Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20-12-2023 17:40
Behavioral task
behavioral1
Sample
fa685918b7320ca926400a3bc190bc49.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fa685918b7320ca926400a3bc190bc49.exe
Resource
win10v2004-20231215-en
General
-
Target
fa685918b7320ca926400a3bc190bc49.exe
-
Size
191KB
-
MD5
fa685918b7320ca926400a3bc190bc49
-
SHA1
d4aa058377deb43d54e7213c60882db4b7447dcf
-
SHA256
58eb20bc2754f2f80ef27a7d205d694fa6aca669c60047b9f513cafa09d60f96
-
SHA512
e864e24b556d01719d8e88011f9d89961429f5171e60616aa1f07d975b86329e9edf404bd442a9c779c6278751dd65be791c911431bf6635d380970a55ff8297
-
SSDEEP
1536:2oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroZeBsCXKTn8:h0hpgz6xGhTjwHN30BE8BsZ8
Malware Config
Signatures
-
Sakula payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2188 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2756 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
fa685918b7320ca926400a3bc190bc49.exepid process 1760 fa685918b7320ca926400a3bc190bc49.exe 1760 fa685918b7320ca926400a3bc190bc49.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fa685918b7320ca926400a3bc190bc49.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" fa685918b7320ca926400a3bc190bc49.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fa685918b7320ca926400a3bc190bc49.exedescription pid process Token: SeIncBasePriorityPrivilege 1760 fa685918b7320ca926400a3bc190bc49.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fa685918b7320ca926400a3bc190bc49.execmd.exedescription pid process target process PID 1760 wrote to memory of 2756 1760 fa685918b7320ca926400a3bc190bc49.exe MediaCenter.exe PID 1760 wrote to memory of 2756 1760 fa685918b7320ca926400a3bc190bc49.exe MediaCenter.exe PID 1760 wrote to memory of 2756 1760 fa685918b7320ca926400a3bc190bc49.exe MediaCenter.exe PID 1760 wrote to memory of 2756 1760 fa685918b7320ca926400a3bc190bc49.exe MediaCenter.exe PID 1760 wrote to memory of 2188 1760 fa685918b7320ca926400a3bc190bc49.exe cmd.exe PID 1760 wrote to memory of 2188 1760 fa685918b7320ca926400a3bc190bc49.exe cmd.exe PID 1760 wrote to memory of 2188 1760 fa685918b7320ca926400a3bc190bc49.exe cmd.exe PID 1760 wrote to memory of 2188 1760 fa685918b7320ca926400a3bc190bc49.exe cmd.exe PID 2188 wrote to memory of 2576 2188 cmd.exe PING.EXE PID 2188 wrote to memory of 2576 2188 cmd.exe PING.EXE PID 2188 wrote to memory of 2576 2188 cmd.exe PING.EXE PID 2188 wrote to memory of 2576 2188 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa685918b7320ca926400a3bc190bc49.exe"C:\Users\Admin\AppData\Local\Temp\fa685918b7320ca926400a3bc190bc49.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\fa685918b7320ca926400a3bc190bc49.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
191KB
MD5678d5047f4639016ec18fdaf0d0f573a
SHA1cdb04ec7d5041239d4cefbf18e21674a55e8e21d
SHA256998b2c473c1dd9a46afe18543cf8e89c55a1740dccb09b245d955f340708754f
SHA51257da8a545f7a72c96d88816f6d20e227f24cf6669d058b8b9c5befce7faba7d183dda5c4d44d386e619d2b531da6ec9ec12097c7fb8d29701b6ab992b3944905