Analysis
-
max time kernel
193s -
max time network
234s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-05-2022 15:10
Static task
static1
Behavioral task
behavioral1
Sample
0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe
Resource
win7-20220414-en
General
-
Target
0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe
-
Size
4.4MB
-
MD5
934653327b00519dfbda05da76d40f93
-
SHA1
266a26a068d09fb55b0cb048dfd899e888341ed8
-
SHA256
0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce
-
SHA512
ae2e76cf6301d181cc892405d8d25f180312e4d4e4fc0cc3d5500397a80b5706067854f0365bd5c9a4ed70792217eec25cab06e749e8a894dc43346537865e4f
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Program\vp8decoder.dll acprotect C:\Program\vp8encoder.dll acprotect -
Processes:
resource yara_rule C:\Program\rutserv.exe aspack_v212_v242 C:\Program\rutserv.exe aspack_v212_v242 C:\Program\rutserv.exe aspack_v212_v242 C:\Program\rutserv.exe aspack_v212_v242 C:\Program\rutserv.exe aspack_v212_v242 C:\Program\rfusclient.exe aspack_v212_v242 C:\Program\rfusclient.exe aspack_v212_v242 C:\Program\rfusclient.exe aspack_v212_v242 C:\Program\rfusclient.exe aspack_v212_v242 -
Executes dropped EXE 10 IoCs
Processes:
install.exeFreak602.exeinstall.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exepid process 4144 install.exe 4148 Freak602.exe 1028 install.exe 3920 rutserv.exe 2120 rutserv.exe 3376 rutserv.exe 928 rutserv.exe 3952 rfusclient.exe 2804 rfusclient.exe 1896 rfusclient.exe -
Processes:
resource yara_rule C:\Program\vp8decoder.dll upx C:\Program\vp8encoder.dll upx -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exeinstall.exeFreak602.exeinstall.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation install.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Freak602.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation install.exe -
Drops file in Program Files directory 6 IoCs
Processes:
0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exedescription ioc process File created C:\Program Files (x86)\Hello from Freak602\__tmp_rar_sfx_access_check_240631781 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe File created C:\Program Files (x86)\Hello from Freak602\Freak602.exe 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe File opened for modification C:\Program Files (x86)\Hello from Freak602\Freak602.exe 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe File created C:\Program Files (x86)\Hello from Freak602\install.exe 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe File opened for modification C:\Program Files (x86)\Hello from Freak602\install.exe 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe File opened for modification C:\Program Files (x86)\Hello from Freak602 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3212 timeout.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 696 taskkill.exe 2564 taskkill.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 2288 regedit.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exepid process 3920 rutserv.exe 3920 rutserv.exe 3920 rutserv.exe 3920 rutserv.exe 3920 rutserv.exe 3920 rutserv.exe 2120 rutserv.exe 2120 rutserv.exe 3376 rutserv.exe 3376 rutserv.exe 928 rutserv.exe 928 rutserv.exe 928 rutserv.exe 928 rutserv.exe 928 rutserv.exe 928 rutserv.exe 2804 rfusclient.exe 2804 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
taskkill.exetaskkill.exerutserv.exerutserv.exerutserv.exedescription pid process Token: SeDebugPrivilege 696 taskkill.exe Token: SeDebugPrivilege 2564 taskkill.exe Token: SeDebugPrivilege 3920 rutserv.exe Token: SeDebugPrivilege 3376 rutserv.exe Token: SeTakeOwnershipPrivilege 928 rutserv.exe Token: SeTcbPrivilege 928 rutserv.exe Token: SeTcbPrivilege 928 rutserv.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
install.exeinstall.exerutserv.exerutserv.exerutserv.exerutserv.exepid process 4144 install.exe 1028 install.exe 3920 rutserv.exe 3920 rutserv.exe 2120 rutserv.exe 2120 rutserv.exe 3376 rutserv.exe 3376 rutserv.exe 928 rutserv.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exeinstall.execmd.exeFreak602.exeinstall.execmd.exerutserv.exerfusclient.exedescription pid process target process PID 3644 wrote to memory of 4144 3644 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe install.exe PID 3644 wrote to memory of 4144 3644 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe install.exe PID 3644 wrote to memory of 4144 3644 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe install.exe PID 4144 wrote to memory of 1376 4144 install.exe cmd.exe PID 4144 wrote to memory of 1376 4144 install.exe cmd.exe PID 1376 wrote to memory of 4148 1376 cmd.exe Freak602.exe PID 1376 wrote to memory of 4148 1376 cmd.exe Freak602.exe PID 1376 wrote to memory of 4148 1376 cmd.exe Freak602.exe PID 4148 wrote to memory of 1028 4148 Freak602.exe install.exe PID 4148 wrote to memory of 1028 4148 Freak602.exe install.exe PID 4148 wrote to memory of 1028 4148 Freak602.exe install.exe PID 1028 wrote to memory of 1624 1028 install.exe cmd.exe PID 1028 wrote to memory of 1624 1028 install.exe cmd.exe PID 1624 wrote to memory of 696 1624 cmd.exe taskkill.exe PID 1624 wrote to memory of 696 1624 cmd.exe taskkill.exe PID 1624 wrote to memory of 2564 1624 cmd.exe taskkill.exe PID 1624 wrote to memory of 2564 1624 cmd.exe taskkill.exe PID 1624 wrote to memory of 480 1624 cmd.exe reg.exe PID 1624 wrote to memory of 480 1624 cmd.exe reg.exe PID 1624 wrote to memory of 2288 1624 cmd.exe regedit.exe PID 1624 wrote to memory of 2288 1624 cmd.exe regedit.exe PID 1624 wrote to memory of 3212 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 3212 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 3920 1624 cmd.exe rutserv.exe PID 1624 wrote to memory of 3920 1624 cmd.exe rutserv.exe PID 1624 wrote to memory of 3920 1624 cmd.exe rutserv.exe PID 1624 wrote to memory of 2120 1624 cmd.exe rutserv.exe PID 1624 wrote to memory of 2120 1624 cmd.exe rutserv.exe PID 1624 wrote to memory of 2120 1624 cmd.exe rutserv.exe PID 1624 wrote to memory of 3376 1624 cmd.exe rutserv.exe PID 1624 wrote to memory of 3376 1624 cmd.exe rutserv.exe PID 1624 wrote to memory of 3376 1624 cmd.exe rutserv.exe PID 928 wrote to memory of 2804 928 rutserv.exe rfusclient.exe PID 928 wrote to memory of 2804 928 rutserv.exe rfusclient.exe PID 928 wrote to memory of 2804 928 rutserv.exe rfusclient.exe PID 928 wrote to memory of 3952 928 rutserv.exe rfusclient.exe PID 928 wrote to memory of 3952 928 rutserv.exe rfusclient.exe PID 928 wrote to memory of 3952 928 rutserv.exe rfusclient.exe PID 2804 wrote to memory of 1896 2804 rfusclient.exe rfusclient.exe PID 2804 wrote to memory of 1896 2804 rfusclient.exe rfusclient.exe PID 2804 wrote to memory of 1896 2804 rfusclient.exe rfusclient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe"C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Program Files (x86)\Hello from Freak602\install.exe"C:\Program Files (x86)\Hello from Freak602\install.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5A50.tmp\5A51.bat "C:\Program Files (x86)\Hello from Freak602\install.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Program Files (x86)\Hello from Freak602\Freak602.exeFreak602.exe -p123 -dC:\Program Files (x86)\Internet ExpIorer4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Program\install.exe"C:\Program\install.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\68B8.tmp\68B9.bat C:\Program\install.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\taskkill.exetaskkill /f /im rutserv.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:696 -
C:\Windows\system32\taskkill.exetaskkill /f /im rfusclient.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f7⤵PID:480
-
C:\Windows\regedit.exeregedit /s "regedit.reg"7⤵
- Runs .reg file with regedit
PID:2288 -
C:\Windows\system32\timeout.exetimeout 27⤵
- Delays execution with timeout.exe
PID:3212 -
C:\Program\rutserv.exerutserv.exe /silentinstall7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3920 -
C:\Program\rutserv.exerutserv.exe /firewall7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2120 -
C:\Program\rutserv.exerutserv.exe /start7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3376
-
C:\Program\rutserv.exeC:\Program\rutserv.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Program\rfusclient.exeC:\Program\rfusclient.exe /tray2⤵
- Executes dropped EXE
PID:3952 -
C:\Program\rfusclient.exeC:\Program\rfusclient.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program\rfusclient.exeC:\Program\rfusclient.exe /tray3⤵
- Executes dropped EXE
PID:1896
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD59c61fd9b195b3f0db1286ca342a94f35
SHA1fc76941ba7d11d41f811196f93bc0f0193750851
SHA25644be6e163d6b84e037adfa24a8c3619a82df0ba194331e5da60ed55f32cfaf28
SHA512f31705f4539e50646c233b219233539338ff3c9b44b245a9289f21cc7be564eba10b86a7e34b399dff7c95c0a816a4f0c3a095e4e0b2e1811096a57289cc3cef
-
Filesize
4.1MB
MD59c61fd9b195b3f0db1286ca342a94f35
SHA1fc76941ba7d11d41f811196f93bc0f0193750851
SHA25644be6e163d6b84e037adfa24a8c3619a82df0ba194331e5da60ed55f32cfaf28
SHA512f31705f4539e50646c233b219233539338ff3c9b44b245a9289f21cc7be564eba10b86a7e34b399dff7c95c0a816a4f0c3a095e4e0b2e1811096a57289cc3cef
-
Filesize
166KB
MD5c381db6cf3be28cf4ae6b79f80feffd4
SHA103b002ad4b04d390f0dab1799118b1be5144730b
SHA256e1873454940771162e763cb47c875901afd8940001288d90abfc17f14cec258f
SHA51277bd00c1c958684a16e9d4b9e17bb381e63910c09b3ce6bbe56f724af143126daab21c55f5a5c854f4a452accfc6af2b8128c3ccb9115bca278dd88f0aadd5a6
-
Filesize
166KB
MD5c381db6cf3be28cf4ae6b79f80feffd4
SHA103b002ad4b04d390f0dab1799118b1be5144730b
SHA256e1873454940771162e763cb47c875901afd8940001288d90abfc17f14cec258f
SHA51277bd00c1c958684a16e9d4b9e17bb381e63910c09b3ce6bbe56f724af143126daab21c55f5a5c854f4a452accfc6af2b8128c3ccb9115bca278dd88f0aadd5a6
-
Filesize
69KB
MD530b3e1b01711c9f4cf0893595260c21c
SHA1fa1fa67f2d1e1a0b9085abd34079563f967ec935
SHA256df9fffcb8b167d7b2f9bf994afe07d2ce9da19bb11b53771d6401c6149cb34f5
SHA5129845e390471afef210cad5d088adcf900178853475a6ffbcc388c8da43598b1b69c42aefaff0a83aac820b760e8d4b1bb796df1b920d5a9ba2764f4a46e967ec
-
Filesize
69KB
MD530b3e1b01711c9f4cf0893595260c21c
SHA1fa1fa67f2d1e1a0b9085abd34079563f967ec935
SHA256df9fffcb8b167d7b2f9bf994afe07d2ce9da19bb11b53771d6401c6149cb34f5
SHA5129845e390471afef210cad5d088adcf900178853475a6ffbcc388c8da43598b1b69c42aefaff0a83aac820b760e8d4b1bb796df1b920d5a9ba2764f4a46e967ec
-
Filesize
11KB
MD55c53b55d69309ccea66eeec02ce649d8
SHA1bb14f532c9ba8975650cf0c93a7023b47bb26ab0
SHA256db6a980f0b87fb10181783e016aa50a3915d1d4a87a40f226e18e8886d5203e4
SHA51298fadf4890b451855c336fb906e75e034ec95ec5e867b900d1bfadf84f791758182dea33c00d36e107478ccf5dfc91a00d37928cc4232e2e23f60833f32a1c61
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
155KB
MD588318158527985702f61d169434a4940
SHA13cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA2564c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA5125d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff
-
Filesize
593KB
MD56298c0af3d1d563834a218a9cc9f54bd
SHA10185cd591e454ed072e5a5077b25c612f6849dc9
SHA25681af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe
-
Filesize
967B
MD5a7e5780f23499911ab8b1ad76cabc8fd
SHA1ac20933c872b61de3664c7966786f35dc62aa5be
SHA256ad74668679d07bed771a554d4c73af37cfd662c00b3e74aa95791670dc1e9b9e
SHA51273cc1b4be9b576056a94344435b6cfcbac727b9b1ce0a857acf305dc4798fdfccb512e8a8d707f2d4523a456bac10b72096d89f268ba06059d8a265dd095b6bd
-
Filesize
303B
MD543da2ef898696e8d17e9171e4af013ff
SHA15d78dc219f7572ca5e552c1d029c0de8f60bd237
SHA25617e49e926d6f3442909e7e289d044335b357f6c070e3c0e8e415e7cf351c14c8
SHA512dbcfd5afedfe53ec30365b93e4d0454de4c6ddede85c43ab11f855a98103ad47dd6d18dee8bb21e9b61e90906236bfd35a9252d96b7c1909495024600c7ffae4