Extracted

• • Target
    report_13478.lnk
  • Size 1010B
  • SHA256 c348eeb804630963d653931b2031455d8c29e3ba24d9246e7d3327e8d9a93d5f
  • MD5 0296d34d99ec98f16e1833ce08b9ce67
  • SHA1 4a0fdc0bc303fb42f5d34f1ba29ec43482fd5539
  • SHA512 793f3840e63c9d9c16faafa67c0a1b03bd5b9acd156b1d28bfe510510a7c1b78e18206c3a0668b4bc0a43b95103dfa09c28a0ed3c76bccc2d433132ee429f2ec
  • TLSH
    T1B711E12A5D74EAC0C3B8B9B4441E271A65B23C138B35867CD70128B6AC24359FF2B66D
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2