a89860f2fe908e7231bff59d581c122cd1cb646808562b7fd0f447916b8126e2 | Triage™

Login
Reports

Overview

overview

Static

static

1

c.xml

windows10-ltsc_2021-x64

Sharing

Copy URL Twitter E-mail

General

Target
c.xml
Size 786B
Sample260628-m7864agy5n
SHA256 a89860f2fe908e7231bff59d581c122cd1cb646808562b7fd0f447916b8126e2
MD5 de2bb206786d5c2285b4b25c6e5107b9
SHA1 7d4af20371679cc4d0c378a926b8915829ac35cd
SHA512 68de880f86500776cbab463c4e08e7f08045d54bce63f1117ca59e4b5c8d3eb91cf813da73e6a2c24d4f817e6c23ad11b95580717b1b7721971088e9ade9a4a3
TLSH
T1D001B965BDCC4F1282B112776AEE644DEF9999B306380C04B6DF61874FBF4381667113
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware bootkit google defense_evasion discovery persistence phishing spyware trojan

Static task

static1

Behavioral task

behavioral1

Sample

c.xml

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

19 signatures

900 seconds

adware bootkit google defense_evasion discovery persistence phishing spyware trojan

Malware Config

Targets

- Target
  c.xml
- Size 786B
- SHA256 a89860f2fe908e7231bff59d581c122cd1cb646808562b7fd0f447916b8126e2
- MD5 de2bb206786d5c2285b4b25c6e5107b9
- SHA1 7d4af20371679cc4d0c378a926b8915829ac35cd
- SHA512 68de880f86500776cbab463c4e08e7f08045d54bce63f1117ca59e4b5c8d3eb91cf813da73e6a2c24d4f817e6c23ad11b95580717b1b7721971088e9ade9a4a3
- TLSH
  T1D001B965BDCC4F1282B112776AEE644DEF9999B306380C04B6DF61874FBF4381667113
- MD5 SHA1 SHA512 TLSH
Score

10^/10

adware bootkit google defense_evasion discovery persistence phishing spyware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  defense_evasion trojan
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Detected potential entity reuse from brand GOOGLE.
  phishing google
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Pre-OS Boot

Bootkit

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarebootkitgoogledefense_evasiondiscoverypersistencephishingspywaretrojan

© 2018-2026

Terms | Privacy