Overview

overview

10

Static

static

8

server.exe

windows10-1703-x64

10

Resubmissions

25-11-2022 15:38

221125-s3jcrsbh9x 10

25-11-2022 15:33

221125-szhl3abg2v 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    server.exe

  • Size

    342KB

  • Sample

    221125-s3jcrsbh9x

  • MD5

    dd7a7bdffc40007a2e9a77de930b2ab2

  • SHA1

    6088343b8765d896bb8ec465e25b1cecca5f8c67

  • SHA256

    f1d4cf0fec6a19910599f985043e6699ec763c58330d66e86bdce4b12fc82407

  • SHA512

    f130953f19e91c8871ce93fb85a0bd062e7fbbdc3742dc5f9be9e373dd66c54ace542189f21ba9b3c93a55a77e83e328b7d95279457fbf95ebd8dfe9993fbcae

  • SSDEEP

    6144:4Rqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4yYWYbCyx:8qmpplpGoGL3etQoMiXM8gxf/Sj4yix

Score
10/10
aspackv2persistenceupx

Malware Config

Targets

    • Target

      server.exe

    • Size

      342KB

    • MD5

      dd7a7bdffc40007a2e9a77de930b2ab2

    • SHA1

      6088343b8765d896bb8ec465e25b1cecca5f8c67

    • SHA256

      f1d4cf0fec6a19910599f985043e6699ec763c58330d66e86bdce4b12fc82407

    • SHA512

      f130953f19e91c8871ce93fb85a0bd062e7fbbdc3742dc5f9be9e373dd66c54ace542189f21ba9b3c93a55a77e83e328b7d95279457fbf95ebd8dfe9993fbcae

    • SSDEEP

      6144:4Rqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4yYWYbCyx:8qmpplpGoGL3etQoMiXM8gxf/Sj4yix

    Score
    10/10
    aspackv2persistenceupx

    • Modifies WinLogon for persistence

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

2
T1004

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks