e5436505bdbf18d2b1ee707e48348d2390f02e2779fdd7fb9762f9428c9e5cc7

Analysis

max time kernel
151s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sanghyun.exe
Size 83KB
Sample261014-apa55awsft
SHA256 e5436505bdbf18d2b1ee707e48348d2390f02e2779fdd7fb9762f9428c9e5cc7
MD5 84f9262d0e27c7362c9c4c116bd0e85b
SHA1 3f0530745c668bbd61bf5e9e23b491ede66107c6
SHA512 0123a1654abcc65829f51b41813827c6d9e1f34cea86e039ee68e80f2d9fa542acef75f8b4e81e70145c50b46adab795475fa3bc594d25717a1ef2bd63b21714
SSDEEP 1536:fOXQrSji6XN9+GVqQ7zgN9ebqvjoJExemwHX9wc21wjHD:fOXQA+QqQfgNY0emckijj
TLSH
T13A83396B23A414C9D7E786F9C2A15607D3B070611F24A3CF17A4878A2F2B6E19F3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware execution spyware

Malware Config

Extracted

Credentials

Protocol
ftp
Host
sanghyun.nfile.net
Port
21
Username
id

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5860	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1528	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1528	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1528	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5624 wrote to memory of 5860	5624	sanghyun.exe	90
PID 5860 wrote to memory of 4516	5860	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\sanghyun.exe
"C:\Users\Admin\AppData\Local\Temp\sanghyun.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5D39.tmp\sanghyun.bat" "C:\Users\Admin\AppData\Local\Temp\sanghyun.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\explorer.exe
    explorer ftp://[email protected]
    3⤵
    PID:4516

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sanghyun.bat

Path C:\Users\Admin\AppData\Local\Temp\5D39.tmp\sanghyun.bat
Size 60B
SHA256 0f8709c117073e819d3ff08bfa8976ead67821cecb5c91e3f7311cb19d2528fa
MD5 d9c01da38eba966f5063e6a19967cfe7
SHA1 6a46d19f73c9dd0f9e4c0c9dcb058ec644dfe996
SHA512 fc2386edbd7d7c3972be2d5e7e164d9142d9e6ebee41e0ce1d1af419434be5337d9f5b027e5d11da198e563a38eb11f4155753dc5c14ce800b323b0308532709
TLSH
T1B7A00255510E64469B03D40231C9507071E642F389C78685B6521A2A54848D4A5DAA4B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1528-3-0x000000000D470000-0x000000000D4DF000-memory.dmp

Download