1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2 | Triage

Sharing

General

Target

1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe
Size

62KB
Sample

241120-wja4tsvnek
MD5

fb7f1c3c694ea35946a1fe0415f882de
SHA1

c51196f374e9f21a7086f24929ab20a257432873
SHA256

1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2
SHA512

7e7ecea62af28573761848d2742aa9cff02e4dcfa74b3b918545ebd42add3b051e7afb4ef66e1fc900e8c917d18e1771175cbf80495334f3d26497556f707385
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIIIDIIIIIC:8g585LpPCrQt7F84IIIIIIIIIIIIIIIU

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe
- Size
  
  62KB
- MD5
  
  fb7f1c3c694ea35946a1fe0415f882de
- SHA1
  
  c51196f374e9f21a7086f24929ab20a257432873
- SHA256
  
  1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2
- SHA512
  
  7e7ecea62af28573761848d2742aa9cff02e4dcfa74b3b918545ebd42add3b051e7afb4ef66e1fc900e8c917d18e1771175cbf80495334f3d26497556f707385
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIIIDIIIIIC:8g585LpPCrQt7F84IIIIIIIIIIIIIIIU
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence