e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f | Triage

Sharing

General

Target

17322268314a51a39ac2777728622eba6f0e0ffb4d9a43e754cf43e17710963c83922a9d03611.dat-decoded.exe
Size

64KB
Sample

241121-2fewhaylgs
MD5

04e6b5760c4b7ce8217375ba3ce7914a
SHA1

dd6a17ad99eb90a623db5b4cbed4e1faf6587523
SHA256

e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f
SHA512

2f68ae2b06bbf8fda80e185e616ceb65afe7a2be1c2e53e2326df70de1a2d39504ceb4669abca36c97e99b679622943321c11f99b03fe4ebbbc2eddf4b41d729
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIN:8g585LpPCrQt7F84IIIIIIIIIIIIIIIT

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  17322268314a51a39ac2777728622eba6f0e0ffb4d9a43e754cf43e17710963c83922a9d03611.dat-decoded.exe
- Size
  
  64KB
- MD5
  
  04e6b5760c4b7ce8217375ba3ce7914a
- SHA1
  
  dd6a17ad99eb90a623db5b4cbed4e1faf6587523
- SHA256
  
  e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f
- SHA512
  
  2f68ae2b06bbf8fda80e185e616ceb65afe7a2be1c2e53e2326df70de1a2d39504ceb4669abca36c97e99b679622943321c11f99b03fe4ebbbc2eddf4b41d729
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIN:8g585LpPCrQt7F84IIIIIIIIIIIIIIIT
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence