Overview

overview

10

Static

static

8

f8284b3f32...12.exe

windows7_x64

10

f8284b3f32...12.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8284b3f320cc80e70e3b01c476da012

  • Size

    316KB

  • Sample

    201214-1bwcs6xfba

  • MD5

    f8284b3f320cc80e70e3b01c476da012

  • SHA1

    22f630a082d927c357723a43471df1fc985d87cc

  • SHA256

    bb62cacb307f74c1b3c29fc6b878c2ca3f243808a846bf7ba4e5d2eb7691f0d4

  • SHA512

    1c917a4abcef6691972da7c7e0ec152d90427557703662df53daa52b37ef28ae453b4c62249b1e1ae7127a57716356b42d1f15035b815837d085d4e6fd68270f

Score
10/10
aspackv2persistence

Malware Config

Targets

    • Target

      f8284b3f320cc80e70e3b01c476da012

    • Size

      316KB

    • MD5

      f8284b3f320cc80e70e3b01c476da012

    • SHA1

      22f630a082d927c357723a43471df1fc985d87cc

    • SHA256

      bb62cacb307f74c1b3c29fc6b878c2ca3f243808a846bf7ba4e5d2eb7691f0d4

    • SHA512

      1c917a4abcef6691972da7c7e0ec152d90427557703662df53daa52b37ef28ae453b4c62249b1e1ae7127a57716356b42d1f15035b815837d085d4e6fd68270f

    Score
    10/10
    aspackv2persistence

    • Modifies WinLogon for persistence

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks