-
MD5
2b7044d1887a308585a8e27e0c8897c9
-
SHA1
8baa4f9f57f45e81c2fb211ca8ecbd68a87ccdab
-
SHA256
f00a881478ad56594918e540141374332c15574ad4491d8475a3067db32867dd
-
SHA512
c899005c984b2b8e43b210e8eb1cb3910d7179e7080e2fec3c633ce6550eca3ca093534935b0676192f95eb39c2e3bd46dd41d5b1b179006b86d3cd3a60197cb
-
SSDEEP
1536:hoaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroO:S0hpgz6xGhTjwHN30BEO
Malware Config
Signatures
-
Sakula payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2520 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2060 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
2b7044d1887a308585a8e27e0c8897c9.exepid process 2304 2b7044d1887a308585a8e27e0c8897c9.exe 2304 2b7044d1887a308585a8e27e0c8897c9.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2b7044d1887a308585a8e27e0c8897c9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 2b7044d1887a308585a8e27e0c8897c9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2b7044d1887a308585a8e27e0c8897c9.exedescription pid process Token: SeIncBasePriorityPrivilege 2304 2b7044d1887a308585a8e27e0c8897c9.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2b7044d1887a308585a8e27e0c8897c9.execmd.exedescription pid process target process PID 2304 wrote to memory of 2060 2304 2b7044d1887a308585a8e27e0c8897c9.exe MediaCenter.exe PID 2304 wrote to memory of 2060 2304 2b7044d1887a308585a8e27e0c8897c9.exe MediaCenter.exe PID 2304 wrote to memory of 2060 2304 2b7044d1887a308585a8e27e0c8897c9.exe MediaCenter.exe PID 2304 wrote to memory of 2060 2304 2b7044d1887a308585a8e27e0c8897c9.exe MediaCenter.exe PID 2304 wrote to memory of 2520 2304 2b7044d1887a308585a8e27e0c8897c9.exe cmd.exe PID 2304 wrote to memory of 2520 2304 2b7044d1887a308585a8e27e0c8897c9.exe cmd.exe PID 2304 wrote to memory of 2520 2304 2b7044d1887a308585a8e27e0c8897c9.exe cmd.exe PID 2304 wrote to memory of 2520 2304 2b7044d1887a308585a8e27e0c8897c9.exe cmd.exe PID 2520 wrote to memory of 2572 2520 cmd.exe PING.EXE PID 2520 wrote to memory of 2572 2520 cmd.exe PING.EXE PID 2520 wrote to memory of 2572 2520 cmd.exe PING.EXE PID 2520 wrote to memory of 2572 2520 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b7044d1887a308585a8e27e0c8897c9.exe"C:\Users\Admin\AppData\Local\Temp\2b7044d1887a308585a8e27e0c8897c9.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2060 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\2b7044d1887a308585a8e27e0c8897c9.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
80KB
MD5a2b5b4468ef05aa63c65371227060dd2
SHA10e298cc4d79aa8f4d124bb4165c93343656cbab2
SHA256dda28950ff393bd4e45d2be54ee10d8901ad2e19be2d3d0212bbd7f8198039be
SHA512e17a19e182646a67f618a8af90981e98ad45b0a9b1c2555fa933719f517f20f08c0663d29cf253e05b001c7548d6867ac822378928abcfdf1c0fbdda3fa576c7