General
- Target gamepad.json
- Size 221B
- Sample260906-vk3d2aydjb
- SHA256 d69e29498000378aa1594a980f5a3f655d0a83006fe74575c024d4457cfc1b73
- MD5 c12cd729f3774d40bf8e25730ce69870
- SHA1 1b2e8f70aa50b32b2c8d1a5c0eb5ceb669048f2d
- SHA512 7bf39a9a0e0d11f34a24fa2afa49acd75ef6c4d781c86bba996393faffcd36c7880d16cdb1d19f4e345935f9fe14b18d08fd74fadc602d2e503e069b00f82955
- TLSH T106D0A76379D0D12715E5568C7471B4210424D47BE1436AEA6C0CFD14E961162104BA00
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
gamepad.json
Resource
win10v2004-20260513-en
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
gamepad.json
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target gamepad.json
- Size 221B
- SHA256 d69e29498000378aa1594a980f5a3f655d0a83006fe74575c024d4457cfc1b73
- MD5 c12cd729f3774d40bf8e25730ce69870
- SHA1 1b2e8f70aa50b32b2c8d1a5c0eb5ceb669048f2d
- SHA512 7bf39a9a0e0d11f34a24fa2afa49acd75ef6c4d781c86bba996393faffcd36c7880d16cdb1d19f4e345935f9fe14b18d08fd74fadc602d2e503e069b00f82955
- TLSH T106D0A76379D0D12715E5568C7471B4210424D47BE1436AEA6C0CFD14E961162104BA00
- MD5 SHA1 SHA512 TLSH
-
Modifies WinLogon for persistence
-
UAC bypass
-
Disables RegEdit via registry modification
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3