8f3c9ad33eefaa5eb5fc4543f0e48c85c32abb3d9d0e09b6f1ee74a6d1189463 | Triage

Sharing

General

Target

8f3c9ad33eefaa5eb5fc4543f0e48c85c32abb3d9d0e09b6f1ee74a6d1189463.exe
Size

63KB
Sample

241120-c71jvazbpn
MD5

01f7c5322bd3b6129c48969e3254a9f7
SHA1

caa3978e1784c0071c66138a04f70f91daeb817b
SHA256

8f3c9ad33eefaa5eb5fc4543f0e48c85c32abb3d9d0e09b6f1ee74a6d1189463
SHA512

95cfa7f44d2e08b70e7b91e3110cbe872764deb1fbf6f02551ee2b2ca11c3cca61a5d1196baeb7bc7246a373f9008bff8e74976b960a952ef6fabab7f3cdb640
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIn:8g585LpPCrQt7F84IIIIIIIIIIIIIIIx

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  8f3c9ad33eefaa5eb5fc4543f0e48c85c32abb3d9d0e09b6f1ee74a6d1189463.exe
- Size
  
  63KB
- MD5
  
  01f7c5322bd3b6129c48969e3254a9f7
- SHA1
  
  caa3978e1784c0071c66138a04f70f91daeb817b
- SHA256
  
  8f3c9ad33eefaa5eb5fc4543f0e48c85c32abb3d9d0e09b6f1ee74a6d1189463
- SHA512
  
  95cfa7f44d2e08b70e7b91e3110cbe872764deb1fbf6f02551ee2b2ca11c3cca61a5d1196baeb7bc7246a373f9008bff8e74976b960a952ef6fabab7f3cdb640
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIn:8g585LpPCrQt7F84IIIIIIIIIIIIIIIx
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence