MALICIOUS — a5a167b4f070315f4db61058cc70c2f6f55fa39926f1a2b2af310f3558bd2462

MALICIOUS — a5a167b4f070315f4db61058cc70c2f6f55fa39926f1a2b2af310f3558bd2462 is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100), attributed to the WinLNK family. 1 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: a5a167b4f070315f4db61058cc70c2f6f55fa39926f1a2b2af310f3558bd2462
SHA-1: f53c2b99771e4abe703a52f41416527215a9f87b
MD5: 0cbae76aee1ac28cf8fbc19cf26ec01c
ssdeep: 12:8u0lCU453IHoCkkY//8XESLkRRL4SEm53LFwojAmHJ4jFw7nytmy:8DKqoxKsnES3qsAM4iSmy
TLSH: T17011FD8915A52080C22D8C11D55A55EC888323E31D763A0AB64D4179B8E1583D83B72C
Submitted as: a5a167b4f070315f4db61058cc70c2f6f55fa39926f1a2b2af310f3558bd2462
File type: lnk · Size: 885 bytes
Verdict: malicious (86/100) · Family: WinLNK

Detections (1 of 54 engines)

Microsoft Defender: Trojan:Win32/WinLNK.GAL!MTB

MITRE ATT&CK

Why this verdict

The malicious score of 86/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:Win32/WinLNK.GAL!MTB (rule Trojan:Win32/WinLNK.GAL!MTB) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

18488 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
default.exp-tas.com

Embedded IP addresses

40.79.167.9
40.84.85.40
4.144.132.223
4.230.171.124
48.211.4.16
135.232.92.97
20.184.175.0
74.179.77.204
104.18.33.89
4.209.250.170
4.150.223.100
135.234.160.244
52.110.12.42
52.110.12.54
203.26.79.13
20.184.175.4
52.168.117.169
20.184.175.1
52.148.114.188
172.215.188.225
4.247.188.224
72.145.35.103
52.168.117.175
172.172.255.217
52.110.12.18

File paths

C:\Users\george\AppData\Roaming\klist\drvinst.exe.bat

More WinLNK samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report