40f7c621c260aec5949efa43db65d89f1c90ba2d40e3622c4c6a48a3c48bb7a1 | Triage

Sharing

General

Target

a2021e449699edd8f16c117db56b8f0b_JaffaCakes118
Size

484KB
Sample

240817-ldn4ds1gmk
MD5

a2021e449699edd8f16c117db56b8f0b
SHA1

fd33ddd0d6ba9afd219d33dad170f8f855a17ad8
SHA256

40f7c621c260aec5949efa43db65d89f1c90ba2d40e3622c4c6a48a3c48bb7a1
SHA512

6ef8e0528129fd3a1468f902427ce4c6fb2acf660c84310ce434090a5b4e4cb372fca5718842b63060b7e599fd8b26e900e2ed2dd4350c3aadc6314b0db4a2fc
SSDEEP

12288:rebytrsSy4i2KWXxJzxf5/XXhUxQVTG1h3Q3q0HwTeA:rDfC2KkzlhXDy1h4q0U

Score

7^/10

aspackv2 discovery persistence

Malware Config

Targets

- Target
  
  a2021e449699edd8f16c117db56b8f0b_JaffaCakes118
- Size
  
  484KB
- MD5
  
  a2021e449699edd8f16c117db56b8f0b
- SHA1
  
  fd33ddd0d6ba9afd219d33dad170f8f855a17ad8
- SHA256
  
  40f7c621c260aec5949efa43db65d89f1c90ba2d40e3622c4c6a48a3c48bb7a1
- SHA512
  
  6ef8e0528129fd3a1468f902427ce4c6fb2acf660c84310ce434090a5b4e4cb372fca5718842b63060b7e599fd8b26e900e2ed2dd4350c3aadc6314b0db4a2fc
- SSDEEP
  
  12288:rebytrsSy4i2KWXxJzxf5/XXhUxQVTG1h3Q3q0HwTeA:rDfC2KkzlhXDy1h4q0U
Score

7^/10

aspackv2 discovery persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoverypersistence

behavioral2

aspackv2discoverypersistence