Overview

overview

10

Static

static

3

??????????.exe

windows7-x64

7

??????????.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ??????????.exe

  • Size

    51.1MB

  • Sample

    230605-kgtbvaga6v

  • MD5

    0769ed600d9fd9477915573dca6ac0e3

  • SHA1

    651bc713117a92a449a1936e8fdf42e9ae5b8b9b

  • SHA256

    ec3ab38ccd00d1c556983978e89533fc9c3cfbb395f590ee4c437847a68ecf80

  • SHA512

    aa50e289c7ef3453fdf6e1a94450a1d8737c522c153c556fac1bb6617b31bbb202c60e156a0f5c8998a93b32065a9fa5b51da33a803557009f91f43265b56439

  • SSDEEP

    1572864:vvhr89ORGJRvOaIHPZtp9RvxgtC+rGQFh57MefPAH1x6iu:3B8lRfIHPHRZ+rGQFYeXMmV

Score
10/10
aspackv2discoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      ??????????.exe

    • Size

      51.1MB

    • MD5

      0769ed600d9fd9477915573dca6ac0e3

    • SHA1

      651bc713117a92a449a1936e8fdf42e9ae5b8b9b

    • SHA256

      ec3ab38ccd00d1c556983978e89533fc9c3cfbb395f590ee4c437847a68ecf80

    • SHA512

      aa50e289c7ef3453fdf6e1a94450a1d8737c522c153c556fac1bb6617b31bbb202c60e156a0f5c8998a93b32065a9fa5b51da33a803557009f91f43265b56439

    • SSDEEP

      1572864:vvhr89ORGJRvOaIHPZtp9RvxgtC+rGQFh57MefPAH1x6iu:3B8lRfIHPHRZ+rGQFYeXMmV

    Score
    10/10
    aspackv2discoveryevasionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Creates new service(s)

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

New Service

1
T1050

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks