Extracted

• • Target
    doc324917.pdf.lnk
  • Size 924B
  • SHA256 08510eab2540a98dd283a9ce407a6c2f25820877c9018994e0f8641d20a0c694
  • MD5 137a012ccda895642bd0ec64dfc1b49c
  • SHA1 661ce82ddbdf9ebc6f21fd229e7c4a4aa99c565d
  • SHA512 0b27e8688fb2108145f6a925c6e16259c589220cf324cd8c18d68dfbc680eb658ff282c61c233d2d6cb280d38805bf139ccae416607aac88151b0223f4925e6f
  • TLSH
    T1731141981AD84462E3B6CE7384BD731215227B425C12C78C0A84466D0C0A301FE33F29
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionadwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2