ea25090f26e76a4d91a8d6fa325fe5068c341e7c002598ed7490caee8846d2ca

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/11/2022, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
demurest.cmd
Size 710B
Sample221101-mss7bsbhgl
SHA256 364d346da8e398a89d3542600cbc72984b857df3d20a6dc37879f14e5e173522
MD5 586fe6d361ef5208fad28c5ff8a4579b
SHA1 bf4177381235393279e7cdfd45a3fa497b7b8a96
SHA512 bb702af1aeba2b2ccf317404f601a61457fee2348a07c55324afee32406a0ab436b49a54eee2500f3620382f066d6912724ba7cb3cf4b4b1ee4997a3a922b8ea
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
692	entails.exe

Loads dropped DLL 1 IoCs

pid	Process
900	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1548	900	cmd.exe	29
PID 900 wrote to memory of 1548	900	cmd.exe	29
PID 900 wrote to memory of 1548	900	cmd.exe	29
PID 900 wrote to memory of 624	900	cmd.exe	30
PID 900 wrote to memory of 624	900	cmd.exe	30
PID 900 wrote to memory of 624	900	cmd.exe	30
PID 900 wrote to memory of 1620	900	cmd.exe	31
PID 900 wrote to memory of 1620	900	cmd.exe	31
PID 900 wrote to memory of 1620	900	cmd.exe	31
PID 900 wrote to memory of 1948	900	cmd.exe	32
PID 900 wrote to memory of 1948	900	cmd.exe	32
PID 900 wrote to memory of 1948	900	cmd.exe	32
PID 900 wrote to memory of 692	900	cmd.exe	33
PID 900 wrote to memory of 692	900	cmd.exe	33
PID 900 wrote to memory of 692	900	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\demurest.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo f"
  2⤵
  PID:1548
- C:\Windows\system32\xcopy.exe
  xcopy C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\entails.exe /h /s /e
  2⤵
  PID:624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo f"
  2⤵
  PID:1620
- C:\Windows\system32\xcopy.exe
  xcopy templates544.png C:\Users\Admin\AppData\Local\Temp\11959.10687 /h /s /e
  2⤵
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\entails.exe
  C:\Users\Admin\AppData\Local\Temp\entails.exe C:\Users\Admin\AppData\Local\Temp\11959.10687,#1
  2⤵
  - Executes dropped EXE
  PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

entails.exe

Path C:\Users\Admin\AppData\Local\Temp\entails.exe
Size 44KB
SHA256 f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9
MD5 dd81d91ff3b0763c392422865c9ac12e
SHA1 963b55acc8c566876364716d5aafa353995812a8
SHA512 8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120
SSDEEP 768:lC2UEwdMtWsxjR6l0eiJMVhbfMPURqbSEln5IyYpamDjobj8S:lkMtNoluMVdMPURqln5IUmDjoX
MD5 SHA1 SHA512 SSDEEP

Submit Download