Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23/12/2024, 22:42
Behavioral task
behavioral1
Sample
7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe
Resource
win7-20241010-en
General
-
Target
7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe
-
Size
43KB
-
MD5
5d35a9de2232613ad3e0f35e17d2e497
-
SHA1
3c4042f5d19dac259ef48392a19f8ce9d63d5247
-
SHA256
7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd
-
SHA512
4028a54cffbd1fa3766ff4cc943e0faae719bed41955e8a654bfcb22bd99ddc12a08a7a0779177f06cb84338ac8be3e44c2b170cb95ca6b5d62fa5cd4d0e4e77
-
SSDEEP
768:+U9XnKJv8KrtPNxT4oreP7cIK3yQpdk6x8pf9m4P/S0hVvIZiGDZ6RO8nHE8taq5:+U9abrtX4oocIK3yQkaY9z/S0hhy6k83
Malware Config
Signatures
-
Sakula family
-
Sakula payload 4 IoCs
resource yara_rule behavioral1/memory/2264-11-0x0000000000890000-0x00000000008AF000-memory.dmp family_sakula behavioral1/memory/2220-12-0x0000000000FF0000-0x000000000100F000-memory.dmp family_sakula behavioral1/memory/2220-22-0x0000000000FF0000-0x000000000100F000-memory.dmp family_sakula behavioral1/memory/2264-26-0x0000000000890000-0x00000000008AF000-memory.dmp family_sakula -
Deletes itself 1 IoCs
pid Process 2820 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2264 MediaCenter.exe -
Loads dropped DLL 2 IoCs
pid Process 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe -
resource yara_rule behavioral1/memory/2220-0-0x0000000000FF0000-0x000000000100F000-memory.dmp upx behavioral1/files/0x0028000000016fe5-2.dat upx behavioral1/memory/2264-11-0x0000000000890000-0x00000000008AF000-memory.dmp upx behavioral1/memory/2220-12-0x0000000000FF0000-0x000000000100F000-memory.dmp upx behavioral1/memory/2220-22-0x0000000000FF0000-0x000000000100F000-memory.dmp upx behavioral1/memory/2264-26-0x0000000000890000-0x00000000008AF000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2820 cmd.exe 2804 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2804 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2264 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe 29 PID 2220 wrote to memory of 2264 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe 29 PID 2220 wrote to memory of 2264 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe 29 PID 2220 wrote to memory of 2264 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe 29 PID 2220 wrote to memory of 2820 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe 31 PID 2220 wrote to memory of 2820 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe 31 PID 2220 wrote to memory of 2820 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe 31 PID 2220 wrote to memory of 2820 2220 7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe 31 PID 2820 wrote to memory of 2804 2820 cmd.exe 33 PID 2820 wrote to memory of 2804 2820 cmd.exe 33 PID 2820 wrote to memory of 2804 2820 cmd.exe 33 PID 2820 wrote to memory of 2804 2820 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe"C:\Users\Admin\AppData\Local\Temp\7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2264
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\7c6145926daf0a2d2f7a48058c762698cd5c8081f376275b721067e48b4efacd.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2804
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5985d5b87c98bef975584e8ab79ca280e
SHA18626c9959b3c92552bd5744680b19296b7e265c4
SHA256e8ea4c48542799b8176988f36a89b2d2a08afb6d09abbf32c32fb2be08b5ac85
SHA51264f1804346b3681ec5329fc3835f164b5f8f152e554ff480bbe55d76c969a3e39b3b87de0e9b0b865aea838095017a96b75f5bfc66d3183281cff65cd036f5cd