Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://linkshield.s...

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://linkshield.synaq.com/link?id=1wweif-0005fj-Tm&ts=1787139843&cnf=98739490591343117&url=OehuGFtaVxyXHP5rnsUYGC3Fw._.axwW_mvF_wVONDg5Mm7_BDUwMjBu_w00Nzc0MjkxMzgyNDIxxf8JQjIzOTk5Mjkzbv8KMjcxNTM5MTIzOxgc_l_D_wJrXwTt_ws9NDY2MDE2NzcwOxgc_l_D_wJrXxzt_ws9MTMxMTAxMjkyOxgc_l.JA_8CPTsYHP5fDIEY_wI9O8g7_l9E_l.Z8Bj.X4EhHEUY_l_DeAP8A_8CPTsDLCYE_wI9Pzk88IndNgYWxGv9xVrFWv5IFiZaLf8FVmtRR1o8HAn_Ak4wGP8DR1ZqBP8CSEIW_kwt_k5t_kwJPBI-
  • Sample260819-n1rh5sam61
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      https://linkshield.synaq.com/link?id=1wweif-0005fj-Tm&ts=1787139843&cnf=98739490591343117&url=OehuGFtaVxyXHP5rnsUYGC3Fw._.axwW_mvF_wVONDg5Mm7_BDUwMjBu_w00Nzc0MjkxMzgyNDIxxf8JQjIzOTk5Mjkzbv8KMjcxNTM5MTIzOxgc_l_D_wJrXwTt_ws9NDY2MDE2NzcwOxgc_l_D_wJrXxzt_ws9MTMxMTAxMjkyOxgc_l.JA_8CPTsYHP5fDIEY_wI9O8g7_l9E_l.Z8Bj.X4EhHEUY_l_DeAP8A_8CPTsDLCYE_wI9Pzk88IndNgYWxGv9xVrFWv5IFiZaLf8FVmtRR1o8HAn_Ak4wGP8DR1ZqBP8CSEIW_kwt_k5t_kwJPBI-
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

4
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

Remote System Discovery

1
T1018

System Information Discovery

5
T1082

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

2
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks