SUSPICIOUS — DOC-O8MS70.lnk

SUSPICIOUS — DOC-O8MS70.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 3 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 658e2a85b2e4b0c87661f0ce9b092a6c0bdd6eed09743214c5ca73e6b23b9226
SHA-1: 351085982eeb87efc5d8be1f73d34d114c2eac57
MD5: 62106e78a4a31022243d1b92e6ec0d54
ssdeep: 12:8rlfyf0m/VnEXzZURl2+UPfw2WWZLLVX4gC7oAlmubdpYrn1IlI7GXuHbLn1Il:8YfJtnyUD2+LRW15XPQOqddNXuHY
TLSH: T1E41447CF93488352CB2E883A0259A2EC648270D10595B71D2E0C973E69E641BDD55569
Submitted as: DOC-O8MS70.lnk
File type: lnk · Size: 1565 bytes
Verdict: suspicious (54/100)

Detections (3 of 53 engines)

Microsoft Defender: Trojan:Win32/WinLNK.PADL!MTB
Emsisoft (Emergency Kit): Trojan.GenericKD.81032298
Kaspersky (KVRT): HEUR:Trojan.Multi.GenBadur.genw

MITRE ATT&CK

Why this verdict

The suspicious score of 54/100 is the fusion of 6 weighted signals:

2 behavioral detection(s): LOLBin: mshta executing remote/scripted payload [high] (rule tl-lolbin-mshta) - dynamic signal, weight 0.60, confidence 0.90
Shortcut launches: embedded-url - static signal, weight 0.50, confidence 0.80
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

15528 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49
47ca234dcb198395f30e0fc4e2cca701110e66245a991545644cd43cdd115b31 - 47ca234dcb198395f30e0fc4e2cca701110e66245a991545644cd43cdd115b31

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787586792&P2=404&P3=2&P4=kkgoi%2fVmw%2bTtY%2fALVBPZbDqu3eMSwfEzHaYVLYqfphP%2bLi3Km8NPYDRMwZkDs892jI18xg13nbDl739Mk5oRxQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

bro-pdffiller.lat

Embedded IP addresses

20.42.65.84
172.215.188.225
4.230.171.124
4.144.132.223
74.178.240.61
20.184.175.12
74.179.77.164
52.123.128.14
172.178.240.162
52.123.129.14
74.179.77.204
20.42.65.90
20.76.201.171
52.148.114.188
52.123.252.226
20.184.175.15
203.26.79.13
52.168.117.174
20.50.80.215
74.179.71.159
52.110.12.24
52.110.12.8
72.145.35.100

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report