Overview

overview

10

Static

static

8

464fa3d9ea...47.exe

windows7_x64

10

464fa3d9ea...47.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    464fa3d9eaece84db9d04221c5a1df5e985f044b51c7b3e3c46d4bb5092edc47

  • Size

    959KB

  • Sample

    220707-k435kacdf5

  • MD5

    a71f3bc44ca191d08cccd3988f606bd2

  • SHA1

    c8775ed5539914641b71becf2e58d380b875dd75

  • SHA256

    464fa3d9eaece84db9d04221c5a1df5e985f044b51c7b3e3c46d4bb5092edc47

  • SHA512

    11d3ad6e6847d039ccee5204161460214b0a88b9cd4e9ef849a1e8d5a96d97e1cc0e09d0213acdfc863925cd90bd08323c118dcaba6fe1a141c00d5aed4c33ef

Score
10/10
aspackv2persistence

Malware Config

Targets

    • Target

      464fa3d9eaece84db9d04221c5a1df5e985f044b51c7b3e3c46d4bb5092edc47

    • Size

      959KB

    • MD5

      a71f3bc44ca191d08cccd3988f606bd2

    • SHA1

      c8775ed5539914641b71becf2e58d380b875dd75

    • SHA256

      464fa3d9eaece84db9d04221c5a1df5e985f044b51c7b3e3c46d4bb5092edc47

    • SHA512

      11d3ad6e6847d039ccee5204161460214b0a88b9cd4e9ef849a1e8d5a96d97e1cc0e09d0213acdfc863925cd90bd08323c118dcaba6fe1a141c00d5aed4c33ef

    Score
    10/10
    aspackv2persistence

    • Modifies WinLogon for persistence

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks