949b9cd4d45d4c66866a112b7ecd696b0e90ad749c980dc41becf04814e81e88 | Triage

Sharing

General

Target

949b9cd4d45d4c66866a112b7ecd696b0e90ad749c980dc41becf04814e81e88
Size

63KB
Sample

241126-bkkz7swmct
MD5

84db282b4e3c3bcb3559c3c0fbbfc73b
SHA1

64bd664668dc280f55e82b354033e4affb838159
SHA256

949b9cd4d45d4c66866a112b7ecd696b0e90ad749c980dc41becf04814e81e88
SHA512

b29a74c0535aa51e3164de65cd124e8ba25ce0d41f85ef17aa604e9a5a2af3c49940d203ab18c038258a4ecfb8446908616cc6f0e588d2d8882e2807ed6354d0
SSDEEP

1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIIIDIIIIIu:8g585LpPCrQt7F84IIIIIIIIIIIIIIIs

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Targets

- Target
  
  949b9cd4d45d4c66866a112b7ecd696b0e90ad749c980dc41becf04814e81e88
- Size
  
  63KB
- MD5
  
  84db282b4e3c3bcb3559c3c0fbbfc73b
- SHA1
  
  64bd664668dc280f55e82b354033e4affb838159
- SHA256
  
  949b9cd4d45d4c66866a112b7ecd696b0e90ad749c980dc41becf04814e81e88
- SHA512
  
  b29a74c0535aa51e3164de65cd124e8ba25ce0d41f85ef17aa604e9a5a2af3c49940d203ab18c038258a4ecfb8446908616cc6f0e588d2d8882e2807ed6354d0
- SSDEEP
  
  1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIIIDIIIIIu:8g585LpPCrQt7F84IIIIIIIIIIIIIIIs
Score

10^/10

aspackv2 discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoveryevasionpersistence

behavioral2

aspackv2discoveryevasionpersistence