Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 10:40
Behavioral task
behavioral1
Sample
6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe
Resource
win7-20240708-en
General
-
Target
6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe
-
Size
283KB
-
MD5
f939079733fccb00db0356d07f3c29c0
-
SHA1
d1ac9a4713e684c68de1bf1cff164797945caa86
-
SHA256
6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1
-
SHA512
de3add44f6cb2388e49c6f57c6c2f7c4d66936faf16d3ff85dca87d263df4631ed590f23b25e6c8f6228784e5b019185e5c3d63f12dd52fa2206c593f8e94e6a
-
SSDEEP
1536:NU9abrtX4oocIK3yQkaY9z/S0hhnDiKKJqTnouy8HeBsCXKTnhxJS:Nm2rocIyhYtJxKJqrout+BsZha
Malware Config
Signatures
-
Sakula payload 5 IoCs
resource yara_rule behavioral2/memory/708-5-0x0000000000880000-0x000000000089F000-memory.dmp family_sakula behavioral2/memory/1464-6-0x0000000000D50000-0x0000000000D6F000-memory.dmp family_sakula behavioral2/memory/708-8-0x0000000000880000-0x000000000089F000-memory.dmp family_sakula behavioral2/memory/1464-14-0x0000000000D50000-0x0000000000D6F000-memory.dmp family_sakula behavioral2/memory/708-18-0x0000000000880000-0x000000000089F000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation 6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe -
Executes dropped EXE 1 IoCs
pid Process 708 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe -
resource yara_rule behavioral2/memory/1464-0-0x0000000000D50000-0x0000000000D6F000-memory.dmp upx behavioral2/files/0x000a0000000234f4-3.dat upx behavioral2/memory/708-5-0x0000000000880000-0x000000000089F000-memory.dmp upx behavioral2/memory/1464-6-0x0000000000D50000-0x0000000000D6F000-memory.dmp upx behavioral2/memory/708-8-0x0000000000880000-0x000000000089F000-memory.dmp upx behavioral2/memory/1464-14-0x0000000000D50000-0x0000000000D6F000-memory.dmp upx behavioral2/memory/708-18-0x0000000000880000-0x000000000089F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1168 cmd.exe 4820 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4820 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1464 6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1464 wrote to memory of 708 1464 6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe 82 PID 1464 wrote to memory of 708 1464 6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe 82 PID 1464 wrote to memory of 708 1464 6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe 82 PID 1464 wrote to memory of 1168 1464 6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe 91 PID 1464 wrote to memory of 1168 1464 6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe 91 PID 1464 wrote to memory of 1168 1464 6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe 91 PID 1168 wrote to memory of 4820 1168 cmd.exe 93 PID 1168 wrote to memory of 4820 1168 cmd.exe 93 PID 1168 wrote to memory of 4820 1168 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe"C:\Users\Admin\AppData\Local\Temp\6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:708
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\6958be6fbaf7cbcdf52d9d5fbac1b53b332c59fc3339b63536554392ba56c7b1N.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4820
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283KB
MD523890779c58c972088ae5e359a2c049d
SHA1dd62478a114ae0ae3de8d6cf16d04c5951c73ca1
SHA2566706e8679d324e90a21d92dfe18449809c2bad94222b90cd5a1551b43316370f
SHA512d7e094371f1f3744cc1f5b0928b56b96b77c9c7bf85cb279644800f47bc634fd1c8de7f1ff805d59f4d0f0e9892a7bfe960967d4e18f8cfe03f2226208e32593