MALICIOUS — f11b94080adb75431e0848ce77cce44dcce3b2cf45e5f2300363e4fa864bd802

MALICIOUS — f11b94080adb75431e0848ce77cce44dcce3b2cf45e5f2300363e4fa864bd802 is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Mehetme family. 1 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f11b94080adb75431e0848ce77cce44dcce3b2cf45e5f2300363e4fa864bd802
SHA-1: 40bff80a7a6193d810c435d3e0bc514f430ff7af
MD5: be62375826648fb94842ec3b524d0924
ssdeep: 192:8gzg0zm0zm0zm0zm0zm0zm0zm0zm0zm0zm0zm0zm0zm0zm0zm0zm0z:x1DDDDDDDDDDDDDDDD
TLSH: T1F126BFCE90694B42C22E4F343F1879ED94A270F4916A19191F7E523E51C5C636C3AB3D
Submitted as: f11b94080adb75431e0848ce77cce44dcce3b2cf45e5f2300363e4fa864bd802
File type: lnk · Size: 14256 bytes
Verdict: malicious (84/100) · Family: Mehetme

Detections (1 of 53 engines)

Microsoft Defender: Trojan:Win32/Mehetme.C!lnk

MITRE ATT&CK

Why this verdict

The malicious score of 84/100 is the fusion of 5 weighted signals:

Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 31 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13039 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787828438&P2=404&P3=2&P4=G%2fc%2bnE082a6D%2fa6Ra3iHjivwJW8kEi0onkoJvAA%2b%2bNpbuXiWxOP0SCwmU6KHltmnQhSwGXYU1heG9KP1AOODcQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787828498&P2=404&P3=2&P4=Ixwrf12MfFgq%2fhTVz7w%2bueT5ZrmiDrVI9JojENfhAu8rITkDw88GwvkRob4p7san%2f8UujFKvxMJ5THk6oODRzA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787225187&P2=404&P3=2&P4=ZUVc51DbZW6i6CjiszlYtNRnhph6aeLgJ3jeEZ7UsKlQklpRQGtxWv0GDtkEfanHVw8%2freKlkI4oVb4UNmwmKw%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787224808&P2=404&P3=2&P4=LXJSmtA0BaHM4eHcSUo%2fijeU7Xe9eoe31z27OexmjtqotwHU5N3jmea2KPZ9uDfEu7R1YOnSfwd5OGKqtUAc9w%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.9
52.123.252.212
48.211.4.16
20.247.185.124
52.123.252.193
4.230.171.124
74.179.71.159
74.179.77.204
135.233.95.135
20.42.72.131
20.112.250.133
52.123.129.14
52.123.128.14
52.123.252.202
203.26.79.13
4.150.223.113
135.233.45.221
162.159.142.9
135.234.160.245
52.148.114.188
52.110.12.37
52.110.12.33
40.84.97.4
72.145.35.106
135.233.45.223

File paths

C:\Users\george\Desktop\AcroRdrDCUpd1901020064_MUI.msp.exe

More Mehetme samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report