Checks computer location settings

Looks up country code configured in the registry, likely geofence.

Event Triggered Execution: Component Object Model Hijacking

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

Modifies system executable filetype association

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Adversaries may delete files left behind by the actions of their intrusion activity.

Enumerates processes with tasklist