Find similar analyses in TI Lookup

Analysis date (UTC): 4 March 2020, 15:04Analysis environment: Windows 7 Pro, build 7601, x86

03-01-1.lnk

MD5:0F794D6C6646A260558E9D638AE060C9

SHA1:2D6FD5FAF485B7FEAD2570FE1E610B34B371B60B

SHA256:A095924F6F0ED69914A36A8DBCD4F03D5040F61A3C107EDB73A4DD7E0C18AD4B

Analysis result

Threat level:Malicious activity

Tags:

trojancobaltstrike

Full analysis:Analysis 03-01-1.lnk (MD5: 0F794D6C6646A260558E9D638AE060C9) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

3.exe (PID: 2892)
3.exe (PID: 2936)
tencentsoso.exe (PID: 3032)

Uses Task Scheduler to run other applications

3.exe (PID: 2936)
3.exe (PID: 2892)

Loads dropped or rewritten executable

tencentsoso.exe (PID: 3032)
SearchProtocolHost.exe (PID: 3548)

Loads the Task Scheduler COM API

schtasks.exe (PID: 2896)
schtasks.exe (PID: 2720)

COBALTSTRIKE was detected

tencentsoso.exe (PID: 3032)

Connects to CnC server

tencentsoso.exe (PID: 3032)

SUSPICIOUS

Starts CMD.EXE for commands execution

cmd.exe (PID: 304)

Starts MSHTA.EXE for opening HTA or HTMLS files

cmd.exe (PID: 304)

Executable content was dropped or overwritten

mshta.exe (PID: 2556)
mshta.exe (PID: 940)
3.exe (PID: 2936)
3.exe (PID: 2892)

Executed via WMI

3.exe (PID: 2936)
3.exe (PID: 2892)
cmd.exe (PID: 2820)
cmd.exe (PID: 2880)

Starts Microsoft Office Application

cmd.exe (PID: 2820)
cmd.exe (PID: 2880)

Executed via Task Scheduler

tencentsoso.exe (PID: 3032)

Reads Internet Cache Settings

tencentsoso.exe (PID: 3032)

INFO

Reads internet explorer settings

mshta.exe (PID: 940)
mshta.exe (PID: 2556)

Reads Microsoft Office registry keys

WINWORD.EXE (PID: 2876)
WINWORD.EXE (PID: 3988)

Creates files in the user directory

WINWORD.EXE (PID: 2876)

Threats

No threats detected