Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2024, 20:15
Behavioral task
behavioral1
Sample
216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe
Resource
win7-20241010-en
General
-
Target
216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe
-
Size
43KB
-
MD5
95341762747074c82d059c5f79843177
-
SHA1
0017b0ae120a1bd2b983769effe6d478367b623c
-
SHA256
216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e
-
SHA512
0138265b4b565af0c8847eca1d3a0023af9fb777fd2130f2e8dfd27abba218f68121df05826775b86ad10ac93264e137863a30e2623c95d58720e50191503cd9
-
SSDEEP
768:+U9XnKJv8KrtPNxT4oreP7cIK3yQpdk6x8pf9m4P/S0hVvIZiGDZ6RO8nHE8taq8:+U9abrtX4oocIK3yQkaY9z/S0hhy6k8q
Malware Config
Signatures
-
Sakula family
-
Sakula payload 4 IoCs
resource yara_rule behavioral2/memory/1908-6-0x0000000000BA0000-0x0000000000BBF000-memory.dmp family_sakula behavioral2/memory/4280-8-0x0000000000EA0000-0x0000000000EBF000-memory.dmp family_sakula behavioral2/memory/1908-14-0x0000000000BA0000-0x0000000000BBF000-memory.dmp family_sakula behavioral2/memory/4280-17-0x0000000000EA0000-0x0000000000EBF000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe -
Executes dropped EXE 1 IoCs
pid Process 4280 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe -
resource yara_rule behavioral2/memory/1908-0-0x0000000000BA0000-0x0000000000BBF000-memory.dmp upx behavioral2/memory/4280-4-0x0000000000EA0000-0x0000000000EBF000-memory.dmp upx behavioral2/files/0x000b000000023b76-3.dat upx behavioral2/memory/1908-6-0x0000000000BA0000-0x0000000000BBF000-memory.dmp upx behavioral2/memory/4280-8-0x0000000000EA0000-0x0000000000EBF000-memory.dmp upx behavioral2/memory/1908-14-0x0000000000BA0000-0x0000000000BBF000-memory.dmp upx behavioral2/memory/4280-17-0x0000000000EA0000-0x0000000000EBF000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1292 cmd.exe 2012 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2012 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1908 216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1908 wrote to memory of 4280 1908 216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe 83 PID 1908 wrote to memory of 4280 1908 216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe 83 PID 1908 wrote to memory of 4280 1908 216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe 83 PID 1908 wrote to memory of 1292 1908 216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe 99 PID 1908 wrote to memory of 1292 1908 216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe 99 PID 1908 wrote to memory of 1292 1908 216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe 99 PID 1292 wrote to memory of 2012 1292 cmd.exe 101 PID 1292 wrote to memory of 2012 1292 cmd.exe 101 PID 1292 wrote to memory of 2012 1292 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe"C:\Users\Admin\AppData\Local\Temp\216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4280
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\216756ec55417da199b7e19587d2218f52d89721b0706229cb7d80badd87a03e.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2012
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD59377efd7465ced379920bb825bc733ca
SHA154c18cda1926d8c55f23d4218b86eb7a995a3c32
SHA2568a9d927893028c0d9977cc592083b5c89a35a5caae7d670198701b61383f8923
SHA51238c45a3fc9a2f7de0c54a3d07eb21b52bcdb8bfa106ee49aba762652d2f78b5a42e269403366b708386a467599d73287097c9714c89851d9f273879bef98c361