General
- Target 16fe0b3e90a3daf0af075c0b091fde1017eb822d5c3dc6ce6c5eaa3182d80f6e
- Size 32KB
- Sample260731-mjrbdagf46
- SHA256 16fe0b3e90a3daf0af075c0b091fde1017eb822d5c3dc6ce6c5eaa3182d80f6e
- MD5 9525bb5c71558e2276191ef494c7dae8
- SHA1 bd93b1bac21706c18005502de5566bad0e549931
- SHA512 f5247822da60dfe008f110b4b54329859bc2c603f331014cd959f1b25ad3ec33dd16044e864bf0ce81519caf53d9b68244d63d9c776f26994a69c56ec9f77de8
- SSDEEP 384:tesMTtxTHbKfRETHk3l7SkR8YbWc6o77JiK9MhkeQJXXNNftB3VEGnrIWbUY6sNw:teBT7LToJFKpYHNN7ZUmIXTndNN7oYh
- TLSH T1E6E2C61167FA01DCF27BCA30DAB25456EC7A7C226A25ED9F0250055A0F31E61FA39F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
16fe0b3e90a3daf0af075c0b091fde1017eb822d5c3dc6ce6c5eaa3182d80f6e.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
16fe0b3e90a3daf0af075c0b091fde1017eb822d5c3dc6ce6c5eaa3182d80f6e.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Targets
-
- Target 16fe0b3e90a3daf0af075c0b091fde1017eb822d5c3dc6ce6c5eaa3182d80f6e
- Size 32KB
- SHA256 16fe0b3e90a3daf0af075c0b091fde1017eb822d5c3dc6ce6c5eaa3182d80f6e
- MD5 9525bb5c71558e2276191ef494c7dae8
- SHA1 bd93b1bac21706c18005502de5566bad0e549931
- SHA512 f5247822da60dfe008f110b4b54329859bc2c603f331014cd959f1b25ad3ec33dd16044e864bf0ce81519caf53d9b68244d63d9c776f26994a69c56ec9f77de8
- SSDEEP 384:tesMTtxTHbKfRETHk3l7SkR8YbWc6o77JiK9MhkeQJXXNNftB3VEGnrIWbUY6sNw:teBT7LToJFKpYHNN7ZUmIXTndNN7oYh
- TLSH T1E6E2C61167FA01DCF27BCA30DAB25456EC7A7C226A25ED9F0250055A0F31E61FA39F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
UAC bypass
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Modifies WinLogon
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1