Edit tour
Windows
Analysis Report
DECIDENT.LNK.lnk
Overview
General Information
| Sample Name: | DECIDENT.LNK.lnk |
| Analysis ID: | 795693 |
| MD5: | 0dcf849c45cbcbcc80f2faf974a2da70 |
| SHA1: | fb649af9030286b008898cbb0314f39689323a9e |
| SHA256: | dc8d25b04313db41d710d03a22c60eb79eff2f2c8e36980fb8328de6f62e00af |
| Tags: | IcedIDlnk |
| Infos: | |
 | |
Detection
| Score: | 52 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Windows shortcut file (LNK) starts blacklisted processes
Machine Learning detection for sample
Sample execution stops while process was sleeping (likely an evasion)
Program does not show much activity (idle)
Classification
- System is w10x64
cmd.exe (PID: 1804 cmdline: "C:\Window s\System32 \cmd.exe" /c "SPASTI CS\STYRACI N.CMD re g" i Monoe idic X Sor tieing MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 5264 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Joe Sandbox ML: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
Persistence and Installation Behavior | |
|---|
| Source: | Process created: | ||
| Source: | Last function: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Windows Management Instrumentation | Path Interception | 1 Process Injection | 1 Process Injection | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Data Obfuscation | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | 1 File and Directory Discovery | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Junk Data | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 3% | ReversingLabs | |||
| 7% | Virustotal | Browse | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No contacted domains info
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|
| IP |
|---|
| 192.168.2.1 |
| Joe Sandbox Version: | 36.0.0 Rainbow Opal |
| Analysis ID: | 795693 |
| Start date and time: | 2023-02-01 07:51:10 +01:00 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 2m 4s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Number of analysed new started processes analysed: | 2 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample file name: | DECIDENT.LNK.lnk |
| Detection: | MAL |
| Classification: | mal52.winLNK@2/0@0/1 |
| Cookbook Comments: |
|
- Not all processes where analyzed, report is missing behavior information
⊘No simulations
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 3.236690031941681 |
| TrID: |
|
| File name: | DECIDENT.LNK.lnk |
| File size: | 1784 |
| MD5: | 0dcf849c45cbcbcc80f2faf974a2da70 |
| SHA1: | fb649af9030286b008898cbb0314f39689323a9e |
| SHA256: | dc8d25b04313db41d710d03a22c60eb79eff2f2c8e36980fb8328de6f62e00af |
| SHA512: | c93120e27e161e82e5fe7d8beee0e8eac9a1ee5eb9d54b49eb04a3f15bccf6c04542648efd2edbff4f83a4106563f24a1957486bd1206a1f571e717a5404d98a |
| SSDEEP: | 24:8oWJR/AP97s4yMp5zCxUA6e+/U4I02Gd+dsT+m9l:8p4PtzUCeEIUd+dC+Gl |
| TLSH: | 3A31442F67E4471AE1F2467264ABB3118232F811E5274A2B41C0A18ADD20600FD2AB3F |
| File Content Preview: | L..................F.@.. ................0...........l......................5....P.O. .:i.....+00.../C:\...................V.1.....3VUb..Windows.@........OwH8V......(.....................It(.W.i.n.d.o.w.s.....Z.1.....4V.s..System32..B........OwH8V'....... |
 | |
| Icon Hash: | f4ccccccccc9c9cd |
General | |
|---|---|
| Relative Path: | |
| Command Line Argument: | /c "SPASTICS\STYRACIN.CMD reg" i Monoeidic X Sortieing |
| Icon location: | C:\Windows\System32\zipfldr.dll |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeReport size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 0 |
| Start time: | 07:52:06 |
| Start date: | 01/02/2023 |
| Path: | C:\Windows\System32\cmd.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff632260000 |
| File size: | 273920 bytes |
| MD5 hash: | 4E2ACF4F8A396486AB4268C94A6A245F |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Target ID: | 1 |
| Start time: | 07:52:06 |
| Start date: | 01/02/2023 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7c72c0000 |
| File size: | 625664 bytes |
| MD5 hash: | EA777DEEA782E8B4D7C7C33BBF8A4496 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
⊘No disassembly