aa767147cc1512b53b7f4a50f614d89c4fc9f8989c2ce2fc03e5781db0b09283 | Triage

Sharing

General

Target

8a22bbfbda65bcfcd42d6c15814c45fa_JaffaCakes118
Size

460KB
Sample

240811-m9ys5sxajk
MD5

8a22bbfbda65bcfcd42d6c15814c45fa
SHA1

f16294fffc88dfded26fbacaabf9ac3b62077631
SHA256

aa767147cc1512b53b7f4a50f614d89c4fc9f8989c2ce2fc03e5781db0b09283
SHA512

c15cfb1ee08bc335a30b7953947ba1480a0c120350680558be60784f375e81f3e176e115ff9e8ed1fb67dfb744a47eba6948885fe6571590993c07a8bb32a386
SSDEEP

12288:MTKhvYDaADmLcVExBhTnXtiDX5qMBPIWlc:TvYDaDLcsXYX5q+PIYc

Score

10^/10

aspackv2 discovery persistence

Malware Config

Targets

- Target
  
  8a22bbfbda65bcfcd42d6c15814c45fa_JaffaCakes118
- Size
  
  460KB
- MD5
  
  8a22bbfbda65bcfcd42d6c15814c45fa
- SHA1
  
  f16294fffc88dfded26fbacaabf9ac3b62077631
- SHA256
  
  aa767147cc1512b53b7f4a50f614d89c4fc9f8989c2ce2fc03e5781db0b09283
- SHA512
  
  c15cfb1ee08bc335a30b7953947ba1480a0c120350680558be60784f375e81f3e176e115ff9e8ed1fb67dfb744a47eba6948885fe6571590993c07a8bb32a386
- SSDEEP
  
  12288:MTKhvYDaADmLcVExBhTnXtiDX5qMBPIWlc:TvYDaDLcsXYX5q+PIYc
Score

10^/10

aspackv2 discovery persistence
- Modifies WinLogon for persistence
  persistence
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
  persistence
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Network Share Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoverypersistence

behavioral2

aspackv2discoverypersistence