MALICIOUS — 2c2390c856ae36b4ece33a03459f4ff7f18e51985c8e921fc916bda0ba304469

MALICIOUS — 2c2390c856ae36b4ece33a03459f4ff7f18e51985c8e921fc916bda0ba304469 is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100), attributed to the Mehetme family. 1 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 2c2390c856ae36b4ece33a03459f4ff7f18e51985c8e921fc916bda0ba304469
SHA-1: d571d3b6f9518d79885b5ff3236f7441024948b8
MD5: 3e8f36ea606c71c1de63a98a58a2f621
ssdeep: 48:8Szd7bF8pRsgxDpwlzd7bF8ipRsgxDpw7zd7bF8ipRsgxDpw7zd7bF8ipRsgxDp:8Sz3qJ1wlz3lpJ1w7z3lpJ1w7z3lpJ1
TLSH: T1CC16CACE94ADCB41EA2E1F2425146CFE9912B1C27C391E5A2E4C547E44D0C638C7A33E
Submitted as: 2c2390c856ae36b4ece33a03459f4ff7f18e51985c8e921fc916bda0ba304469
File type: lnk · Size: 2808 bytes
Verdict: malicious (86/100) · Family: Mehetme

Detections (1 of 54 engines)

Microsoft Defender: Trojan:Win32/Mehetme.C!lnk

MITRE ATT&CK

Why this verdict

The malicious score of 86/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:Win32/Mehetme.C!lnk (rule Trojan:Win32/Mehetme.C!lnk) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

29912 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
default.exp-tas.com

Embedded IP addresses

20.184.175.8
52.123.252.222
4.230.171.124
48.211.4.16
20.247.184.142
74.179.77.204
135.232.92.97
52.182.143.212
57.154.63.210
172.64.154.167
48.200.63.27
4.207.44.64
172.178.240.162
4.207.44.69
203.26.79.13
4.150.223.113
20.184.175.11
20.50.201.200
52.148.114.188
72.153.5.96
52.110.12.53
52.110.12.50
172.172.255.218
172.172.255.217

File paths

C:\Users\george\Desktop\AcroRead.msi.exe

More Mehetme samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report