Extracted

• • Target
    File_c482c886-de89-4a5c-a1be-76de658e19ae.lnk
  • Size 3KB
  • SHA256 c865b6aeb8fc17f884907f9f082d55f4d55dc40bcf7bbf1dd437209231896c8e
  • MD5 4bc5cc52736d01730ca51d854be89b66
  • SHA1 13b052a66e285b71155e2ec6d865269aa12c4d92
  • SHA512 f91649076b060caccd07600b9432c13ecbf40524445870411463fb9fa4722a6ba29eacd8367633a85843625a84e0ff3e770ac12d97020bd1308058b750ce2e05
  • TLSH
    T14D619A245BE5032DF2B3AA32ADFB6655A977B856F920CF1E0085024D0432B51F995F2F
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionadwarepersistenceransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2