3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395 | Triage

Sharing

General

Target

3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395
Size

64KB
Sample

241121-2yzzdstlal
MD5

ba423cc966ae8f69bd093fc71b8e46ba
SHA1

d0087bc748dff59f79432a62619eeae8af2d67d4
SHA256

3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395
SHA512

ae8d783064d3b84ec390982cbe22e80d5f731f34179b7dd7e663c6ec98e8c627d3f917edbebfbe8f4b70b3ddf59293d55a7f2f164d62c81833bade67872b8e90
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIy:8g585LpPCrQt7F84IIIIIIIIIIIIIIIU

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395
- Size
  
  64KB
- MD5
  
  ba423cc966ae8f69bd093fc71b8e46ba
- SHA1
  
  d0087bc748dff59f79432a62619eeae8af2d67d4
- SHA256
  
  3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395
- SHA512
  
  ae8d783064d3b84ec390982cbe22e80d5f731f34179b7dd7e663c6ec98e8c627d3f917edbebfbe8f4b70b3ddf59293d55a7f2f164d62c81833bade67872b8e90
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIy:8g585LpPCrQt7F84IIIIIIIIIIIIIIIU
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence