Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2023 14:27
Behavioral task
behavioral1
Sample
c714d185124b93abfa2b02b111eb3442.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c714d185124b93abfa2b02b111eb3442.exe
Resource
win10v2004-20231215-en
General
-
Target
c714d185124b93abfa2b02b111eb3442.exe
-
Size
191KB
-
MD5
c714d185124b93abfa2b02b111eb3442
-
SHA1
8b20352cc9edf5053f089e96c59a0e4792bc3ed4
-
SHA256
e55d454dce39b02cf51d2837c2c5b519f4f7edc703542c8dd702f84fc9e58bba
-
SHA512
2b2259e158e18939e60ac0f8a7a4d018b9273c0b838b26f68bb179f782258201538352798791fc886d5069162177f43f9b2dec5010348a88b8da7a0dc87c960c
-
SSDEEP
1536:2oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroZeBsCXKTn8:h0hpgz6xGhTjwHN30BE8BsZ8
Malware Config
Signatures
-
Sakula payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c714d185124b93abfa2b02b111eb3442.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation c714d185124b93abfa2b02b111eb3442.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3172 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c714d185124b93abfa2b02b111eb3442.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" c714d185124b93abfa2b02b111eb3442.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c714d185124b93abfa2b02b111eb3442.exedescription pid process Token: SeIncBasePriorityPrivilege 3820 c714d185124b93abfa2b02b111eb3442.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c714d185124b93abfa2b02b111eb3442.execmd.exedescription pid process target process PID 3820 wrote to memory of 3172 3820 c714d185124b93abfa2b02b111eb3442.exe MediaCenter.exe PID 3820 wrote to memory of 3172 3820 c714d185124b93abfa2b02b111eb3442.exe MediaCenter.exe PID 3820 wrote to memory of 3172 3820 c714d185124b93abfa2b02b111eb3442.exe MediaCenter.exe PID 3820 wrote to memory of 1648 3820 c714d185124b93abfa2b02b111eb3442.exe cmd.exe PID 3820 wrote to memory of 1648 3820 c714d185124b93abfa2b02b111eb3442.exe cmd.exe PID 3820 wrote to memory of 1648 3820 c714d185124b93abfa2b02b111eb3442.exe cmd.exe PID 1648 wrote to memory of 3448 1648 cmd.exe PING.EXE PID 1648 wrote to memory of 3448 1648 cmd.exe PING.EXE PID 1648 wrote to memory of 3448 1648 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c714d185124b93abfa2b02b111eb3442.exe"C:\Users\Admin\AppData\Local\Temp\c714d185124b93abfa2b02b111eb3442.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3172 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\c714d185124b93abfa2b02b111eb3442.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
191KB
MD5a9cedd87e6a97c2a58e792921899a473
SHA1c493c41dcb319fc11d73bb7b291d3eca2e315880
SHA2560c10a896deca0fc5a383c5629b147d1e6cb380c3901b5e8a4a7703490ea9f40b
SHA51212879ff284efdabd7853785010f92da880ba0d145a0d156587568173f2dfeb439e78bc479e28dbba6f29f9f8dee2ac23ce05efd272a6acbfcd804a687bf30a54