008039a49577c519b463814cdf8c04ad600e63debf240879c5d2b43cb5177c43 | Triage

Sharing

General

Target

008039a49577c519b463814cdf8c04ad600e63debf240879c5d2b43cb5177c43.exe
Size

64KB
Sample

241122-qs5rxa1pfy
MD5

407f13ef3fed008707cc04bcb06c418b
SHA1

5478422c97ff8595bbc9b1df2cf20a6f62b95bc4
SHA256

008039a49577c519b463814cdf8c04ad600e63debf240879c5d2b43cb5177c43
SHA512

c542bb71976da78e03f3abd4dff84115154d268e02b67d8c6bf833ffa015cd4a330d79e16299e9f09d8cdaaf64d6ef28a9f7f31654dce346b1ed1613fdadaad2
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIId:8g585LpPCrQt7F84IIIIIIIIIIIIIIIz

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  008039a49577c519b463814cdf8c04ad600e63debf240879c5d2b43cb5177c43.exe
- Size
  
  64KB
- MD5
  
  407f13ef3fed008707cc04bcb06c418b
- SHA1
  
  5478422c97ff8595bbc9b1df2cf20a6f62b95bc4
- SHA256
  
  008039a49577c519b463814cdf8c04ad600e63debf240879c5d2b43cb5177c43
- SHA512
  
  c542bb71976da78e03f3abd4dff84115154d268e02b67d8c6bf833ffa015cd4a330d79e16299e9f09d8cdaaf64d6ef28a9f7f31654dce346b1ed1613fdadaad2
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIId:8g585LpPCrQt7F84IIIIIIIIIIIIIIIz
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence