MALICIOUS — Contrato_Indeniza_Brasil-UJ1CH6.lnk

MALICIOUS — Contrato_Indeniza_Brasil-UJ1CH6.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the GenBadur family. 3 of 53 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 59f213a613ccf9656e1bcca071983daf52fe63932720856d95bae9fdab1b0822
SHA-1: b13eea05ad64949c0c0a161bdca89b825f55eba7
MD5: f3a334d46362f8430ad3aa48194c700a
ssdeep: 12:8rlfyf0m/VnEXzZURl2+URQGfwYH3bVZl5C7aWwUlDFlIqubdpYrn1IlI7GXuHb:8YfJtnyUD2+9w5b5QtjNqddNXuHY
TLSH: T12C149CCFD31C4702CB2E8839024D92EC248270D105D5B62C2D0CD73E69E242BDDA0579
Submitted as: Contrato_Indeniza_Brasil-UJ1CH6.lnk
File type: lnk · Size: 1585 bytes
Verdict: malicious (98/100) · Family: GenBadur

Detections (3 of 53 engines)

Microsoft Defender: Trojan:Win32/Ravartar!rfn
Emsisoft (Emergency Kit): Trojan.Generic.40387059
Kaspersky (KVRT): HEUR:Trojan.Multi.GenBadur.genw

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

2 behavioral detection(s): LOLBin: mshta executing remote/scripted payload [high] (rule tl-lolbin-mshta) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 4 finding(s), e.g. RWX/private injected region in svchost.exe (pid 912) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Shortcut launches: embedded-url - static signal, weight 0.50, confidence 0.80
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: main[1].css - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

16507 behavior events · 2 ATT&CK techniques · 16 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\cf-icon-server[1].png - 41553a537f85839927155af093b7bfa1987215f474ed038714609cc48812ea3b
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - ccea0b1651e9c90f345a6843df26ce3a473466ca723fb160a2028c0a3903e6db
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\9G746KYB\main[1].css - d30b4ea6f68456672f5abb35e9dcf7d54226372b66e9d60a7ee26b7a52568e74
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\cf-icon-browser[1].png - 78a7d8b29cabf16831417dba1b9bbe36fae0d060a35a495e8f10e9663b3c9e65
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - 3170582404500cb8726fd3dea643edadbe34998cb52af46ca01ab5d641469d64
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\9G746KYB\cf-icon-error[1].png - 67f70597a183fbca7fac55d609fbaac5c34bb4d4d32a0530bbbbb42591f2de2f
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9DD9D8EB1173CB9DA0F6DAA87673F76F - e1de6288c852b084cd2150590436b1e199ce63dbf1fb7e2d49a9b2d5469607e5
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\cf-icon-cloud[1].png - 3a223426c67a0a33ff57af68a57fb589fea36af2a6e8f9dae7798c77471e0e58
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9DD9D8EB1173CB9DA0F6DAA87673F76F - d04924ef26b002817d6934ad3e7c56b067ddf68379c9babb7a3fa88d90ad238a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - 0a90abccbb95013c700a97de5e694d3fccaa707e9b85401fe6001d0a1cd6d079
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\cf-icon-ok[1].png - ed732380ee3ff0f2d841784da213c8c05d2b5ae187a5217b419d21cae5cedb1b
ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye2.c.lencr.org/61.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787586918&P2=404&P3=2&P4=mv8wsYgZPvfdKBoKqzPwPncyPTmA1IUSxLsr5yhoguxrMKCobTG5TqvUkx%2bo3qECDFFOnFTY1wXRR3IOW0vmBw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

aglobaconvite.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye2.c.lencr.org

Embedded IP addresses

104.46.162.230
172.215.188.232
4.230.171.124
52.230.59.222
74.179.77.204
74.179.77.164
52.168.117.168
135.233.95.144
72.145.35.100
20.76.201.171
52.123.128.14
52.123.129.14
172.178.240.161
135.234.160.246
203.26.79.13
52.148.114.188
135.233.95.80
172.67.165.195
104.18.20.213
172.215.188.225
57.154.63.210
51.116.246.104
72.145.35.106
52.110.12.53
52.110.12.55

More GenBadur samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report