2524aab82b6b4458ebd9547641afbd36061f08d43d37fc6f7965b493466d7897 | Triage

Submit
Reports

Overview

overview

Static

static

8

2524aab82b...97.exe

windows7-x64

2524aab82b...97.exe

windows10-2004-x64

Sharing

General

Target

2524aab82b6b4458ebd9547641afbd36061f08d43d37fc6f7965b493466d7897
Size

42KB
Sample

221123-z19v9shd4v
MD5

748080737c5e82390029c4fead317fbf
SHA1

3fc1c1a20cc6749f92c2589b26bd7a277348dc02
SHA256

2524aab82b6b4458ebd9547641afbd36061f08d43d37fc6f7965b493466d7897
SHA512

5e411396d2453d735d6f54a52a0a3f5a3dd387b035316fba89491ab38115a0d0d02e7cd9e05faee32073522bc7a3a21b5e996056b9bd9fa32690dfd51efb92d6
SSDEEP

768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D8888888888F:BzOCay4wV339rPjzbpLwRJ9pSdoIQ

Score

10^/10

aspackv2 evasion persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2524aab82b6b4458ebd9547641afbd36061f08d43d37fc6f7965b493466d7897.exe

Resource

win7-20220901-en

aspackv2 evasion persistence

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

2524aab82b6b4458ebd9547641afbd36061f08d43d37fc6f7965b493466d7897.exe

Resource

win10v2004-20221111-en

aspackv2 evasion persistence

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  2524aab82b6b4458ebd9547641afbd36061f08d43d37fc6f7965b493466d7897
- Size
  
  42KB
- MD5
  
  748080737c5e82390029c4fead317fbf
- SHA1
  
  3fc1c1a20cc6749f92c2589b26bd7a277348dc02
- SHA256
  
  2524aab82b6b4458ebd9547641afbd36061f08d43d37fc6f7965b493466d7897
- SHA512
  
  5e411396d2453d735d6f54a52a0a3f5a3dd387b035316fba89491ab38115a0d0d02e7cd9e05faee32073522bc7a3a21b5e996056b9bd9fa32690dfd51efb92d6
- SSDEEP
  
  768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D8888888888F:BzOCay4wV339rPjzbpLwRJ9pSdoIQ
Score

10^/10

aspackv2 evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2evasionpersistence

behavioral2

aspackv2evasionpersistence

© 2018-2024

Terms | Privacy