Extracted

• • Target
    Data docking.PDF.lnk
  • Size 4KB
  • SHA256 e5b2b39e71f2538852d11754e06907b5d654d737656a85d255d6a93a94027033
  • MD5 e1d2b685a8e7aa454dc9d25ff28ad6fc
  • SHA1 1ea200e17d062f3d04970117204eec5af82c1a2e
  • SHA512 b695d8964b06525578ec32c81712d1ad09ff829b29be725ab67a9c40cc411b1035f0c1e13516bb3735b57d2022606dda9056392528aedf2b204abb8ff995458a
  • SSDEEP 96:8HSprP6vhQD+oGL7RuKBDcgC+IV3i8vQAEwZ4Ljp7CZff4OZSsSMhTUFqNR3bI:8HSprCvboORtDcgC+lKQApqLtCZfgOZk
  • TLSH
    T145915BADE666A461E64EFB348D174FF89177811DA6329D8CC450B479E430B04FB82229
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionadwaredefense_evasiondiscoveryinstallerpersistenceransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2