Process Monitor log of extraction of LNK, opening it (which rewrites it), and then the check for MotW later (it's not there)

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Thursday, 12-Sep-2024 01:47:45 JST Will Dormann

   in reply to

   The flow is pretty straightforward:
   First, the MotW is written when the from-the-internet ZIP is extracted, as any well-behaved (e.g. NOT 7-zip) archiving utility will do.

   Then, as Windows parses the LNK file, it rewrites it to fix the path. In the process of doing this, the MotW is removed.

   Finally, Windows checks to see if it needs to use SAC or SmartScreen. Because there is no MotW, the file is deemed "safe" and no SAC or SmartScreen comes into play. 🎉