Managed XDR

shortcut.lnk — malware analysis report

File info

Filename
shortcut.lnk
File type
MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=13, Archive, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hide
File size
2.3 KB
First seen
Last seen

Environment

win7/x64 en

Hashes

SHA1
70b030628f979e4a02b2a7b836e877145157eb00
SHA256
54ca372ced39a563a9868e3016f29a3e5125f62921eaf571d64096ca17ee8418
MD5
cf4a837f0453be8325f80cf05252351a

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content
T1059.003 suspicious_cmd: Executes cmd.exe with a suspicious command line

Defense Evasion

T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1027 suspicious_cmd: Executes cmd.exe with a suspicious command line

Discovery

T1518 locates_browser: Attempts to identify where browsers are installed
T1082 recon_systeminfo: Collects system information (ipconfig, netstat, systeminfo, net)

Command and Control

T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

dead_host: Connects to IP addresses that do not respond to requests
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process