Extracted

• • Target

    https://drive.google.com/file/d/1G3_2_HJsgv-3XaB1c-1LiB7FCw7Y_e2G/view?usp=sharing" shash="AHgwadQR0oti/LSs1mgMNCbwWr4tIel2pzfy1I5MA5ekINAV05visyc/LzTPeM2L6HUwp3Hfak+cgiZW2PbRpwD6YLs/S/JMmUf/d+1+BcsBf4VxoSqYjQ3itlbZYgMgUPjwQ1Lfo+DbL00md6ce11JacrEw+jJ1/KbLgguscV4=

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1