3604fb7bb6311043125573ecfef59ef29dda4533413ce1c6e9fa4f02003d64bb | Triage

Sharing

General

Target

3604fb7bb6311043125573ecfef59ef29dda4533413ce1c6e9fa4f02003d64bb
Size

63KB
Sample

241121-2nnhlstkal
MD5

0fedf754c1378503ae839f35d4d29f0c
SHA1

55e1c0f1d631188a4c86711ef09f6c91f89f8040
SHA256

3604fb7bb6311043125573ecfef59ef29dda4533413ce1c6e9fa4f02003d64bb
SHA512

362d9061194feb4ed1d1e72788754ef93bd71f0cbb3c1a037a550a58f1d8acc4bf235d66a8a74d19a73f3c554d42d1bd5d1ad9c69c0f160ef515cd241d2d7397
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIB:8g585LpPCrQt7F84IIIIIIIIIIIIIII/

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  3604fb7bb6311043125573ecfef59ef29dda4533413ce1c6e9fa4f02003d64bb
- Size
  
  63KB
- MD5
  
  0fedf754c1378503ae839f35d4d29f0c
- SHA1
  
  55e1c0f1d631188a4c86711ef09f6c91f89f8040
- SHA256
  
  3604fb7bb6311043125573ecfef59ef29dda4533413ce1c6e9fa4f02003d64bb
- SHA512
  
  362d9061194feb4ed1d1e72788754ef93bd71f0cbb3c1a037a550a58f1d8acc4bf235d66a8a74d19a73f3c554d42d1bd5d1ad9c69c0f160ef515cd241d2d7397
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIB:8g585LpPCrQt7F84IIIIIIIIIIIIIII/
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence