General
- Target malware.exe
- Size 2.5MB
- Sample260711-2pgfpaaz6k
- SHA256 0aa8acdf1bc3210bd7292df6c3c7a71ca733a007d95dfff163a8888198949b53
- MD5 b29895bc1a4d938c5a1d39eeba03de49
- SHA1 9cfccd777490ed47378f77288dd6627413f0f3fd
- SHA512 4571ed6786b5c5ad8f583d76cdf868299130e2b064aecfc4731227f3c69cff12b5fe0f891bed3d8a4a6a5e60a47b73f0569ed9f4958b86ba393c34b85c6e3ee8
- SSDEEP 24576:2T9JSz2zXfPJf2CT6YNEzhz/zZhfo5b3D5f1zgai7k2JP+Ec0xMki8UsU3Ao0M98:2T9JSz2joCT6Yahz/dhfWVf1zJUM9xFM
- TLSH T143C5C74369DB0DE5DED66BB861D36339A734FD31CB291F3A9A04C23129532C5AD2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
malware.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
malware.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target malware.exe
- Size 2.5MB
- SHA256 0aa8acdf1bc3210bd7292df6c3c7a71ca733a007d95dfff163a8888198949b53
- MD5 b29895bc1a4d938c5a1d39eeba03de49
- SHA1 9cfccd777490ed47378f77288dd6627413f0f3fd
- SHA512 4571ed6786b5c5ad8f583d76cdf868299130e2b064aecfc4731227f3c69cff12b5fe0f891bed3d8a4a6a5e60a47b73f0569ed9f4958b86ba393c34b85c6e3ee8
- SSDEEP 24576:2T9JSz2zXfPJf2CT6YNEzhz/zZhfo5b3D5f1zgai7k2JP+Ec0xMki8UsU3Ao0M98:2T9JSz2joCT6Yahz/dhfWVf1zJUM9xFM
- TLSH T143C5C74369DB0DE5DED66BB861D36339A734FD31CB291F3A9A04C23129532C5AD2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Drops startup file
-
Executes dropped EXE
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1