Extracted

Extracted

• • Target
    PHOTO-347377076.png.lnk
  • Size 2KB
  • SHA256 b422e102ed941533b2ba7a6481aa19a9d4e6cdcc033f0740833bb65bf5944f80
  • MD5 c4661a41eb3e19bc804a582f017288b8
  • SHA1 17abeb78bb862d702d4e63d746c58d2d805d71ee
  • SHA512 eed8fd735ed93f44ee381b0a847556332d71c1897648899edc383bbaca3554d3491d8d63c559800762bb3a8370049f7634ac5d65b38728e25d542ce38e352eba
  • TLSH
    T1B841FE101BF10239F7F79B34E8FD6222E6257513EA229F6F01C042994671811F5A7F2E
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2