Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 23:50
Behavioral task
behavioral1
Sample
7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe
Resource
win10v2004-20240508-en
General
-
Target
7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe
-
Size
355KB
-
MD5
9bcc123f6b5ee1d90b79dd78e7e0adc9
-
SHA1
2e096849c0e1c3a4938372c2e41f06ea3c759250
-
SHA256
7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b
-
SHA512
c60c4fdf87e4c61eae0b51001e04c17c078c7cbc6d696e0858aec19b6c5dab764ab92284a78867985268c311061eb789fe3004d3e407feb6adf522cdc088fbb6
-
SSDEEP
3072:c0hpgz6xGhYJF30Butn6rout1Rg8BsZh2:c0U6530BA6roS1a+
Malware Config
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2652-0-0x00000000010F0000-0x0000000001111000-memory.dmp family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/316-11-0x0000000000EE0000-0x0000000000F01000-memory.dmp family_sakula behavioral1/memory/2652-12-0x00000000010F0000-0x0000000001111000-memory.dmp family_sakula behavioral1/memory/316-15-0x0000000000EE0000-0x0000000000F01000-memory.dmp family_sakula behavioral1/memory/2652-16-0x00000000010F0000-0x0000000001111000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2608 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 316 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exepid process 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe -
Processes:
resource yara_rule behavioral1/memory/2652-0-0x00000000010F0000-0x0000000001111000-memory.dmp upx \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral1/memory/316-11-0x0000000000EE0000-0x0000000000F01000-memory.dmp upx behavioral1/memory/2652-12-0x00000000010F0000-0x0000000001111000-memory.dmp upx behavioral1/memory/316-15-0x0000000000EE0000-0x0000000000F01000-memory.dmp upx behavioral1/memory/2652-16-0x00000000010F0000-0x0000000001111000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exedescription pid process Token: SeIncBasePriorityPrivilege 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.execmd.exedescription pid process target process PID 2652 wrote to memory of 316 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe MediaCenter.exe PID 2652 wrote to memory of 316 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe MediaCenter.exe PID 2652 wrote to memory of 316 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe MediaCenter.exe PID 2652 wrote to memory of 316 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe MediaCenter.exe PID 2652 wrote to memory of 2608 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe cmd.exe PID 2652 wrote to memory of 2608 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe cmd.exe PID 2652 wrote to memory of 2608 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe cmd.exe PID 2652 wrote to memory of 2608 2652 7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe cmd.exe PID 2608 wrote to memory of 2616 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 2616 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 2616 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 2616 2608 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe"C:\Users\Admin\AppData\Local\Temp\7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\7d6ba1da4f5b2e43962fe4902245f4133f3026c714cf6fcc56cd4c1702cc2d7b.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
355KB
MD54394c950b7c3ecfb187f6ca80d0d41eb
SHA18db695a3e3118cb375220c08a4510b53cce12091
SHA256827cf5df9fcc63b6dab2d492b8f454a4ba2bd1097c3772c887330fb5d5c34e25
SHA512ae187db7272e1ef009597fbe3750cc69d912feeab7fdb3337d65346b234e4408e435ecb1d187be66c37bdc59cb45430968b373448e4df0058d1e5c1fd549dede
-
memory/316-11-0x0000000000EE0000-0x0000000000F01000-memory.dmpFilesize
132KB
-
memory/316-15-0x0000000000EE0000-0x0000000000F01000-memory.dmpFilesize
132KB
-
memory/2652-0-0x00000000010F0000-0x0000000001111000-memory.dmpFilesize
132KB
-
memory/2652-4-0x0000000000EE0000-0x0000000000F01000-memory.dmpFilesize
132KB
-
memory/2652-10-0x0000000000EE0000-0x0000000000F01000-memory.dmpFilesize
132KB
-
memory/2652-12-0x00000000010F0000-0x0000000001111000-memory.dmpFilesize
132KB
-
memory/2652-13-0x0000000000EE0000-0x0000000000F01000-memory.dmpFilesize
132KB
-
memory/2652-14-0x0000000000EE0000-0x0000000000F01000-memory.dmpFilesize
132KB
-
memory/2652-16-0x00000000010F0000-0x0000000001111000-memory.dmpFilesize
132KB
-
memory/2652-17-0x0000000000EE0000-0x0000000000F01000-memory.dmpFilesize
132KB