8169d73b40ee6e81a7ab0bae2f3d761102d03877385d0fd2c26f972e9210ada9 | Triage

Sharing

General

Target

1732233184b4811bba0d47744362d41bafc1a303d700cc8709c5e216f86dee4148689507cc512.dat-decoded.exe
Size

64KB
Sample

241121-3xvhysznex
MD5

385e7b496b00ea29de872509cb29f5be
SHA1

5d944b9957d54698cb0319a3e65362435ef5885b
SHA256

8169d73b40ee6e81a7ab0bae2f3d761102d03877385d0fd2c26f972e9210ada9
SHA512

9fa0973186c1577dea242a0df9b0a23c416da33e7a7f232678669fb0479ca4eec83a0ee21e97c6ce0768e461348740edfdcaefb3324e1572810f493e618c8ba2
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIh:8g585LpPCrQt7F84IIIIIIIIIIIIIIIz

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  1732233184b4811bba0d47744362d41bafc1a303d700cc8709c5e216f86dee4148689507cc512.dat-decoded.exe
- Size
  
  64KB
- MD5
  
  385e7b496b00ea29de872509cb29f5be
- SHA1
  
  5d944b9957d54698cb0319a3e65362435ef5885b
- SHA256
  
  8169d73b40ee6e81a7ab0bae2f3d761102d03877385d0fd2c26f972e9210ada9
- SHA512
  
  9fa0973186c1577dea242a0df9b0a23c416da33e7a7f232678669fb0479ca4eec83a0ee21e97c6ce0768e461348740edfdcaefb3324e1572810f493e618c8ba2
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIh:8g585LpPCrQt7F84IIIIIIIIIIIIIIIz
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence