3606f906b01220f2dcfda65504bc7ce806a9f984c7067e5022aa872eaa35a39b | Triage

Sharing

General

Target

3606f906b01220f2dcfda65504bc7ce806a9f984c7067e5022aa872eaa35a39b.exe
Size

63KB
Sample

241122-jvr59swrhz
MD5

4d4cc6a0188e64c16c384e8de3711b6f
SHA1

bd13be96a19831f849fbd6cc4bca3b8fd2c0e113
SHA256

3606f906b01220f2dcfda65504bc7ce806a9f984c7067e5022aa872eaa35a39b
SHA512

c33bb2dd61feff2b436b984597dc68cf34aee9ae26f1d95dd0c0bc4c3101192a9efdf2d6f63f39cd283db57ceb93f464f358c4b472d8783f1973a0d163944896
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIIIDIIIIIb:8g585LpPCrQt7F84IIIIIIIIIIIIIIIp

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  3606f906b01220f2dcfda65504bc7ce806a9f984c7067e5022aa872eaa35a39b.exe
- Size
  
  63KB
- MD5
  
  4d4cc6a0188e64c16c384e8de3711b6f
- SHA1
  
  bd13be96a19831f849fbd6cc4bca3b8fd2c0e113
- SHA256
  
  3606f906b01220f2dcfda65504bc7ce806a9f984c7067e5022aa872eaa35a39b
- SHA512
  
  c33bb2dd61feff2b436b984597dc68cf34aee9ae26f1d95dd0c0bc4c3101192a9efdf2d6f63f39cd283db57ceb93f464f358c4b472d8783f1973a0d163944896
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIIIDIIIIIb:8g585LpPCrQt7F84IIIIIIIIIIIIIIIp
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence