General

  • Target

    ae84ec23ebbe60a983ead3a8d32cbade

  • Size

    1.9MB

  • Sample

    240229-pptpssgh41

  • MD5

    ae84ec23ebbe60a983ead3a8d32cbade

  • SHA1

    26389e8a38cc66504b0f7ab01ccf3d99932f47b7

  • SHA256

    b9656d9d100439bd3fc91cd8e69be9a50a01e4f9c9f1c27a0900a34c1a20f0e4

  • SHA512

    e6e449f8b587dd587c814c87660f86c32bef15186e6a82844fe4a95aee8276701cf5cd2b1116391681cd4085451f3c0abc0789b374999c584d444e47844b44ef

  • SSDEEP

    12288:5PNM9cM4pmckJQNFJj6TQfCi0Z/k8FVL+X7ByzdcsqPCPpS1rha9:4cM4cIF56Ipyc1mqPOSxha9

Score
10/10

Malware Config

Targets

    • Target

      ae84ec23ebbe60a983ead3a8d32cbade

    • Size

      1.9MB

    • MD5

      ae84ec23ebbe60a983ead3a8d32cbade

    • SHA1

      26389e8a38cc66504b0f7ab01ccf3d99932f47b7

    • SHA256

      b9656d9d100439bd3fc91cd8e69be9a50a01e4f9c9f1c27a0900a34c1a20f0e4

    • SHA512

      e6e449f8b587dd587c814c87660f86c32bef15186e6a82844fe4a95aee8276701cf5cd2b1116391681cd4085451f3c0abc0789b374999c584d444e47844b44ef

    • SSDEEP

      12288:5PNM9cM4pmckJQNFJj6TQfCi0Z/k8FVL+X7ByzdcsqPCPpS1rha9:4cM4cIF56Ipyc1mqPOSxha9

    Score
    10/10
    • Modifies WinLogon for persistence

    • Adds policy Run key to start application

    • Modifies Installed Components in the registry

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks