Managed XDR

111111111.lnk — malware analysis report

File info

Filename
111111111.lnk
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=7, Archive, ctime=Mon Jul 13 23:25:32 2009, mtime=Mon Jul 13 23:25:32 2009, atime=Tue Jul 14 01:39:31 2009, length=20480, window=hidenormalshowminimized
File size
1.3 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
d918cea00a096523134342313de5194a99d6f661
SHA256
add12efc8c415d9d6f5756458e7e4cda2ab3f04a11f1008087b08590e3adcc6c
MD5
2a608e86d9ae351aa416d93af6d761fc

Signatures

Persistence

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object