General
-
Target
sample
-
Size
479KB
-
Sample
240412-xg6ndsga71
-
MD5
7623a5f4888348a1470e2c5bbe2e826a
-
SHA1
4f86a2e6585914e77eab7166d159a5e309a0a3e7
-
SHA256
8a1ca44c57db2910334734c555645f5e4cce911b0b6a51020eeadbe1f5432b4e
-
SHA512
7838893132be1b99c2878f689a4685495dfd793ccdc6d303163cb64edf9de28ec58d4c8cfdec2fae4428e58d50dcc4115a51e8e1e6539f880864e7cec283f8f6
-
SSDEEP
6144:7sTibDibtib+ibdibOibcibyibjiblibBkk:7Yi3iJiqipiaiAiGivi5iNkk
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win11-20240412-en
Malware Config
Targets
-
-
Target
sample
-
Size
479KB
-
MD5
7623a5f4888348a1470e2c5bbe2e826a
-
SHA1
4f86a2e6585914e77eab7166d159a5e309a0a3e7
-
SHA256
8a1ca44c57db2910334734c555645f5e4cce911b0b6a51020eeadbe1f5432b4e
-
SHA512
7838893132be1b99c2878f689a4685495dfd793ccdc6d303163cb64edf9de28ec58d4c8cfdec2fae4428e58d50dcc4115a51e8e1e6539f880864e7cec283f8f6
-
SSDEEP
6144:7sTibDibtib+ibdibOibcibyibjiblibBkk:7Yi3iJiqipiaiAiGivi5iNkk
Score10/10-
Modifies WinLogon for persistence
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1