Managed XDR

pack.mcmeta.lnk — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
pack.mcmeta.lnk
Тип файла
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 09:08:46 2019, mtime=Sat Dec 7 09:08:46 2019, atime=Sat Dec 7 09:08:46 2019, length=211456, window=hide
Размер файла
2.4 KB
Первое обнаружение
Последнее обнаружение

Окружение

win7/x64 en

Хеши

SHA1
a8949f24266d168db42c360e96ca6914edc9bcf1
SHA256
cd0c67354218fc62a1394b7949cdd43e8ba5970e2ceb11eecc22063143884c4e
MD5
b4f849a43f2e9ccc1e417f721420d145

Сигнатуры

Execution

T1204 suspicious_lnk: LNK file with suspicious content
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Persistence

T1197 bitsadmin_download: Downloads a file using bitsadmin

Defense Evasion

T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1197 bitsadmin_download: Downloads a file using bitsadmin

Other

unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process
yara_rules: Static rules