1429668b745504e7f83da6914086405cf23b13367b07649409cce92e97b9a192

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
산안패스_법령패스_통합배포팩_v2.0.6/공용프로필관리자/법령패스_공용프로�.ps1
Size 99KB
Sample260831-tle5fscp4w
SHA256 1429668b745504e7f83da6914086405cf23b13367b07649409cce92e97b9a192
MD5 f7062a05f5a2d6e3f2b9f90dd5fe6df0
SHA1 329068902bb2039a4d8d48e54e1156d3fd4ccda5
SHA512 dc17b80566ecb60f6c66a5723b6af615639ccac278198264563c5d6b412b5c4734b3639a287d61951a6be39ab16cf69d061e31d3caccb9aab793907383968552
SSDEEP 1536:PwxY7uKuiZkhKDy9NlQZHCtCeu7VBBcRG+GXWmrMh:Pf/uhKDclQZHCtCeu7dcRG+GXWmrMh
TLSH
T1DEA3D46A690C42214AB7627BFDE2D881DE25503B93290014FDDD91D86FF2A81C2B7E97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2260	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2260	powershell.exe
2260	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\산안패스_법령패스_통합배포팩_v2.0.6\공용프로필관리자\법령패스_공용프로�.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_fiizs15m.puq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fiizs15m.puq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2260-1-0x000001BED67F0000-0x000001BED6800000-memory.dmp

Download

memory/2260-0-0x000001BED67F0000-0x000001BED6800000-memory.dmp

Download

memory/2260-9-0x000001BEF0DA0000-0x000001BEF0DC2000-memory.dmp

Download

memory/2260-11-0x000001BED67F0000-0x000001BED6800000-memory.dmp

Download

memory/2260-10-0x000001BED67F0000-0x000001BED6800000-memory.dmp

Download