Overview

overview

10

Static

static

7

3b0c085d7a...af.exe

windows7-x64

10

3b0c085d7a...af.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3b0c085d7a09a8297ffeb1aef005b0af

  • Size

    618KB

  • Sample

    231231-zv5dlaebbk

  • MD5

    3b0c085d7a09a8297ffeb1aef005b0af

  • SHA1

    9fe6fed14407a7b1f511db8f521e648bf835c809

  • SHA256

    67349abf109c9f0ccb0581f9962116271f8d91b366ad1a94ca07d139f8a99b4c

  • SHA512

    377b92e490a518feaf5cab7ee46a1fde1320b5401bc45228fc45ed96d53d2fddf0147055b9033f0af6a027b3ac377319cb5f1c24b7ed42b80ba6a01d6294411d

  • SSDEEP

    12288:5MMpXKb0hNGh1kG0HWnALb1BuKmXsU866w0B2uJ2s4otqFCJrW9FqvSbqsHasgXd:5MMpXS0hN0V0HJBuKmcSGB2uJ2s4otq+

Score
10/10
aspackv2persistenceransomware

Malware Config

Targets

    • Target

      3b0c085d7a09a8297ffeb1aef005b0af

    • Size

      618KB

    • MD5

      3b0c085d7a09a8297ffeb1aef005b0af

    • SHA1

      9fe6fed14407a7b1f511db8f521e648bf835c809

    • SHA256

      67349abf109c9f0ccb0581f9962116271f8d91b366ad1a94ca07d139f8a99b4c

    • SHA512

      377b92e490a518feaf5cab7ee46a1fde1320b5401bc45228fc45ed96d53d2fddf0147055b9033f0af6a027b3ac377319cb5f1c24b7ed42b80ba6a01d6294411d

    • SSDEEP

      12288:5MMpXKb0hNGh1kG0HWnALb1BuKmXsU866w0B2uJ2s4otqFCJrW9FqvSbqsHasgXd:5MMpXS0hN0V0HJBuKmcSGB2uJ2s4otq+

    Score
    10/10
    aspackv2persistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks