Managed XDR

c-users-user-appdata-l...p-eu4emmdf.3p5-new.lnk — malware analysis report

File info

Filename
c-users-user-appdata-local-temp-eu4emmdf.3p5-new.lnk
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=1, Archive, ctime=Fri Nov 22 09:57:42 2024, mtime=Sun Dec 22 22:28:01 2024, atime=Fri Nov 22 09:57:42 2024, length=77824, window=hidenormalshowminimized
File size
1.8 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
5e7b56e7e2481b208fafcc4b407969518b5e75f1
SHA256
eee9ceae12a49c84927912efdf8bab09946fe91d6a8e85b35defd203259b9f65
MD5
ffd2c40dffc93330b1b6802700c10477

Signatures

Execution

T1059.007 rundll_javascript: Runs JavaScript using rundll32

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1218.011 rundll_javascript: Runs JavaScript using rundll32
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1552 cookie_files: Accesses cookie files
T1555.003 cookie_files: Accesses cookie files

Other

yara_rules: Static rules
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object