Analysis
-
max time kernel
120s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 12:47
Behavioral task
behavioral1
Sample
Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe
Resource
win10v2004-20240802-en
General
-
Target
Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe
-
Size
92KB
-
MD5
c28098175997d42658cc962fddfa4d66
-
SHA1
3ff7792a3f7aef62db8f3e356c774a4eae0971e3
-
SHA256
539e4310882605c47f0e625def8f057758df0a3072cb4d7a5894a5570c6aa3f0
-
SHA512
c4967c12ece1848dce16bb4b0d4bb507429ed7d4c44d0b23f048110bf98adf98331d37dc12004195a51ab227c2343dcf4e640198554fba8feaaf6e823497157f
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr3:9bfVk29te2jqxCEtg30Bj
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 1 IoCs
resource yara_rule behavioral1/files/0x0008000000016115-1.dat family_sakula -
Deletes itself 1 IoCs
pid Process 2896 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2364 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
pid Process 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 2364 AdobeUpdate.exe 2364 AdobeUpdate.exe 2364 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2896 cmd.exe 2992 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2992 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2364 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 30 PID 1044 wrote to memory of 2364 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 30 PID 1044 wrote to memory of 2364 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 30 PID 1044 wrote to memory of 2364 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 30 PID 1044 wrote to memory of 2364 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 30 PID 1044 wrote to memory of 2364 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 30 PID 1044 wrote to memory of 2364 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 30 PID 1044 wrote to memory of 2896 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 33 PID 1044 wrote to memory of 2896 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 33 PID 1044 wrote to memory of 2896 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 33 PID 1044 wrote to memory of 2896 1044 Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe 33 PID 2896 wrote to memory of 2992 2896 cmd.exe 35 PID 2896 wrote to memory of 2992 2896 cmd.exe 35 PID 2896 wrote to memory of 2992 2896 cmd.exe 35 PID 2896 wrote to memory of 2992 2896 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe"C:\Users\Admin\AppData\Local\Temp\Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2364
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\Virus.Autorun.ATA_virussign.com_c28098175997d42658cc962fddfa4d66.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2992
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5a4c4d1adada6962becd6c50498764828
SHA106358200bc1390153478f32b62a97ee3e18d4f7e
SHA256b447d8c125615d6573c1626194075af1b0075d7239c6357ab017e66ab3132e9e
SHA5127bf57e6b331d40dc518221f4054301e766c996d5477d37c4cf153dd32417c707bb7089106cb759fc3dd81e95d065ec3d67147a01f5143b71870fb724143d3b72