General
- Target 666.exe
- Size 4.0MB
- Sample260816-va2dzsscnc
- SHA256 4958c554787a589449e918fc5e3acc61b0ca61fdbf7ce0b658d4f60e2052f48e
- MD5 fb06afbe05e9006fb0974b34db9b3e47
- SHA1 798adfdf387a81d4e4784508b1c7a45c2574e5fb
- SHA512 5a7d0ae0e43cce249f4a8bd1239697a36b6f903336b23dd0b9c7aec415e0209dd24385e4f90d14a911208214415625f4a90ac490c1439f48be34cabde1c89080
- SSDEEP 49152:zO24L/Por4CZ8BSnxlGWJzV89A6E2Lfv/jMuxB4sbD3IqSq+3:zDIMdD89aSlxBx3
- TLSH T171167D12FA43A16FD0333ABC85B74AC06A65F724251289A773D96F7AFB70F802D15706
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
666.exe
Resource
win11-20260513-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target 666.exe
- Size 4.0MB
- SHA256 4958c554787a589449e918fc5e3acc61b0ca61fdbf7ce0b658d4f60e2052f48e
- MD5 fb06afbe05e9006fb0974b34db9b3e47
- SHA1 798adfdf387a81d4e4784508b1c7a45c2574e5fb
- SHA512 5a7d0ae0e43cce249f4a8bd1239697a36b6f903336b23dd0b9c7aec415e0209dd24385e4f90d14a911208214415625f4a90ac490c1439f48be34cabde1c89080
- SSDEEP 49152:zO24L/Por4CZ8BSnxlGWJzV89A6E2Lfv/jMuxB4sbD3IqSq+3:zDIMdD89aSlxBx3
- TLSH T171167D12FA43A16FD0333ABC85B74AC06A65F724251289A773D96F7AFB70F802D15706
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies WinLogon for persistence
-
UAC bypass
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables use of System Restore points
-
Event Triggered Execution: Image File Execution Options Injection
-
Modifies system executable filetype association
-
Checks whether UAC is enabled
-
Modifies WinLogon
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
6