Analysis
-
max time kernel
125s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2024 23:10
Behavioral task
behavioral1
Sample
5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe
Resource
win10v2004-20241007-en
General
-
Target
5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe
-
Size
92KB
-
MD5
5237e96881dc205e761b920550a3ae0f
-
SHA1
1a2eba62f37ffacf0311d0b8d535526c90254c21
-
SHA256
5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f
-
SHA512
82079d87e00ebfd9fd7a81b10a838726ba06323dfea95ba008393a961a3770a1ba857fa867f4a9ce40bd36426053895980929dc41050e9232a7667f2b9d1b15d
-
SSDEEP
1536:R7M3BhP/E9y9f/zMGv/4P6bR1ik5J/lEuU0Ay2s+eHxCEtkz30rtrs:O3BN+IfRO6bRnlZAvHcxCEtg30Bw
Malware Config
Signatures
-
Sakula family
-
Sakula payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2968 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" 5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AdobeUpdate.execmd.exePING.EXE5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid process 3272 cmd.exe 3956 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exedescription pid process Token: SeIncBasePriorityPrivilege 864 5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.execmd.exedescription pid process target process PID 864 wrote to memory of 2968 864 5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe AdobeUpdate.exe PID 864 wrote to memory of 2968 864 5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe AdobeUpdate.exe PID 864 wrote to memory of 2968 864 5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe AdobeUpdate.exe PID 864 wrote to memory of 3272 864 5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe cmd.exe PID 864 wrote to memory of 3272 864 5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe cmd.exe PID 864 wrote to memory of 3272 864 5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe cmd.exe PID 3272 wrote to memory of 3956 3272 cmd.exe PING.EXE PID 3272 wrote to memory of 3956 3272 cmd.exe PING.EXE PID 3272 wrote to memory of 3956 3272 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe"C:\Users\Admin\AppData\Local\Temp\5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3956
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD506c33f72d346aa479ff9ea9cb2e9c447
SHA160d9c7e6782d4ee32b1dc3e077993bd92158ea21
SHA256d0cb69cd57015a43c07aeb1cdf8934d2c49d1c7372106d8ead193a2f7c493baa
SHA5125a7b7ad137cfbf7c66410ef52a2da9b5b9b31c24a490812a836755f1bd7e103ff8ee1e11eae6943e094e7fb5c026d0440fe9a5ebb007d3b6ff81266e60027381