Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2023 17:40
Behavioral task
behavioral1
Sample
fa685918b7320ca926400a3bc190bc49.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fa685918b7320ca926400a3bc190bc49.exe
Resource
win10v2004-20231215-en
General
-
Target
fa685918b7320ca926400a3bc190bc49.exe
-
Size
191KB
-
MD5
fa685918b7320ca926400a3bc190bc49
-
SHA1
d4aa058377deb43d54e7213c60882db4b7447dcf
-
SHA256
58eb20bc2754f2f80ef27a7d205d694fa6aca669c60047b9f513cafa09d60f96
-
SHA512
e864e24b556d01719d8e88011f9d89961429f5171e60616aa1f07d975b86329e9edf404bd442a9c779c6278751dd65be791c911431bf6635d380970a55ff8297
-
SSDEEP
1536:2oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroZeBsCXKTn8:h0hpgz6xGhTjwHN30BE8BsZ8
Malware Config
Signatures
-
Sakula payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fa685918b7320ca926400a3bc190bc49.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation fa685918b7320ca926400a3bc190bc49.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2820 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fa685918b7320ca926400a3bc190bc49.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" fa685918b7320ca926400a3bc190bc49.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fa685918b7320ca926400a3bc190bc49.exedescription pid process Token: SeIncBasePriorityPrivilege 1696 fa685918b7320ca926400a3bc190bc49.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fa685918b7320ca926400a3bc190bc49.execmd.exedescription pid process target process PID 1696 wrote to memory of 2820 1696 fa685918b7320ca926400a3bc190bc49.exe MediaCenter.exe PID 1696 wrote to memory of 2820 1696 fa685918b7320ca926400a3bc190bc49.exe MediaCenter.exe PID 1696 wrote to memory of 2820 1696 fa685918b7320ca926400a3bc190bc49.exe MediaCenter.exe PID 1696 wrote to memory of 1868 1696 fa685918b7320ca926400a3bc190bc49.exe cmd.exe PID 1696 wrote to memory of 1868 1696 fa685918b7320ca926400a3bc190bc49.exe cmd.exe PID 1696 wrote to memory of 1868 1696 fa685918b7320ca926400a3bc190bc49.exe cmd.exe PID 1868 wrote to memory of 368 1868 cmd.exe PING.EXE PID 1868 wrote to memory of 368 1868 cmd.exe PING.EXE PID 1868 wrote to memory of 368 1868 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa685918b7320ca926400a3bc190bc49.exe"C:\Users\Admin\AppData\Local\Temp\fa685918b7320ca926400a3bc190bc49.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\fa685918b7320ca926400a3bc190bc49.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
191KB
MD5022b6bb16036fcc596421dba9750b5a2
SHA10560e83a94f1c5297882e173a56157d1bb59942e
SHA256134e5014ee7279daac6282acaaa0a5395dfc758cc6984e040448944d870a85de
SHA512a85c804667a253d50b7934042cee0fca111db0460c0303dc19d43d2f5520f96640fc67f4efb19a07d7587acffc440562d8baf00327281395c78b5cf14f47efef