Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 11:22
Behavioral task
behavioral1
Sample
82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe
Resource
win7-20240729-en
General
-
Target
82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe
-
Size
63KB
-
MD5
3fb6663de6801190409249b761189950
-
SHA1
08f016d0c755bdf62447fff69e7e4dcd7cbc6d0d
-
SHA256
82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3
-
SHA512
fb16401b14dd6733fa1e9e98f77b0de7595fe314961b240d40f4ce39d4106c6fc712733c53f55f30f85b2241a9f82d9636e26534c956d6389d0080db5eef765f
-
SSDEEP
1536:zoxBP0D61Oj3+5FdOa52C8pdo95j6hZ2MzNDCkrU:0PPUj3+5FMIn8To94wa7U
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula family
-
Sakula payload 3 IoCs
resource yara_rule behavioral2/memory/2228-9-0x0000000000400000-0x0000000000424000-memory.dmp family_sakula behavioral2/memory/1468-11-0x0000000000400000-0x0000000000424000-memory.dmp family_sakula behavioral2/memory/2228-16-0x0000000000400000-0x0000000000424000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe -
Executes dropped EXE 1 IoCs
pid Process 1468 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe -
resource yara_rule behavioral2/memory/2228-0-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/files/0x000c000000023b91-3.dat upx behavioral2/memory/2228-9-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/1468-11-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2228-16-0x0000000000400000-0x0000000000424000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1284 cmd.exe 4240 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4240 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2228 82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2228 wrote to memory of 1468 2228 82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe 82 PID 2228 wrote to memory of 1468 2228 82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe 82 PID 2228 wrote to memory of 1468 2228 82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe 82 PID 2228 wrote to memory of 1284 2228 82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe 91 PID 2228 wrote to memory of 1284 2228 82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe 91 PID 2228 wrote to memory of 1284 2228 82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe 91 PID 1284 wrote to memory of 4240 1284 cmd.exe 93 PID 1284 wrote to memory of 4240 1284 cmd.exe 93 PID 1284 wrote to memory of 4240 1284 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe"C:\Users\Admin\AppData\Local\Temp\82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4240
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD59a481369b3d7d9b76ece1306eef31323
SHA18df3dac87f3465494ac442c84bb66b893f63231b
SHA2562bd92fd04069a9e63e7c1255a0c89be1390cf0794961c99c6ba81c158b3eff0e
SHA512dda10a62b03be9632086146163ed2b631c6d391fe1e032ec784e1183a76f988f77d25c45b046ab2bf23f5477d8b999762ef0db9b72ff379222e09e50e2bf48cb