Extracted

• • Target
    GooglePhotos_YNM65.lnk
  • Size 2KB
  • SHA256 18c1a6e6e52231ba9c8a1621332f9d6208e509f0a7eff04f97447077e897cef6
  • MD5 9433d4c91d9f53525cb96b83522c4cd3
  • SHA1 d80920666d7445829f20b743596961c0b595a082
  • SHA512 f4ff676d731d204258c4eb6d689688359f44c05bcdf4587789caa09126dee873bf7b9fe7abfb222d73b64d0dd51db347056fabfa4a6a56b931c3cf829d90ff32
  • TLSH
    T1E951E0151BED172CF3F38A3BA8B6A3560536F998EC35CB9D0185068D4876940AE72F1B
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2