MALICIOUS — photov_142177907826.lnk

MALICIOUS — photov_142177907826.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Sonbokli family. 2 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 42abe096725fb195bb7d90f478e23a32c04f6eace478876dd2ff18ab0ff5a04a
• SHA-1: 6be9ac77601ee1d09a4cc300108dc2b16666c5e1
• MD5: 2c6e2bbd8646faca690b4d1f5ea38a64
• ssdeep: 24:8ol2IszKaQN7vpLbX0CXn6IcXNqCUkOVmO5ldiW8JmMV2:8olFQ5w7v1bX06nhcXNqCUkhO5lc70
• TLSH: T144147BCB26AC2F28C2318CE90171D69E8E55606605FDB6278913E8345212693D8B3BB3
• Submitted as: photov_142177907826.lnk
• File type: lnk · Size: 1834 bytes
• Verdict: malicious (95/100) · Family: Sonbokli

Detections (2 of 51 engines)

• Microsoft Defender: Trojan:Win32/Sonbokli.A!cl
• Kaspersky (KVRT): HEUR:Trojan.WinLNK.Agent.gen

MITRE ATT&CK

• T1543.003
• T1112

Why this verdict

The malicious score of 95/100 is the fusion of 7 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Sonbokli.A!cl (rule Trojan:Win32/Sonbokli.A!cl) - engine signal, weight 0.55, confidence 0.85
• Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
• Shortcut launches: powershell - static signal, weight 0.50, confidence 0.80
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 32 external host(s) at runtime (6 HTTP) - network signal, weight 0.40, confidence 0.80
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

19061 behavior events · 2 ATT&CK techniques · 14 dropped files.

Runtime network

• www.msftconnecttest.com
• wolkamo.com
• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• tas02.sls.update.microsoft.com
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• 1.0.240.10.in-addr.arpa
• 18.167.190.20.in-addr.arpa
• settings-win.data.microsoft.com
• 9.142.159.162.in-addr.arpa
• v10.events.data.microsoft.com
• 16.4.211.48.in-addr.arpa
• 113.223.150.4.in-addr.arpa
• 251.0.0.224.in-addr.arpa
• 85.52.40.23.in-addr.arpa

Dropped files

• /opt/CAPEv2/storage/analyses/4489/files/09df3f45cff32a06b5b0cf1fa3fb2bcf90adf6a1132d80ad0bdf550b717108c5 - 09df3f45cff32a06b5b0cf1fa3fb2bcf90adf6a1132d80ad0bdf550b717108c5
• /opt/CAPEv2/storage/analyses/4489/files/96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
• /opt/CAPEv2/storage/analyses/4489/files/6e2d4961874ffc2d8f94fdd1041d385896e7c21eabf474100252d09345e97e9c - 6e2d4961874ffc2d8f94fdd1041d385896e7c21eabf474100252d09345e97e9c
• 464abeec7aebb0d984551b24c86797a3cbad8fc03fc39daf6ecb7c865c7f394a - 464abeec7aebb0d984551b24c86797a3cbad8fc03fc39daf6ecb7c865c7f394a
• ef7f01f7b4a478ee19860cc34ec5b9f3824238d75ea3ff1d58dc27791761c496 - ef7f01f7b4a478ee19860cc34ec5b9f3824238d75ea3ff1d58dc27791761c496
• 7bc97cf9a1000998acf7e5b9144a2a58a11e813076b3b828ad00f1c1c78f1b94 - 7bc97cf9a1000998acf7e5b9144a2a58a11e813076b3b828ad00f1c1c78f1b94
• b55c4d37eed90556c0a0f2a8291b79d37ed3029d97f501c13a6fd2752ac91b20 - b55c4d37eed90556c0a0f2a8291b79d37ed3029d97f501c13a6fd2752ac91b20
• 293646da77ad7ccc3e5b4e9225d4c5f270aa8dac4d57c774ba1cc7fb62da0031 - 293646da77ad7ccc3e5b4e9225d4c5f270aa8dac4d57c774ba1cc7fb62da0031
• 253bd9fe0a761666e07c8b63b5a3cdea9788627918a2da7fc222142a41b5e1a9 - 253bd9fe0a761666e07c8b63b5a3cdea9788627918a2da7fc222142a41b5e1a9
• 6a86c33f16796118107629aa6a5ff9a8140b145582373d7b9d79ad5d78c904ad - 6a86c33f16796118107629aa6a5ff9a8140b145582373d7b9d79ad5d78c904ad
• 5475c43ee66510b2c718c62f86feffbea0f48567b6ea6ca29889599924714ec9 - 5475c43ee66510b2c718c62f86feffbea0f48567b6ea6ca29889599924714ec9
• 9d7e6a0d67f6c65e1f647d27764fd7fb767599888e817f61e36be532faad85c2 - 9d7e6a0d67f6c65e1f647d27764fd7fb767599888e817f61e36be532faad85c2
• 81ef680b11bcd74228b6c3531048ced344c249f835ac06c615448b0e0c9e9c5a - 81ef680b11bcd74228b6c3531048ced344c249f835ac06c615448b0e0c9e9c5a
• c1efd97bd2be27175b0211e6d704fd93a1230151265e34d927c900470445e54c - c1efd97bd2be27175b0211e6d704fd93a1230151265e34d927c900470445e54c

Embedded domains

• wolkamo.com

Embedded IP addresses

• 203.26.79.13
• 135.232.92.34
• 23.221.133.123
• 74.178.240.61
• 48.211.4.16
• 4.150.223.113
• 40.126.14.163
• 23.40.52.85
• 20.42.65.84
• 40.84.85.40
• 199.232.138.172
• 20.190.167.18
• 162.159.142.9
• 20.42.179.192
• 92.223.78.30
• 23.221.133.182
• 52.168.117.171
• 20.42.65.88
• 4.150.223.102
• 23.214.54.132
• 20.42.73.30
• 135.233.95.80
• 72.145.35.114
• 52.123.252.233
• 23.40.52.123

More Sonbokli samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report