ea25090f26e76a4d91a8d6fa325fe5068c341e7c002598ed7490caee8846d2ca

Analysis

max time kernel
62s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
demurest.cmd
Size 710B
Sample221101-mss7bsbhgl
SHA256 364d346da8e398a89d3542600cbc72984b857df3d20a6dc37879f14e5e173522
MD5 586fe6d361ef5208fad28c5ff8a4579b
SHA1 bf4177381235393279e7cdfd45a3fa497b7b8a96
SHA512 bb702af1aeba2b2ccf317404f601a61457fee2348a07c55324afee32406a0ab436b49a54eee2500f3620382f066d6912724ba7cb3cf4b4b1ee4997a3a922b8ea
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4844	entails.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 2716	3736	cmd.exe	86
PID 3736 wrote to memory of 2716	3736	cmd.exe	86
PID 3736 wrote to memory of 1648	3736	cmd.exe	87
PID 3736 wrote to memory of 1648	3736	cmd.exe	87
PID 3736 wrote to memory of 3412	3736	cmd.exe	88
PID 3736 wrote to memory of 3412	3736	cmd.exe	88
PID 3736 wrote to memory of 2228	3736	cmd.exe	89
PID 3736 wrote to memory of 2228	3736	cmd.exe	89
PID 3736 wrote to memory of 4844	3736	cmd.exe	90
PID 3736 wrote to memory of 4844	3736	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\demurest.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo f"
  2⤵
  PID:2716
- C:\Windows\system32\xcopy.exe
  xcopy C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\entails.exe /h /s /e
  2⤵
  PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo f"
  2⤵
  PID:3412
- C:\Windows\system32\xcopy.exe
  xcopy templates544.png C:\Users\Admin\AppData\Local\Temp\3162.714 /h /s /e
  2⤵
  PID:2228
- C:\Users\Admin\AppData\Local\Temp\entails.exe
  C:\Users\Admin\AppData\Local\Temp\entails.exe C:\Users\Admin\AppData\Local\Temp\3162.714,#1
  2⤵
  - Executes dropped EXE
  PID:4844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

entails.exe

Path C:\Users\Admin\AppData\Local\Temp\entails.exe
Size 70KB
SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
MD5 ef3179d498793bf4234f708d3be28633
SHA1 dd399ae46303343f9f0da189aee11c67bd868222
SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download