91e87fb7f79c7f1445ba4ca4755e291887de777c04e30db2d6b265cf39dd3cef | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a96962bb6e87c502f0b803ef55e84d98_JaffaCakes118
Size

53KB
Sample

240819-d3a9tsvhpj
MD5

a96962bb6e87c502f0b803ef55e84d98
SHA1

7e1c619a3d38e6d66838b43c1ed235394d5c034f
SHA256

91e87fb7f79c7f1445ba4ca4755e291887de777c04e30db2d6b265cf39dd3cef
SHA512

73fd8dc3dba5da976fb40c02d66e94ee9ea7f793edd85cf84e36ebc33b269132fe8521c7b6cf724f85a8261d68a548a82ac374f1d0218b101c345672e75e7c46
SSDEEP

768:6ffQs4i+LX7aaROIs6jkbxyZzuxGlr2T2ZSHZ/4lBXIeClrS6MIDoyOA:6ffd+Pa4QbxyNKwr74CIrgI

Score

7^/10

aspackv2 discovery persistence

Malware Config

Targets

- Target
  
  a96962bb6e87c502f0b803ef55e84d98_JaffaCakes118
- Size
  
  53KB
- MD5
  
  a96962bb6e87c502f0b803ef55e84d98
- SHA1
  
  7e1c619a3d38e6d66838b43c1ed235394d5c034f
- SHA256
  
  91e87fb7f79c7f1445ba4ca4755e291887de777c04e30db2d6b265cf39dd3cef
- SHA512
  
  73fd8dc3dba5da976fb40c02d66e94ee9ea7f793edd85cf84e36ebc33b269132fe8521c7b6cf724f85a8261d68a548a82ac374f1d0218b101c345672e75e7c46
- SSDEEP
  
  768:6ffQs4i+LX7aaROIs6jkbxyZzuxGlr2T2ZSHZ/4lBXIeClrS6MIDoyOA:6ffd+Pa4QbxyNKwr74CIrgI
Score

7^/10

aspackv2 discovery persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoverypersistence

behavioral2

aspackv2discoverypersistence