a812ed1d18abc7ac7a202c491ce11a2166a5848118eed23502ed91a102d862c7 | Triage

Sharing

General

Target

a812ed1d18abc7ac7a202c491ce11a2166a5848118eed23502ed91a102d862c7
Size

64KB
Sample

241122-dek45ayqbm
MD5

d721e2bf9abc01139dcebd832734eb86
SHA1

a1c1f777e8b73dd61b89166798bf05163355c0ef
SHA256

a812ed1d18abc7ac7a202c491ce11a2166a5848118eed23502ed91a102d862c7
SHA512

b8d04c658f5a9ad4bd4b3c0940ff24b8f9fc00447293fa3c285d2ac917829aa97864ad6da914e05bce09ecae60a997b69e52978f44dc15fa402e8324e655216a
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIn:8g585LpPCrQt7F84IIIIIIIIIIIIIIIl

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  a812ed1d18abc7ac7a202c491ce11a2166a5848118eed23502ed91a102d862c7
- Size
  
  64KB
- MD5
  
  d721e2bf9abc01139dcebd832734eb86
- SHA1
  
  a1c1f777e8b73dd61b89166798bf05163355c0ef
- SHA256
  
  a812ed1d18abc7ac7a202c491ce11a2166a5848118eed23502ed91a102d862c7
- SHA512
  
  b8d04c658f5a9ad4bd4b3c0940ff24b8f9fc00447293fa3c285d2ac917829aa97864ad6da914e05bce09ecae60a997b69e52978f44dc15fa402e8324e655216a
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIn:8g585LpPCrQt7F84IIIIIIIIIIIIIIIl
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence