ea25090f26e76a4d91a8d6fa325fe5068c341e7c002598ed7490caee8846d2ca

Resubmissions

02/11/2022, 02:54

221102-ddxrjahedq8

01/11/2022, 10:44

221101-ms9jbabab28

Analysis

max time kernel
114s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
documents-9771.lnk
Size 2KB
Sample221101-ms9jbabab2
SHA256 57842fe8723ed6ebdf7fc17fc341909ad05a7a4feec8bdb5e062882da29fa1a8
MD5 51e416c3d3be568864994449cd39caa1
SHA1 ee1c5e9f1257fbda3b174d534d06dddf435d3327
SHA512 020cc070c30e5cf192145056b24198846b9cc856ba001924eb95d439d521cffc5c133f7c8506724a2e53083fb5cd8343945370094ed1e1923ca3e9622526bcd8
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
424	entails.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2500	4196	cmd.exe	82
PID 4196 wrote to memory of 2500	4196	cmd.exe	82
PID 2500 wrote to memory of 4896	2500	cmd.exe	86
PID 2500 wrote to memory of 4896	2500	cmd.exe	86
PID 2500 wrote to memory of 4252	2500	cmd.exe	87
PID 2500 wrote to memory of 4252	2500	cmd.exe	87
PID 2500 wrote to memory of 5100	2500	cmd.exe	88
PID 2500 wrote to memory of 5100	2500	cmd.exe	88
PID 2500 wrote to memory of 3532	2500	cmd.exe	89
PID 2500 wrote to memory of 3532	2500	cmd.exe	89
PID 2500 wrote to memory of 424	2500	cmd.exe	90
PID 2500 wrote to memory of 424	2500	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\documents-9771.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\demurest.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo f"
    3⤵
    PID:4896
- - C:\Windows\system32\xcopy.exe
    xcopy C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\entails.exe /h /s /e
    3⤵
    PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo f"
    3⤵
    PID:5100
- - C:\Windows\system32\xcopy.exe
    xcopy templates544.png C:\Users\Admin\AppData\Local\Temp\2709.2127 /h /s /e
    3⤵
    PID:3532
- - C:\Users\Admin\AppData\Local\Temp\entails.exe
    C:\Users\Admin\AppData\Local\Temp\entails.exe C:\Users\Admin\AppData\Local\Temp\2709.2127,#1
    3⤵
    - Executes dropped EXE
    PID:424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

entails.exe

Path C:\Users\Admin\AppData\Local\Temp\entails.exe
Size 70KB
SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
MD5 ef3179d498793bf4234f708d3be28633
SHA1 dd399ae46303343f9f0da189aee11c67bd868222
SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download