84eaaff1cf526a3ad26b37fff5eb82eeaf43acafcf53747294df4082e7c77a9e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
산안패스_법령패스_통합배포팩_v2.0.6/개정알리미/산안패스_개정알리미_v0.8.15/law_change_watcher.ps1
Size 262KB
Sample260831-tle5fscp4w
SHA256 84eaaff1cf526a3ad26b37fff5eb82eeaf43acafcf53747294df4082e7c77a9e
MD5 8ffaecfe08bae94530aa1ae5380ffb38
SHA1 5d0271937bbfca574ca164ccace8a580499ffb0e
SHA512 3d0f9fa6775b5de968b3efcf5130707f434bebf9398df9beb6b855adcc8f036f5ce4408110b9df003d69449d6e713ce22440a2dc9bf45bee50996f914dbfd048
SSDEEP 6144:p9Wn2DWIVYL0a4y3YgFolEJJ64gIZSxCdmyh09PfvcVRc8GcepspO:p9DVY4y3YCoA64Myh0Ic1cYsU
TLSH
T10644E8117C0A92862DF326B7ACC29414FF2A0167592A0450FADD84CC7FB2919D6FDFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3940	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3940	powershell.exe
3940	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\산안패스_법령패스_통합배포팩_v2.0.6\개정알리미\산안패스_개정알리미_v0.8.15\law_change_watcher.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.last_watch_attempt.json.2105c9992e664a34a294f05a07281b68.tmp

Path C:\LawPack_Safety_Watcher\.last_watch_attempt.json.2105c9992e664a34a294f05a07281b68.tmp
Size 408B
SHA256 3ba75e62dc9c54662e288de8db8b0c7809df8548978138de6b2d262ee4c4a977
MD5 5144e5cd02fafc812e7463f905011ae0
SHA1 d90af4a7097bf7455f835ce22c22bd2e9b4504f2
SHA512 993dbeb369e74e103b279cd2aec021357a3a822860df1cbcd32c7d7f6011f8df90ea3be30a154794917e60b3fb892e87e4f830a279976d0455c937b84b65a4a1
TLSH
T1CCE02293DDEA4CB2093B0C8C11B04E82F299A30F2226741BB7B9060C1F3E51881D9AD4
MD5 SHA1 SHA512 TLSH

Submit Download

last_watch_attempt.json

Path C:\LawPack_Safety_Watcher\last_watch_attempt.json
Size 330B
SHA256 85b789fe27554f51228c40a42f03d5d742f494eec6e12acd41eb848788d74d7c
MD5 341e0aaa58f02dfbaa932ff256ebd22e
SHA1 bea5337f108d811ef5e9dd54db61969ef79164d0
SHA512 9b61c21e76464fab87e0cd3bed792c18d53901ad64729df7b43b10033957581d66cbccf26fece7c9291f1f3d088b7e0896eac7166c30fe0cad06bf07b201e40d
TLSH
T19DE0C293DEEE4CA7083A0C8D61B08793F294634F1225B80FBBB9064C1F3F41A81C4AC0
MD5 SHA1 SHA512 TLSH

Submit Download

watcher_ui_settings.json

Path C:\Users\Admin\AppData\Local\SananPassLawPass\State\watcher\watcher_ui_settings.json
Size 483B
SHA256 574d9727f268ae059f56121a4071f62e5a55192010fcee798edb9474af3c14a4
MD5 9e95cfb3c5c5b057e2f6fbbc0f81138d
SHA1 0fea6b6b32972b4a20f5a39cb7313508cdc35900
SHA512 e38ab4f9947b2e10406e9e97d356a42074f2a16fccc8c3712d166964022258ba55fb7ca44da8eee1fd0ca3cc8d54ff284d7ff37f8102e9af6d711105e4460781
TLSH
T1AEF08217DC068D6926B4A2CCC4290A47E602D73B0964756B77F6425C4F7AF22229B921
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uy2cadzh.z0c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uy2cadzh.z0c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3940-1-0x0000026796B10000-0x0000026796B20000-memory.dmp

Download

memory/3940-0-0x0000026796B10000-0x0000026796B20000-memory.dmp

Download

memory/3940-2-0x0000026796AE0000-0x0000026796B02000-memory.dmp

Download

memory/3940-10-0x0000026796B10000-0x0000026796B20000-memory.dmp

Download

memory/3940-11-0x00000267AFF50000-0x00000267B0112000-memory.dmp

Download

memory/3940-12-0x00000267B0650000-0x00000267B0B78000-memory.dmp

Download

memory/3940-13-0x0000026796B10000-0x0000026796B20000-memory.dmp

Download