Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2023 14:56
Static task
static1
Behavioral task
behavioral1
Sample
cf354485ff99ff7fd40ab0199949c46b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cf354485ff99ff7fd40ab0199949c46b.exe
Resource
win10v2004-20231215-en
General
-
Target
cf354485ff99ff7fd40ab0199949c46b.exe
-
Size
58KB
-
MD5
cf354485ff99ff7fd40ab0199949c46b
-
SHA1
10de82d12ed108783d38a2e4c81e9ac5320ba991
-
SHA256
2ab286f997883bca4ef5a91198c9a0888f3f9f5ce901ef1f07b6637befeadeb2
-
SHA512
b29fe046ae40e284a6d8bd9ee5efd43b22c63e5aa18eb93767e7699e54bbf64e9e2eb0fa1da4b789d9651df672a3fe7337eee4123ec3a6f835312361f19d6810
-
SSDEEP
1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/9:iEoIlwIguEA4c5DgA9DOyq0eFl
Malware Config
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3116-6-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/4828-7-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/3116-12-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/4828-17-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cf354485ff99ff7fd40ab0199949c46b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation cf354485ff99ff7fd40ab0199949c46b.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4828 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cf354485ff99ff7fd40ab0199949c46b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" cf354485ff99ff7fd40ab0199949c46b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cf354485ff99ff7fd40ab0199949c46b.exedescription pid process Token: SeIncBasePriorityPrivilege 3116 cf354485ff99ff7fd40ab0199949c46b.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cf354485ff99ff7fd40ab0199949c46b.execmd.exedescription pid process target process PID 3116 wrote to memory of 4828 3116 cf354485ff99ff7fd40ab0199949c46b.exe MediaCenter.exe PID 3116 wrote to memory of 4828 3116 cf354485ff99ff7fd40ab0199949c46b.exe MediaCenter.exe PID 3116 wrote to memory of 4828 3116 cf354485ff99ff7fd40ab0199949c46b.exe MediaCenter.exe PID 3116 wrote to memory of 3644 3116 cf354485ff99ff7fd40ab0199949c46b.exe cmd.exe PID 3116 wrote to memory of 3644 3116 cf354485ff99ff7fd40ab0199949c46b.exe cmd.exe PID 3116 wrote to memory of 3644 3116 cf354485ff99ff7fd40ab0199949c46b.exe cmd.exe PID 3644 wrote to memory of 2452 3644 cmd.exe PING.EXE PID 3644 wrote to memory of 2452 3644 cmd.exe PING.EXE PID 3644 wrote to memory of 2452 3644 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf354485ff99ff7fd40ab0199949c46b.exe"C:\Users\Admin\AppData\Local\Temp\cf354485ff99ff7fd40ab0199949c46b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:4828 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\cf354485ff99ff7fd40ab0199949c46b.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
58KB
MD558e11429209aa79aac7fbf42e066fc1d
SHA1336bbcf5873b8b3ec76224b179b3a43d758318c6
SHA256ed4fcac697de20732b33257fc6d4d7bed3e6758c1dc697aa12db4f8c00281a82
SHA512e61298f77c4ba11e8b358bc95f1494bde9442b74453a64cf2c51922c16ac1f0b01e5ce588669b5831f014ea63c4096ff4c52fbf8562af89863a4d5ed8b33a041
-
memory/3116-0-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3116-6-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3116-12-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4828-5-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4828-7-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4828-17-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB