dada32cbd82318063d5af1f11e8a8a510102fa129d2caba30bf2c04810b1576c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b43a337eaf7202c3e2f9e344d42fb9d5_JaffaCakes118
Size

1.7MB
Sample

240821-t7jd1azbkh
MD5

b43a337eaf7202c3e2f9e344d42fb9d5
SHA1

c26f387ee032b6140c742273b40bc55cd65ade05
SHA256

dada32cbd82318063d5af1f11e8a8a510102fa129d2caba30bf2c04810b1576c
SHA512

5190c601ec41f025f66d12a22161430d8568bb4faf34691082ed09bde730777854a168334d704584d8392af50ddd3ba3ef96ec62eb1040f7dee7a71b8d1dcab0
SSDEEP

24576:mFxS0wzdHOzWJnUrdQnTkJ1Ru9SxT+mJDz6yd/9pnrwA/d6s:0SLzdHisCdIQ3Ru9g3Bm+lKUd

Score

8^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  b43a337eaf7202c3e2f9e344d42fb9d5_JaffaCakes118
- Size
  
  1.7MB
- MD5
  
  b43a337eaf7202c3e2f9e344d42fb9d5
- SHA1
  
  c26f387ee032b6140c742273b40bc55cd65ade05
- SHA256
  
  dada32cbd82318063d5af1f11e8a8a510102fa129d2caba30bf2c04810b1576c
- SHA512
  
  5190c601ec41f025f66d12a22161430d8568bb4faf34691082ed09bde730777854a168334d704584d8392af50ddd3ba3ef96ec62eb1040f7dee7a71b8d1dcab0
- SSDEEP
  
  24576:mFxS0wzdHOzWJnUrdQnTkJ1Ru9SxT+mJDz6yd/9pnrwA/d6s:0SLzdHisCdIQ3Ru9g3Bm+lKUd
Score

8^/10

aspackv2 discovery evasion persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

discoveryevasion