MALICIOUS — PIC0402023.jpg.lnk

MALICIOUS — PIC0402023.jpg.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the WinLNK family. 3 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b8dd2c924604e8d4cac9a235cee2bf49a375727438f705a0028d0c89b7f9f1b7
SHA-1: 1c14b51f2509deca4cb567b235ba174d05e51cea
MD5: 448be7157573263a2d414663a983394b
ssdeep: 24:87JK7r8kaw6awAgqASy9q7erUMkWI9wCc5QgkgVBS9ZmT:8sM/qzy6erHypgkgVw9ZY
TLSH: T1E5143DCD62AC1713C73B8D521A6EA0FE9095F05640B176086D8EC53B28D3293ECE0685
Submitted as: PIC0402023.jpg.lnk
File type: lnk · Size: 2003 bytes
Verdict: malicious (96/100) · Family: WinLNK

Detections (3 of 53 engines)

Microsoft Defender: Trojan:Win32/WinLNK!MSR
Trellix Stinger (McAfee): PS/Downloader!448BE7157573
Kaspersky (KVRT): HEUR:Trojan.Multi.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

Dropped a malicious payload (DangerousObject): windrv.exe - dynamic signal, weight 0.62, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Shortcut launches: powershell, embedded-url - static signal, weight 0.50, confidence 0.80
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 31 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

27311 behavior events · 2 ATT&CK techniques · 15 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_gr12krgq.d2k.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - d36819a68d7ab408a3698b4bf44bceb845f041f9cd05bc08685e3d895366f22d
C:\Users\analyst\windrv.exe - 875bbdff1d3a5f2413334cae7041d32158d4557bf6744e09fbdb925068f23e9e
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache - 11a3b26b9ef2a72300256e038126f0372c3aba6267535c18f8a784a49aa8fca4
9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54 - 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54
57f569486de516d557f16a6ce6c927650241aa8a5d79df143c4e7afcd0e2adde - 57f569486de516d557f16a6ce6c927650241aa8a5d79df143c4e7afcd0e2adde
8bdd5e803286b7fc7215b39e962610a468707fcc2e1cbf5d606d6f9ccbeeaafa - 8bdd5e803286b7fc7215b39e962610a468707fcc2e1cbf5d606d6f9ccbeeaafa
1a277150702c8df0aac2d3e45c68c65bcfdd674f83f4c47249cd21ee2334d44a - 1a277150702c8df0aac2d3e45c68c65bcfdd674f83f4c47249cd21ee2334d44a
b5023b81692f7f1b8b7c54b9239c7534b9269e936597c2230e01e108ff03d3af - b5023b81692f7f1b8b7c54b9239c7534b9269e936597c2230e01e108ff03d3af
68f353c2dab0cf699746a8778ac9e2cca8fb31af63073f78447c2446bbb9e0e2 - 68f353c2dab0cf699746a8778ac9e2cca8fb31af63073f78447c2446bbb9e0e2
71403548d84caa2b98684950ffbecd9f021ffe4c2fef3d40dbe216e06dafac98 - 71403548d84caa2b98684950ffbecd9f021ffe4c2fef3d40dbe216e06dafac98
2823a6256f580ba7ce5bbcd07e5da43c88237ddca341f4c5ad70101f5a85d1f6 - 2823a6256f580ba7ce5bbcd07e5da43c88237ddca341f4c5ad70101f5a85d1f6
dc97fd73f7b416810d9bb0c8d044033d6bc164f68a12a812b5842c337e9d294d - dc97fd73f7b416810d9bb0c8d044033d6bc164f68a12a812b5842c337e9d294d
c3147da452e680aeae16cdc52e38cdaaa36c2d52262f6950d41b4f5233e6541a - c3147da452e680aeae16cdc52e38cdaaa36c2d52262f6950d41b4f5233e6541a
ca4bd4fb05e1ca5a7b3785e31a7d84c85db13fe4c9199c95622fb3ecc54bf812 - ca4bd4fb05e1ca5a7b3785e31a7d84c85db13fe4c9199c95622fb3ecc54bf812

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787742584&P2=404&P3=2&P4=j5y5RgEk9IKpG3CSjqu%2ft8HiOIqh8Th2q55cPfn1k45Nk2iLyoSSb0gwTv6zMBB%2fNyhjLWQcBXb%2fDv0An6tpMQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://178.16.54.109/getit.exe
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787742613&P2=404&P3=2&P4=jzgonBqKMF2rh%2b7fxVWEgbpEo%2bGhQDAWWde2Htds%2fAD%2f1j7KFO3gsfpC34dX4pIKB%2buRLoR7NQXsCS5XKAoM3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

92.223.78.30
4.150.223.112
135.233.95.80
20.247.184.197
40.84.85.40
74.179.77.204
4.230.171.124
20.42.65.84
48.211.4.16
85.210.193.152
74.178.76.54
4.247.188.233
20.184.175.13
20.231.239.246
52.123.128.14
40.99.133.226
52.123.252.248
135.233.95.144
52.123.252.222
172.178.240.161
20.165.94.46
203.26.79.13
135.233.45.222
48.192.143.121
52.148.114.188

File paths

C:\Windows\System32\cmd.exe

More WinLNK samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report