Managed XDR

62.133.61.49_downloads...penman_itr2023.pdf.lnk — malware analysis report

File info

Filename
62.133.61.49_downloads-nicole_penman-penman_itr2023.pdf.lnk
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=13, Archive, ctime=Sat May 8 08:13:59 2021, mtime=Sat May 8 08:13:59 2021, atime=Sat May 8 08:13:59 2021, length=41472, window=hidenormalshowminimized
File size
490.3 KB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
f993814c3eef5c7db1d4e6b090efa35d4e1d5a8f
SHA256
219d73854421969fc31c07e53191e9fefa2e00eac480ab63e73919024c8b7542
MD5
98cc3918cc413389ca961c95635f29c8

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content
T1059.001 suspicious_powershell: Creates suspicious powershell process
T1059.001 suspicious_process: Spawns a suspicious process
T1059.003 executes_dropped_cmd: Executes dropped batch files
T1059.005 obfuscated_vbs: Detected obfuscated VBS
T1047 has_wmi: Executes one or several WMI requests
T1059 wscript_info_discovery: Collects info about system with Wscript.Shell
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1218 suspicious_cmdline: Executes a suspicious command
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1027 obfuscated_vbs: Detected obfuscated VBS
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.001 antivm_generic_video: Checks information about video adapters in registry, possibly for anti-virtualization
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1518 locates_browser: Attempts to identify where browsers are installed
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.001 antivm_generic_video: Checks information about video adapters in registry, possibly for anti-virtualization
T1082 wscript_info_discovery: Collects info about system with Wscript.Shell

Command and Control

T1102.003 cloud_bitbucket: Connects to cloud services of bitbucket.org (potentially for malicious payload delivery)
T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet
T1102.003 cloud_amazonaws: Connects to cloud services of Amazon AWS (potentially for malicious payload delivery)

Other

yara_rules: Static rules
creates_exe: Creates executable files in the file system
runs_utility_without_cmdline: Runs system utility without arguments (non-typical usage)
multiple_useragents: Uses more than one unique User-Agent
opens_document: Opens office documents
suspicious_process_network: Unusual process network activity detected
creates_doc: Creates (office) documents in the file system
network_powershell: Powershell process network connection detected
creates_suspended_process: Creates suspended process
break_limit_exceeded: Warning: function calls limit has been exceeded
test_check_service: Starts services