f5e1507c38c7dba45a64f1e02f3dc81e526bd72a42c9d16c29152f3894002e6f | Triage

Sharing

General

Target

f5e1507c38c7dba45a64f1e02f3dc81e526bd72a42c9d16c29152f3894002e6fN.exe
Size

64KB
Sample

241122-sabgfsynej
MD5

5ffa657143c65d04d1080a46c0506e10
SHA1

8c5c2e30834e3b34bb198d0afdc52cdb97ce2762
SHA256

f5e1507c38c7dba45a64f1e02f3dc81e526bd72a42c9d16c29152f3894002e6f
SHA512

8ba7056e47d375c02f4084fb9cbcbea01fba16891dff2d1e7d6935c65f953c717a7442442b05ee467f7540d3209aff0288382ee183ced840971912e622680fa4
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIII7:8g585LpPCrQt7F84IIIIIIIIIIIIIIIN

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  f5e1507c38c7dba45a64f1e02f3dc81e526bd72a42c9d16c29152f3894002e6fN.exe
- Size
  
  64KB
- MD5
  
  5ffa657143c65d04d1080a46c0506e10
- SHA1
  
  8c5c2e30834e3b34bb198d0afdc52cdb97ce2762
- SHA256
  
  f5e1507c38c7dba45a64f1e02f3dc81e526bd72a42c9d16c29152f3894002e6f
- SHA512
  
  8ba7056e47d375c02f4084fb9cbcbea01fba16891dff2d1e7d6935c65f953c717a7442442b05ee467f7540d3209aff0288382ee183ced840971912e622680fa4
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIII7:8g585LpPCrQt7F84IIIIIIIIIIIIIIIN
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence