Extracted

Extracted

• • Target
    PHOTO-366969872.png.lnk
  • Size 2KB
  • SHA256 534aac519a9b9be2098bf2330f77e57db26b6dcde4d11035cc4091e0dda0883a
  • MD5 328bfad2c2df94450d58f518d7799e79
  • SHA1 7af781d499ccaf316c6b507332eaa1d17510b374
  • SHA512 4b072f8dd04165a8447038781efd8fc56c3b8df2ddb5e9c04f6b4eeb8e7edcf0e8df0f36b8cdbca05909231bcf7246b17d72020d9cb58c83c163a344bd4542ac
  • TLSH
    T12441DF2027E10369F7F78B35D8FD6213E5227907EB228F9F11C4429955B1611E86AF3E
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2