Analysis
-
max time kernel
136s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-12-2023 14:27
Behavioral task
behavioral1
Sample
c714d185124b93abfa2b02b111eb3442.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c714d185124b93abfa2b02b111eb3442.exe
Resource
win10v2004-20231215-en
General
-
Target
c714d185124b93abfa2b02b111eb3442.exe
-
Size
191KB
-
MD5
c714d185124b93abfa2b02b111eb3442
-
SHA1
8b20352cc9edf5053f089e96c59a0e4792bc3ed4
-
SHA256
e55d454dce39b02cf51d2837c2c5b519f4f7edc703542c8dd702f84fc9e58bba
-
SHA512
2b2259e158e18939e60ac0f8a7a4d018b9273c0b838b26f68bb179f782258201538352798791fc886d5069162177f43f9b2dec5010348a88b8da7a0dc87c960c
-
SSDEEP
1536:2oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroZeBsCXKTn8:h0hpgz6xGhTjwHN30BE8BsZ8
Malware Config
Signatures
-
Sakula payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2600 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2888 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
c714d185124b93abfa2b02b111eb3442.exepid process 2860 c714d185124b93abfa2b02b111eb3442.exe 2860 c714d185124b93abfa2b02b111eb3442.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c714d185124b93abfa2b02b111eb3442.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" c714d185124b93abfa2b02b111eb3442.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c714d185124b93abfa2b02b111eb3442.exedescription pid process Token: SeIncBasePriorityPrivilege 2860 c714d185124b93abfa2b02b111eb3442.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c714d185124b93abfa2b02b111eb3442.execmd.exedescription pid process target process PID 2860 wrote to memory of 2888 2860 c714d185124b93abfa2b02b111eb3442.exe MediaCenter.exe PID 2860 wrote to memory of 2888 2860 c714d185124b93abfa2b02b111eb3442.exe MediaCenter.exe PID 2860 wrote to memory of 2888 2860 c714d185124b93abfa2b02b111eb3442.exe MediaCenter.exe PID 2860 wrote to memory of 2888 2860 c714d185124b93abfa2b02b111eb3442.exe MediaCenter.exe PID 2860 wrote to memory of 2600 2860 c714d185124b93abfa2b02b111eb3442.exe cmd.exe PID 2860 wrote to memory of 2600 2860 c714d185124b93abfa2b02b111eb3442.exe cmd.exe PID 2860 wrote to memory of 2600 2860 c714d185124b93abfa2b02b111eb3442.exe cmd.exe PID 2860 wrote to memory of 2600 2860 c714d185124b93abfa2b02b111eb3442.exe cmd.exe PID 2600 wrote to memory of 2952 2600 cmd.exe PING.EXE PID 2600 wrote to memory of 2952 2600 cmd.exe PING.EXE PID 2600 wrote to memory of 2952 2600 cmd.exe PING.EXE PID 2600 wrote to memory of 2952 2600 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c714d185124b93abfa2b02b111eb3442.exe"C:\Users\Admin\AppData\Local\Temp\c714d185124b93abfa2b02b111eb3442.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\c714d185124b93abfa2b02b111eb3442.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
191KB
MD5867f825e64065b0cd63eddc75a34bba0
SHA124fadb725ecae0ccca3727b0766d8267ec81176a
SHA2562c15da650559600d22dd2bb66117cc7295a6b8cac08fe8296a8d3d4c2bcca8e5
SHA5123b6cd511d3b270ac463ad64d47c55993566024301fafbe37620a68c33161ae7f2900e41860e5616922468754eb901762cc7a7ea84ec70e47a19e9b526d7608be