Overview

overview

10

Static

static

45cc84a95b...82.exe

windows7_x64

10

45cc84a95b...82.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82

  • Size

    1.9MB

  • Sample

    220707-mvx83adfhl

  • MD5

    a11109d3316d966a57e8b50cd7ed12dc

  • SHA1

    2cc9f2d62662abf99d83fad61d02452d9a4c764b

  • SHA256

    45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82

  • SHA512

    ff325b04a7039212135d988f01176c8d556f34a7182fcfd154eb123e4f11367440c7af7cca56d49ba9c175a1c77abf7e83e84cb2f4a3865fe02e0fa9087b546d

Score
10/10
aspackv2persistence

Malware Config

Targets

    • Target

      45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82

    • Size

      1.9MB

    • MD5

      a11109d3316d966a57e8b50cd7ed12dc

    • SHA1

      2cc9f2d62662abf99d83fad61d02452d9a4c764b

    • SHA256

      45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82

    • SHA512

      ff325b04a7039212135d988f01176c8d556f34a7182fcfd154eb123e4f11367440c7af7cca56d49ba9c175a1c77abf7e83e84cb2f4a3865fe02e0fa9087b546d

    Score
    10/10
    aspackv2persistence

    • Modifies WinLogon for persistence

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

2
T1004

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks