Managed XDR

shortcut.lnk — malware analysis report

File info

Filename
shortcut.lnk
File type
MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hidenormalshowminimized
File size
1.1 KB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
5f6c458974f05c43e52e8291c168b2dc4122f9cc
SHA256
778d5e57b12bbf131f90ee7bfe4190719810f9f6278cbc13fd5c957123306aa9
MD5
1ef2b5d3f12cffee3a23e9ee4b6514f0

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content

Defense Evasion

T1218 suspicious_cmdline: Executes a suspicious command
T1096 persistence_ads: Creates Alternate Data Stream (ADS)
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers

Command and Control

T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Other

network_bind: Starts servers listening at None
suspicious_process_network: Unusual process network activity detected
creates_suspended_process: Creates suspended process
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
yara_rules: Static rules
Managed XDR