Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/08/2026, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
윤종신 오르막길 (Feat. 정인) (자동재생) mp3듣기-2.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
윤종신 오르막길 (Feat. 정인) (자동재생) mp3듣기-2.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
(Feat. ) (ڵ) mp3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target (Feat. ) (ڵ) mp3.exe
- Size 164KB
- Sample260828-e4a6wstbjb
- SHA256 d0d1e52df526ca023599c0a613a761a5c5178612fef04d2bd07599ba46d4a07c
- MD5 02387570c61a6fa52ad3842734b275e3
- SHA1 ab16cb23bd99680b99f2ffada7479553906231ae
- SHA512 6f33bc1fc0dab3ae4dbeb6876f97b7144d52bdbb7386849c9c3ad6e86536a9816d6227ee65f9de6af6e63d7e50b7f622c6a916a1ce057312645323cba35e6d95
- SSDEEP 1536:/CZkyevLGyJvD8hYqvqLHBy/HbT3VOaCizEx5P6KnD3Ytq+2Eo/fl7L2IxvCyW+J:6ZkZvlvDi4YnkXsEPP5zWH42GKYlQu3
- TLSH T178F38E2235E1C8F3D25701300DE5AB7AE3B9E9744F724B836398DF1D6D394848A3B266
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation (Feat. ) (ڵ) mp3.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language (Feat. ) (ڵ) mp3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31274661" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d45a58ae36dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "494656384" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3775495492" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000044539d02f39e934cb2e58e469adc5849000000000200000000001066000000010000200000004ee1dfa7a4e274851f34002ea2d67fde01e73ea0d60493760e02ef909c6784a6000000000e80000000020000200000009775a82b7b437c1f7ad4c383bdee79c6cde3135ff29f09041ecc6d02875251f12000000066771b4f4d3c218b3423f600f4c74938109759983d469a624575e8bc667a2b7840000000e0a95d68086b21d9c2b5eb47172e214a61d444bfbc1709835fdbb1a0d56bf37829055dd7f443f36e3cbb37106b49dc145ebc221327562c4cb80ce60c0f8f9556 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31274661" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000044539d02f39e934cb2e58e469adc5849000000000200000000001066000000010000200000004025f857bb039e3601c1f6fa7dcaa6db5c6436f2ee34ba1048d3beed2d888d71000000000e8000000002000020000000dd929e842388b71ffe188a8a94f6b7c194da144e0af99d05a84d86efb50f859a2000000080636ac70ac9239ae22a05c73903649462387446616a6a5db019992decec6f0a40000000cd54a3be26f3f03e6d99db48a14e34f2bdc6985be4e449b0cb8dfb678884ef45eebbf94b4118c9d7bd31ec75941ccd7699d97a1adb33ed8d3357922fba33cdd7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0C7043E0-A299-11F1-92B0-D2489D1A2768} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3773464813" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0195658ae36dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 iexplore.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 728 (Feat. ) (ڵ) mp3.exe 2676 iexplore.exe 2676 iexplore.exe 3824 IEXPLORE.EXE 3824 IEXPLORE.EXE 3824 IEXPLORE.EXE 3824 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 728 wrote to memory of 2676 728 (Feat. ) (ڵ) mp3.exe 86 PID 2676 wrote to memory of 3824 2676 iexplore.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\ (Feat. ) (ڵ) mp3.exe"C:\Users\Admin\AppData\Local\Temp\ (Feat. ) (ڵ) mp3.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://me2.do/5CqJPGN2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3824
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 2e09c313379a35b892e4a0c3fa127fd9d62eec08dc237c0ba7728a747449dc48
- MD5 01ca47db13a7eaf0010fc1c1edb66bc1
- SHA1 a3459d2bdfea244cc8c277d48aa0107ba8b369bd
- SHA512 b48452b516412bceb992136d45180192c50fbf6f1424849b333ba858a48229bd85c149a74f5acbe1efad0e01a967b37bbfe2523477865e816a01deae17f25bea
- TLSH T1BFF0DC858839E6A689834EEC02A71EBB3C2073DF34AA4111A43D0EF405B67B5EF090B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 bb2239e6f8eb746cce432ce9c52766b1c2c50483d3c90646e2d202ac3321e74d
- MD5 a3916fc4e5592cb6222ae092e3b90ee6
- SHA1 b603ad1291158d5be2b23366e4ae66f6ceecc7a9
- SHA512 c964920819af7c57bda984959314b289d01809dcd45fd398fa95e72aa6f0f97db7e9fb5e121771b621adf731e7993429250402789afa5162726f66704ced928b
- TLSH T1D9E0C03422F6011FE4F4D4354FC87431415DF136103996B42DD55F04A3576009C03A6D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\8lqtqxr\imagestore.dat
- Size 1KB
- SHA256 0305a69a6ed9b6a1ce841f46ff428244416c3e01d053de53398e0adf994b1d89
- MD5 e0aafd131197c50e608571fda5654385
- SHA1 d36b81075421c2d0c01a9547474c4cde42a046b5
- SHA512 a62b2a4d82194425c2a5bba55b4fcf26bf33baa3655234edadaa7ee779b8854d46d90980bc154ca92f792da524856fc1151ff2a755165ac44bf18fc7b43cc4ac
- TLSH T1B721D41BE726174EE5E9FF3D894AA70405A76C01E652D239443E3C2634F77188464738
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7EOZKXVE\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BF3JFO81\favicon[1].ico
- Size 1KB
- SHA256 39bff4fa84b276fe9a6ad756943a4df5783fdb3a8956ee71dcd375f44d3e1d81
- MD5 b974b2f20eef844a7ff5219c46c1fb9a
- SHA1 7a612050430a1e106a70bbed0c1a5784cb43e3eb
- SHA512 d00488b61bc7e0ca61288d160111fa3d99111405cac65e55f34718ea0efd5331542fb2a9c58080d758ca02e9f939eb664228a9cecd3e8329d454fcd53abcbca4
- TLSH T1B121090BE326634FD4D9FF3D8A8AAB5842A72C01E262D679042E7D7238F33094009338
- MD5 SHA1 SHA512 TLSH