Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20-12-2023 14:56
Static task
static1
Behavioral task
behavioral1
Sample
cf354485ff99ff7fd40ab0199949c46b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cf354485ff99ff7fd40ab0199949c46b.exe
Resource
win10v2004-20231215-en
General
-
Target
cf354485ff99ff7fd40ab0199949c46b.exe
-
Size
58KB
-
MD5
cf354485ff99ff7fd40ab0199949c46b
-
SHA1
10de82d12ed108783d38a2e4c81e9ac5320ba991
-
SHA256
2ab286f997883bca4ef5a91198c9a0888f3f9f5ce901ef1f07b6637befeadeb2
-
SHA512
b29fe046ae40e284a6d8bd9ee5efd43b22c63e5aa18eb93767e7699e54bbf64e9e2eb0fa1da4b789d9651df672a3fe7337eee4123ec3a6f835312361f19d6810
-
SSDEEP
1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/9:iEoIlwIguEA4c5DgA9DOyq0eFl
Malware Config
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-1-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/2520-10-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/1716-19-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/2520-24-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2740 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2520 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cf354485ff99ff7fd40ab0199949c46b.exepid process 1716 cf354485ff99ff7fd40ab0199949c46b.exe 1716 cf354485ff99ff7fd40ab0199949c46b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cf354485ff99ff7fd40ab0199949c46b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" cf354485ff99ff7fd40ab0199949c46b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cf354485ff99ff7fd40ab0199949c46b.exedescription pid process Token: SeIncBasePriorityPrivilege 1716 cf354485ff99ff7fd40ab0199949c46b.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cf354485ff99ff7fd40ab0199949c46b.execmd.exedescription pid process target process PID 1716 wrote to memory of 2520 1716 cf354485ff99ff7fd40ab0199949c46b.exe MediaCenter.exe PID 1716 wrote to memory of 2520 1716 cf354485ff99ff7fd40ab0199949c46b.exe MediaCenter.exe PID 1716 wrote to memory of 2520 1716 cf354485ff99ff7fd40ab0199949c46b.exe MediaCenter.exe PID 1716 wrote to memory of 2520 1716 cf354485ff99ff7fd40ab0199949c46b.exe MediaCenter.exe PID 1716 wrote to memory of 2740 1716 cf354485ff99ff7fd40ab0199949c46b.exe cmd.exe PID 1716 wrote to memory of 2740 1716 cf354485ff99ff7fd40ab0199949c46b.exe cmd.exe PID 1716 wrote to memory of 2740 1716 cf354485ff99ff7fd40ab0199949c46b.exe cmd.exe PID 1716 wrote to memory of 2740 1716 cf354485ff99ff7fd40ab0199949c46b.exe cmd.exe PID 2740 wrote to memory of 2864 2740 cmd.exe PING.EXE PID 2740 wrote to memory of 2864 2740 cmd.exe PING.EXE PID 2740 wrote to memory of 2864 2740 cmd.exe PING.EXE PID 2740 wrote to memory of 2864 2740 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf354485ff99ff7fd40ab0199949c46b.exe"C:\Users\Admin\AppData\Local\Temp\cf354485ff99ff7fd40ab0199949c46b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\cf354485ff99ff7fd40ab0199949c46b.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
8KB
MD52b5488d9940071dc52c8fdc5abe12c1a
SHA1712ed445feeeb1a823022d7200c2e5be36722669
SHA256fb216060d1dcc425a39dd6988f5effdcd7d1b3f3bdaff14a3adf5a9f5401b883
SHA512b2d341045d320c9912c628191bc3f26bc05463d50e535da879c08c219b8223a2a158ceba7c4fbf25ba4fa3726103fc2675cd2b1ca3fa234dc001e4a965e7c548
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
58KB
MD5d195b8525c8d30c5aa25fd5426ce619a
SHA1dab194d501b52ee162e4fb587f148b009cdaa25d
SHA256d8b0cd0d7acc9dd628ce09b843ec0377464c9a06dec1700ffafe868f010f99ad
SHA51270a936d5a896e1cd031986d9a7f6bc69686bb6f6f306d41379db2d39077fb874ad61d6abf6be10d474cea370a184bf8eabc18576bb30cf3eacf0373f375db9d3
-
memory/1716-9-0x0000000000340000-0x000000000035A000-memory.dmpFilesize
104KB
-
memory/1716-1-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1716-11-0x0000000000340000-0x000000000035A000-memory.dmpFilesize
104KB
-
memory/1716-16-0x0000000000340000-0x000000000035A000-memory.dmpFilesize
104KB
-
memory/1716-19-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2520-10-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2520-24-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB