4f16a5d0a180164cd8d6c74a5e8c3ed8bbfed070e0d31c3db229b0935a5eddcd | Triage

Sharing

General

Target

4f16a5d0a180164cd8d6c74a5e8c3ed8bbfed070e0d31c3db229b0935a5eddcd.exe
Size

62KB
Sample

241120-c9c7bszcjk
MD5

82d11f4af93404bc28bc7250b13ea040
SHA1

b699f477a39e766efea7afe04b47879ceec3da5b
SHA256

4f16a5d0a180164cd8d6c74a5e8c3ed8bbfed070e0d31c3db229b0935a5eddcd
SHA512

057cfc8dd174e6bbc57e61941a6f34a3de11eda96889b425674ed69c6099eb56bb64861900be8916d866bdb25ab944e7cee5e389ab9c71fd9758d70836f55fcd
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIII7:8g585LpPCrQt7F84IIIIIIIIIIIIIIIl

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  4f16a5d0a180164cd8d6c74a5e8c3ed8bbfed070e0d31c3db229b0935a5eddcd.exe
- Size
  
  62KB
- MD5
  
  82d11f4af93404bc28bc7250b13ea040
- SHA1
  
  b699f477a39e766efea7afe04b47879ceec3da5b
- SHA256
  
  4f16a5d0a180164cd8d6c74a5e8c3ed8bbfed070e0d31c3db229b0935a5eddcd
- SHA512
  
  057cfc8dd174e6bbc57e61941a6f34a3de11eda96889b425674ed69c6099eb56bb64861900be8916d866bdb25ab944e7cee5e389ab9c71fd9758d70836f55fcd
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIII7:8g585LpPCrQt7F84IIIIIIIIIIIIIIIl
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence