General
- Target images.jpeg
- Size 47KB
- Sample261014-tg63daft9z
- SHA256 b0839031a6997ae135973486e300e97c27ee39e8939399aac57fe8ff2b8b1481
- MD5 632954cf8598bfa7c13a863e2449f8e2
- SHA1 2ea7f0c31bbf6550b7925b77ebf1843f9e5e3645
- SHA512 39eb6f747806e3508001439bd081734ec125d4d6b7cf8b5b43ff8b879e283b1464135be87f84f9e6420fedd5f56bc3342fc6a9e56c6dc5c304f9c2ff43b55a3d
- SSDEEP 768:ZFrVeQblqsmjFmIQNk7pmyW0rFif0Ux0Vef8QX6caiIrmQIUcD+ICyvW52xeLzCE:ZBVefZUq9E0Jvl48QX6c/IboshpxF7k6
- TLSH T14623F13FD0D1972ECDCA62AFC2308601D904F5E41EAAF01D8B5CDAF0A4F166A547B1E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
images.jpg
Resource
win11ltsc2024-20260911-en
32 signatures
900 seconds
Malware Config
Targets
-
- Target images.jpeg
- Size 47KB
- SHA256 b0839031a6997ae135973486e300e97c27ee39e8939399aac57fe8ff2b8b1481
- MD5 632954cf8598bfa7c13a863e2449f8e2
- SHA1 2ea7f0c31bbf6550b7925b77ebf1843f9e5e3645
- SHA512 39eb6f747806e3508001439bd081734ec125d4d6b7cf8b5b43ff8b879e283b1464135be87f84f9e6420fedd5f56bc3342fc6a9e56c6dc5c304f9c2ff43b55a3d
- SSDEEP 768:ZFrVeQblqsmjFmIQNk7pmyW0rFif0Ux0Vef8QX6caiIrmQIUcD+ICyvW52xeLzCE:ZBVefZUq9E0Jvl48QX6c/IboshpxF7k6
- TLSH T14623F13FD0D1972ECDCA62AFC2308601D904F5E41EAAF01D8B5CDAF0A4F166A547B1E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies WinLogon for persistence
-
UAC bypass
-
Disables RegEdit via registry modification
-
Executes a VBScript file via the Windows Script Host.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
4