Managed XDR

c-users-user-appdata-l..._po-24-0590-01_pdf.lnk — malware analysis report

File info

Filename
c-users-user-appdata-local-temp-lgkzpbog.nwe-unitedgs_po-24-0590-01_pdf.lnk
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=11, Archive, ctime=Sat Sep 7 00:29:00 2019, mtime=Sat Sep 7 00:29:00 2019, atime=Sat Sep 7 00:29:00 2019, length=278528, window=hidenormalshowminimized
File size
3.8 KB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
58dc8019bfc829b446a8a87f5e07ce0a4066c80a
SHA256
b7e2c39efdd806d48b0ea67cf0d4198758a063dcfa1c7aeb6ff94287228dc0f7
MD5
7970d6ab895a95c1a7a7f46851e51514

Signatures

Execution

T1059.001 suspicious_powershell: Creates suspicious powershell process
T1204 suspicious_lnk: LNK file with suspicious content
T1059.001 suspicious_process: Spawns a suspicious process

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1518 locates_browser: Attempts to identify where browsers are installed

Other

dead_host: Connects to IP addresses that do not respond to requests
network_powershell: Powershell process network connection detected
creates_suspended_process: Creates suspended process
writes_data: Writes big amount of data to disk
yara_rules: Static rules