Analysis
-
max time kernel
131s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 12:59
Behavioral task
behavioral1
Sample
2b7044d1887a308585a8e27e0c8897c9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2b7044d1887a308585a8e27e0c8897c9.exe
Resource
win10v2004-20231215-en
General
-
Target
2b7044d1887a308585a8e27e0c8897c9.exe
-
Size
80KB
-
MD5
2b7044d1887a308585a8e27e0c8897c9
-
SHA1
8baa4f9f57f45e81c2fb211ca8ecbd68a87ccdab
-
SHA256
f00a881478ad56594918e540141374332c15574ad4491d8475a3067db32867dd
-
SHA512
c899005c984b2b8e43b210e8eb1cb3910d7179e7080e2fec3c633ce6550eca3ca093534935b0676192f95eb39c2e3bd46dd41d5b1b179006b86d3cd3a60197cb
-
SSDEEP
1536:hoaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroO:S0hpgz6xGhTjwHN30BEO
Malware Config
Signatures
-
Sakula payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2b7044d1887a308585a8e27e0c8897c9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 2b7044d1887a308585a8e27e0c8897c9.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1752 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2b7044d1887a308585a8e27e0c8897c9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 2b7044d1887a308585a8e27e0c8897c9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2b7044d1887a308585a8e27e0c8897c9.exedescription pid process Token: SeIncBasePriorityPrivilege 736 2b7044d1887a308585a8e27e0c8897c9.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2b7044d1887a308585a8e27e0c8897c9.execmd.exedescription pid process target process PID 736 wrote to memory of 1752 736 2b7044d1887a308585a8e27e0c8897c9.exe MediaCenter.exe PID 736 wrote to memory of 1752 736 2b7044d1887a308585a8e27e0c8897c9.exe MediaCenter.exe PID 736 wrote to memory of 1752 736 2b7044d1887a308585a8e27e0c8897c9.exe MediaCenter.exe PID 736 wrote to memory of 3268 736 2b7044d1887a308585a8e27e0c8897c9.exe cmd.exe PID 736 wrote to memory of 3268 736 2b7044d1887a308585a8e27e0c8897c9.exe cmd.exe PID 736 wrote to memory of 3268 736 2b7044d1887a308585a8e27e0c8897c9.exe cmd.exe PID 3268 wrote to memory of 4240 3268 cmd.exe PING.EXE PID 3268 wrote to memory of 4240 3268 cmd.exe PING.EXE PID 3268 wrote to memory of 4240 3268 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b7044d1887a308585a8e27e0c8897c9.exe"C:\Users\Admin\AppData\Local\Temp\2b7044d1887a308585a8e27e0c8897c9.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1752 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\2b7044d1887a308585a8e27e0c8897c9.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4240
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
80KB
MD5ce6f8f0c846d3121d083da839e7fb294
SHA1d96eb91a0f5a1d01267ef3e850c1978ae091260c
SHA256cf2f6e7c4335ab202e66a7141e4988fefc2374c04a0823a1ae15fe78467bf81b
SHA512d84cb2d463ca1e311dcd0e3587afc9841345325b7effd28a4b0fa4661986fe7fc021ff491cbffe5152fa0496dbe62f5184be775edb552b298ade6c471b039fd1