“we can see it uses mshta. exe to start a shell from vbscript, which in turn runs a powershell command. the powershell command reads from an offset within the lnk file and base64 decodes it. the final part of the command, ( $ env : comspec [ 4, 26, 25 ] - join ’ ’ ), is a way to h…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1059.001PowerShell
95%
“sr. readtoend ( ) ) ) ; $ wr. close ( ) ;. ( $ env : comspec [ 4, 26, 25 ] - join ' ' ) ( $ re - join ' ' ) stage 2 the response to the post request from stage 1 is another powershell command : invoke - expression ( ( ' 36j76h111 { 103o69t110h103t105k110r101, 76t105k102, 101k67, …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1059.001PowerShell
94%
“deep dive : a lnk in the chain the huntress soc team sees all sorts of clever tricks attackers use to launch powershell. many of these tricks use powershell to read a payload from the registry and then execute that payload. so when we saw a lnk file starting powershell and then p…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1218.005Mshta
37%
“deep dive : a lnk in the chain the huntress soc team sees all sorts of clever tricks attackers use to launch powershell. many of these tricks use powershell to read a payload from the registry and then execute that payload. so when we saw a lnk file starting powershell and then p…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1497.001System Checks
32%
“##wall | defender | secury | anti | comodo | kasper | protect | point of sale | pos ) * * “ secury ” is not a typo : ) - enumerating the antivirus software - encrypting / decrypting data using rc4 - obtaining the external ip address - testing for administrator privileges - checki…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
Summary
Read this blog to learn more about what the Huntress team discovered with LNK.