Extracted

Extracted

• • Target
    PHOTO-616669398.png.lnk
  • Size 2KB
  • SHA256 5aa9b2b7922d88aef7df85c4aeb38392e989f45d30c2ef4222f3bab3314610fb
  • MD5 b158dc124c35aea7768b6d8fd1f6d816
  • SHA1 295258ff5db6e7c5cd0e74b71941511cb454df94
  • SHA512 21ada33ed74f455c7c03ea8224f757b3f97a0622ef5f5038f942008c1f403e3fe3fc2078f0ef036272a2db4015f9bcae66d0993609b9bd5a17387e72d5d12d0b
  • TLSH
    T1594122101BE2036CFBF74F35D8BD7213B925B412FA129F8E019002A855B0510E8A7F3E
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2