ScreenShot
| Created | 2024.07.31 10:24 | Machine | s1_win7_x6403 |
| Filename | Invoice-2024-07-29.url | ||
| Type | MS Windows 95 Internet shortcut text (URL= |
||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | |||
| md5 | 123301099bd2b21b2b13bddb06c940dc | ||
| sha256 | 5b865b20d91b69e02fdb38b10fb14f3fa66a75314938f306b0b408c28d594a2b | ||
| ssdeep | 3:HRAbABGQYmtXATFghKEKEgBsAXe1YSo/QJ7ovstyYesbBSn:HRYFVml2FghzfuhlSoIJ7yIyYesbBSn | ||
| imphash | |||
| impfuzzy | |||
Network IP location
Signature (8cnts)
| Level | Description |
|---|---|
| watch | Communicates with host for which no DNS query was performed |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | An application raised an exception which may be indicative of an exploit crash |
| notice | Performs some HTTP requests |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | One or more processes crashed |
Rules (9cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | url_file_format | Microsoft Windows Internet Shortcut File Format | binaries (upload) |
Network (4cnts) ?
Suricata ids
ET INFO Executable Download from dotted-quad Host
ET HUNTING WebDAV Retrieving .exe
ET HUNTING Successful PROPFIND Response for Application Media Type
ET WEB_CLIENT DLL or EXE File From Possible WebDAV Share Possible DLL Preloading Exploit Attempt
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure
ET HUNTING WebDAV Retrieving .exe
ET HUNTING Successful PROPFIND Response for Application Media Type
ET WEB_CLIENT DLL or EXE File From Possible WebDAV Share Possible DLL Preloading Exploit Attempt
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure