Managed XDR

favorite.lnk — malware analysis report

File info

Filename
favorite.lnk
File type
MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=13, Archive, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hidenormalshowminimized
File size
3.3 KB
First seen
Last seen

Environment

win7/x64 en

Hashes

SHA1
f56b860f429fa97c30115ed5aeeea5a06cef742f
SHA256
38e57256173aa98455e6b8784ab4ee6d029b0c35f1347d66d419ad9e38aba6ec
MD5
21d76be3a33d58c8dfc771d7d1f503c1

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content
T1059.003 suspicious_cmd: Executes cmd.exe with a suspicious command line

Defense Evasion

T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1027 suspicious_cmd: Executes cmd.exe with a suspicious command line

Discovery

T1518 locates_browser: Attempts to identify where browsers are installed
T1082 recon_systeminfo: Collects system information (ipconfig, netstat, systeminfo, net)

Command and Control

T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

dead_host: Connects to IP addresses that do not respond to requests
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
yara_rules: Static rules