Managed XDR

klook_digital_marketin..._registration_form.lnk — malware analysis report

File info

Filename
klook_digital_marketing_campaign_assets-meeting_registration_form.lnk
File type
MS Windows shortcut, Has Working directory, Has command line arguments, Icon number=338, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hide
File size
3.9 KB
First seen
Last seen

Environment

win7/x64 en

Hashes

SHA1
c87c2a53a5a316193e353e9675267d63bea3dac7
SHA256
0eb23aa171aaee6795b8cbf18cd61b085e5a9fbb4a6355df3ba4ab26c76c2d8d
MD5
7cd60546b7b56ffa68bbff8366417a0a

Signatures

Execution

T1059.001 suspicious_powershell: Creates suspicious powershell process
T1059.001 suspicious_process: Spawns a suspicious process
T1059.003 suspicious_cmd: Executes cmd.exe with a suspicious command line
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Defense Evasion

T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1027 suspicious_cmd: Executes cmd.exe with a suspicious command line

Discovery

T1518 locates_browser: Attempts to identify where browsers are installed

Other

creates_exe: Creates executable files in the file system
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
yara_rules: Static rules