MALICIOUS — photov_070766354893.lnk
MALICIOUS — photov_070766354893.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 3 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
608ff5958e7a748cc4d32f7d8c0ef47406b82dd2a664162836357ebbd08eda8b - SHA-1:
4064adc9fe04c271b6eb19fd3ed0abf1914a5120 - MD5:
5571da4eee12f44372941ff9a8d43f19 - ssdeep:
24:8Ju1dfJnjtUHqueXn66NqCUk4I0wVmOV4I0mr4k:8GjKHkn/NqCU7ImOqID - TLSH:
T1E816A8CD275D4B32C33588B98072D3AE0652E0B501BCB9258E19983B668B443DDB7538 - Submitted as: photov_070766354893.lnk
- File type: lnk · Size: 2734 bytes
- Verdict: malicious (97/100)
Detections (3 of 51 engines)
- Microsoft Defender: Trojan:Win32/Ravartar!rfn
- Emsisoft (Emergency Kit): Trojan.GenericKD.80977462
- Kaspersky (KVRT): HEUR:Trojan.WinLNK.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 97/100 is the fusion of 7 weighted signals:
- Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 928) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:Win32/Ravartar!rfn (rule
Trojan:Win32/Ravartar!rfn) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80977462 (rule
Trojan.GenericKD.80977462) - engine signal, weight 0.55, confidence 0.85 - Shortcut launches: powershell - static signal, weight 0.50, confidence 0.80
- Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
23865 behavior events · 2 ATT&CK techniques · 9 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- searchapp.bundleassets.example
- icudon.com
- desktop-hsgcbep
- v10.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- login.live.com
- fd.api.iris.microsoft.com
- www.bing.com
- windows.msn.com
- officeclient.microsoft.com
- licensing.mp.microsoft.com
- dns.msftncsi.com
- assets.msn.com
- ecs.office.com
- g.live.com
- self.events.data.microsoft.com
- watson.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/5579/files/1ab7ab9adad5733e70bf4cb2fca142fbe9627f91e7807f9f3abe55a6e6328548 -
1ab7ab9adad5733e70bf4cb2fca142fbe9627f91e7807f9f3abe55a6e6328548 - /opt/CAPEv2/storage/analyses/5579/files/13d22b1d1ed2476e851ffa19d998f3a43e657212b30fa061168d7c9240823eb1 -
13d22b1d1ed2476e851ffa19d998f3a43e657212b30fa061168d7c9240823eb1 - /opt/CAPEv2/storage/analyses/5579/files/96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 -
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 - /opt/CAPEv2/storage/analyses/5579/files/f7cf6d4cdf81b50dea8c8f26ab07736e68e9849f78b404796a2b7657f84dd44d -
f7cf6d4cdf81b50dea8c8f26ab07736e68e9849f78b404796a2b7657f84dd44d - a12bd9a8eb938aea38308d0d8b3d64ca789a5ab3fad0ec868628fa065d1c11fa -
a12bd9a8eb938aea38308d0d8b3d64ca789a5ab3fad0ec868628fa065d1c11fa - 6a2d9e5591aa749e4593e9835cb379350f582df913afe55528e96b1e864c3b0d -
6a2d9e5591aa749e4593e9835cb379350f582df913afe55528e96b1e864c3b0d - ca4ef4ba92a6d63f644dc1199f4f16538604b4f1ccbb31bee95872c160a89cdb -
ca4ef4ba92a6d63f644dc1199f4f16538604b4f1ccbb31bee95872c160a89cdb - c94d1cb61c0d4149936852950d109cb08b76f8f532bea538973fa6ef9d97f1de -
c94d1cb61c0d4149936852950d109cb08b76f8f532bea538973fa6ef9d97f1de - 90e0055fbaae8984a7370e89b4dbda0c1399ba8987100192d50f5c9ee22c493c -
90e0055fbaae8984a7370e89b4dbda0c1399ba8987100192d50f5c9ee22c493c
Embedded domains
- inference.location.live.net
- icudon.com
- aefd.nelreports.net
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report