Extracted

Extracted

• • Target
    PHOTO-328122595.png.lnk
  • Size 2KB
  • SHA256 701f6605c7cdfc3fbba457c1437fd32c5ef3143179396d7808449a0589e63f62
  • MD5 e4004b73f49959bad4d4d2509196b1a6
  • SHA1 94a6d2e747bd86b938789c18bb0fc19e775f9ebc
  • SHA512 a68104dcf4b2482467b09dc691e3d1294cf08ded8de9c39668c0f54bdf47477557f758a7c45726f87edbaf59a90ac8a8f849e216051b93b74505c1448dd1d443
  • TLSH
    T11A41EB2417E10229F6F78F36C8B9A213B915B80AEF128F9E02C4035891B1111E9B6F2E
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionpersistencediscoveryinstaller

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2