Extracted

• • Target

    Order/Order.lnk

  • Size

    2KB

  • MD5

    f88d5c71b79d93f336a5fbc20deeb9dd

  • SHA1

    1f77d2879725462577a73adbf83d07c60eb6a384

  • SHA256

    a4e51b364548e87948d0075a8adffcd901d2876950ce6f0a939413a0d450b752

  • SHA512

    e369ed33574528497c330c79630e49971b4398bc089f239648c270774a62086436a36503db5052d9df72a56a0a8113ac0c9c09e7d86b41ad999c15e1cfc404d2

  Score

  10^/10

  persistence

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2