7a8f43187deaf0aa1ba244995e24ebf6fbc1cb2a7475d55fabf97f33685d25e5 | Triage

Sharing

General

Target

7a8f43187deaf0aa1ba244995e24ebf6fbc1cb2a7475d55fabf97f33685d25e5.exe
Size

64KB
Sample

241122-jqpvcawrez
MD5

bd27b7bfa460b44a0852c2692d519e61
SHA1

89fe3f30e7d4074b0afb7038acbcd91783a63ae6
SHA256

7a8f43187deaf0aa1ba244995e24ebf6fbc1cb2a7475d55fabf97f33685d25e5
SHA512

781d01ab86c69546b30a3a2ae1f5251b3f7487bcca1482958da78413353b0dfb152226be3de9909377490d1c57eab6feca2e7aea9df274692fb833a96a187520
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIN:8g585LpPCrQt7F84IIIIIIIIIIIIIIIT

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  7a8f43187deaf0aa1ba244995e24ebf6fbc1cb2a7475d55fabf97f33685d25e5.exe
- Size
  
  64KB
- MD5
  
  bd27b7bfa460b44a0852c2692d519e61
- SHA1
  
  89fe3f30e7d4074b0afb7038acbcd91783a63ae6
- SHA256
  
  7a8f43187deaf0aa1ba244995e24ebf6fbc1cb2a7475d55fabf97f33685d25e5
- SHA512
  
  781d01ab86c69546b30a3a2ae1f5251b3f7487bcca1482958da78413353b0dfb152226be3de9909377490d1c57eab6feca2e7aea9df274692fb833a96a187520
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIN:8g585LpPCrQt7F84IIIIIIIIIIIIIIIT
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence