General
- Target 2026-07-07_cc942471cbc251e9ea93471c5dbf10a7_elex_stop
- Size 4.4MB
- Sample260707-2j72fsft3w
- SHA256 8a8c33fcb719e55e3fe044ff1fa1e6283bdc40beccf05f190672888e8f0e4a10
- MD5 cc942471cbc251e9ea93471c5dbf10a7
- SHA1 34ec99d946b9dd6d2ee61739ff301a0a3fc7d806
- SHA512 7e7021f34724109cf342f706380e12274e41a40745d7560cd5ebf487cb1541c9687ea287226d50df585a81cba6e364694040664a815abe2fc90ec4a391c0dd63
- SSDEEP 24576:IJeofAq/jp98z3kiegV+eOeOe7OxmOocRLfzyFyT96:aeofAaWkLK+eOeOe7OxmHcR1
- TLSH T11D26F11332E1B0F1E86669F45F5B9379A7B57C301236AE0B63D47E1756324A0AB36323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-07_cc942471cbc251e9ea93471c5dbf10a7_elex_stop.exe
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_cc942471cbc251e9ea93471c5dbf10a7_elex_stop.exe
Resource
win11ltsc2024-20260706-en
20 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-07_cc942471cbc251e9ea93471c5dbf10a7_elex_stop
- Size 4.4MB
- SHA256 8a8c33fcb719e55e3fe044ff1fa1e6283bdc40beccf05f190672888e8f0e4a10
- MD5 cc942471cbc251e9ea93471c5dbf10a7
- SHA1 34ec99d946b9dd6d2ee61739ff301a0a3fc7d806
- SHA512 7e7021f34724109cf342f706380e12274e41a40745d7560cd5ebf487cb1541c9687ea287226d50df585a81cba6e364694040664a815abe2fc90ec4a391c0dd63
- SSDEEP 24576:IJeofAq/jp98z3kiegV+eOeOe7OxmOocRLfzyFyT96:aeofAaWkLK+eOeOe7OxmHcR1
- TLSH T11D26F11332E1B0F1E86669F45F5B9379A7B57C301236AE0B63D47E1756324A0AB36323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2