Overview

overview

8

Static

static

3

Revision114exe.exe

windows7-x64

7

Revision114exe.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    Revision114exe.exe

  • Size

    10.4MB

  • Sample

    230704-w52tnsgb74

  • MD5

    e25e39744775a8a636866cc7bc446640

  • SHA1

    9258197f2960a19f6412861fcdee2eb65ea33704

  • SHA256

    d28b5ac49d1df2d04f5c918c3584772efea9260ee514cf0062ea7936ffbc1195

  • SHA512

    b567e820813c78dc7a0864b557cdb8ff9846915fb1d2e6a3c3ddf031a77c4a2b376d6973b35b117ff97a00e690fed432bfbb236da526c824247ab331f6870c86

  • SSDEEP

    196608:WMz28dVl/fzCdDNU/9onJ5hrZEK3e9tGPqKM48RmU/qZlsPv4TbqM/xBfmxMoK5j:km9c5hlEK/PNMtNqZW43rDoK5BN

Score
8/10
aspackv2discoveryexploitpersistencepyinstaller

Malware Config

Targets

    • Target

      Revision114exe.exe

    • Size

      10.4MB

    • MD5

      e25e39744775a8a636866cc7bc446640

    • SHA1

      9258197f2960a19f6412861fcdee2eb65ea33704

    • SHA256

      d28b5ac49d1df2d04f5c918c3584772efea9260ee514cf0062ea7936ffbc1195

    • SHA512

      b567e820813c78dc7a0864b557cdb8ff9846915fb1d2e6a3c3ddf031a77c4a2b376d6973b35b117ff97a00e690fed432bfbb236da526c824247ab331f6870c86

    • SSDEEP

      196608:WMz28dVl/fzCdDNU/9onJ5hrZEK3e9tGPqKM48RmU/qZlsPv4TbqM/xBfmxMoK5j:km9c5hlEK/PNMtNqZW43rDoK5BN

    Score
    8/10
    aspackv2discoveryexploitpersistence

    • Possible privilege escalation attempt

      exploit

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks