sakula | 7447543f4b7f45a231d2160a034db4b2634e1dccca4d57fb4b63f8398a625598

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 10:27

Target

07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe
Size

35KB
MD5

07f6900b7f4e6669133b8aaa5fc5f497
SHA1

26b32c44b9f5f7ac1ba14af1f339773dee49e129
SHA256

7447543f4b7f45a231d2160a034db4b2634e1dccca4d57fb4b63f8398a625598
SHA512

b81b44a238d0067e5f4b5352bbd36a5c26310dedfffa994a4a885dbd65300c6c0098df78eca0109593080af31fc818379fbb4fca170fce04813195714612aa15
SSDEEP

768:lwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647DG:lwbYP4nuEApQK4TQbtY2gA9DX+ytBOY

Score

10^/10

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2156-6-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/2484-7-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/2156-13-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/2484-21-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2484 MediaCenter.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe

pid	process
2484	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5388 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe

description pid process

Token: SeIncBasePriorityPrivilege 2156 07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe

pid	process
5388	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	2156	07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2156 wrote to memory of 2484	2156	07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe	MediaCenter.exe
PID 2156 wrote to memory of 2484	2156	07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe	MediaCenter.exe
PID 2156 wrote to memory of 2484	2156	07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe	MediaCenter.exe
PID 2156 wrote to memory of 1676	2156	07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe	cmd.exe
PID 2156 wrote to memory of 1676	2156	07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe	cmd.exe
PID 2156 wrote to memory of 1676	2156	07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe	cmd.exe
PID 1676 wrote to memory of 5388	1676	cmd.exe	PING.EXE
PID 1676 wrote to memory of 5388	1676	cmd.exe	PING.EXE
PID 1676 wrote to memory of 5388	1676	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2484

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\07f6900b7f4e6669133b8aaa5fc5f497_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
35KB

MD5
b37699499743c10dd53492736dc08065

SHA1
d8f8c4aac88855c6225e63d245f9714b435849d0

SHA256
da15bdd8a38a3aef37e68338873f8bfe6e8a638fc3c665cdebf3202c46526caa

SHA512
b7b79c84261141c3327daf94d2075685946d55849d66620463dea7b1bceb131784f1ebaca3c7ad988d45cee3a01605eec3573b5db9b4da83e9c173ecc8fc3cfc

Download Submit
memory/2156-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2156-6-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2156-13-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2484-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2484-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2484-21-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download