General

  • Target

    3bcd28c4743431abd80a7504451e02e334cedb4bf104ee47377166c864ceb55b

  • Size

    881KB

  • Sample

    220703-lktx8agad2

  • MD5

    2994f3874e28f55f2618030f4813c09e

  • SHA1

    c1ad22709aacfa76f68de9f26ddfe5297caabb76

  • SHA256

    3bcd28c4743431abd80a7504451e02e334cedb4bf104ee47377166c864ceb55b

  • SHA512

    6d7b27d64c1c2ff6bf22e7c271e972d67895d3703a34cf5b3c2cfb6c774aadd6e5277ca2e9dcf537b15c5b48091f4fe75c39d657f011c6c368980a76552aa466

Score
10/10

Malware Config

Targets

    • Target

      3bcd28c4743431abd80a7504451e02e334cedb4bf104ee47377166c864ceb55b

    • Size

      881KB

    • MD5

      2994f3874e28f55f2618030f4813c09e

    • SHA1

      c1ad22709aacfa76f68de9f26ddfe5297caabb76

    • SHA256

      3bcd28c4743431abd80a7504451e02e334cedb4bf104ee47377166c864ceb55b

    • SHA512

      6d7b27d64c1c2ff6bf22e7c271e972d67895d3703a34cf5b3c2cfb6c774aadd6e5277ca2e9dcf537b15c5b48091f4fe75c39d657f011c6c368980a76552aa466

    Score
    10/10
    • Modifies WinLogon for persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Tasks