Overview
overview
10Static
static
10virtual_fr...ds.ps1
windows7_x64
1virtual_fr...ds.ps1
windows10-2004_x64
1virtual_fr...es.ps1
windows7_x64
1virtual_fr...es.ps1
windows10-2004_x64
1virtual_fr...ts.ps1
windows7_x64
1virtual_fr...ts.ps1
windows10-2004_x64
1virtual_fr...ns.ps1
windows7_x64
1virtual_fr...ns.ps1
windows10-2004_x64
1virtual_fr...cts.js
windows7_x64
1virtual_fr...cts.js
windows10-2004_x64
1virtual_fr...ng.ps1
windows7_x64
1virtual_fr...ng.ps1
windows10-2004_x64
1virtual_fr...der.js
windows7_x64
1virtual_fr...der.js
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...ck.ps1
windows7_x64
1virtual_fr...ck.ps1
windows10-2004_x64
1virtual_fr...de.pdf
windows7_x64
1virtual_fr...de.pdf
windows10-2004_x64
1virtual_fr...nks.js
windows7_x64
1virtual_fr...nks.js
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...ler.js
windows7_x64
1virtual_fr...ler.js
windows10-2004_x64
1virtual_fr...tp.ps1
windows7_x64
1virtual_fr...tp.ps1
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...oap.js
windows7_x64
1virtual_fr...oap.js
windows10-2004_x64
1Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 07:07
Behavioral task
behavioral1
Sample
virtual_freer_v1.58/back/cards.ps1
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
virtual_freer_v1.58/back/cards.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
virtual_freer_v1.58/back/categories.ps1
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
virtual_freer_v1.58/back/categories.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
virtual_freer_v1.58/back/payments.ps1
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
virtual_freer_v1.58/back/payments.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
virtual_freer_v1.58/back/plugins.ps1
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
virtual_freer_v1.58/back/plugins.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
virtual_freer_v1.58/back/products.js
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
virtual_freer_v1.58/back/products.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
virtual_freer_v1.58/back/setting.ps1
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
virtual_freer_v1.58/back/setting.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
virtual_freer_v1.58/back/template/header.js
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
virtual_freer_v1.58/back/template/header.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
virtual_freer_v1.58/back/template/index.html
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
virtual_freer_v1.58/back/template/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
virtual_freer_v1.58/callback.ps1
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
virtual_freer_v1.58/callback.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
virtual_freer_v1.58/guide.pdf
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
virtual_freer_v1.58/guide.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
virtual_freer_v1.58/include/funks.js
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
virtual_freer_v1.58/include/funks.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
virtual_freer_v1.58/include/index.html
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
virtual_freer_v1.58/include/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
virtual_freer_v1.58/include/libs/class.phpmailer.js
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
virtual_freer_v1.58/include/libs/class.phpmailer.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral27
Sample
virtual_freer_v1.58/include/libs/class.smtp.ps1
Resource
win7-20220414-en
Behavioral task
behavioral28
Sample
virtual_freer_v1.58/include/libs/class.smtp.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral29
Sample
virtual_freer_v1.58/include/libs/index.html
Resource
win7-20220414-en
Behavioral task
behavioral30
Sample
virtual_freer_v1.58/include/libs/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral31
Sample
virtual_freer_v1.58/include/libs/nusoap.js
Resource
win7-20220414-en
Behavioral task
behavioral32
Sample
virtual_freer_v1.58/include/libs/nusoap.js
Resource
win10v2004-20220414-en
General
-
Target
virtual_freer_v1.58/back/cards.ps1
-
Size
22KB
-
MD5
dcc8c1c2a8101c0a2fdbfba419abd8b3
-
SHA1
48b432e1f26446ad2a1b06606bcd9b2b8f871337
-
SHA256
81a0b4177d24b49b74709d6035713f9398fd6230ba00855f7200734ea18be413
-
SHA512
abeef69d9f1d55786f053b985fc5d29e41ee73c81c7b3016e503ae655b3c30628b43ba32e7a17d57808226e0b1d63380ceb62c271c73c6b0354803eb2ecec1fe
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1948 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1948 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1948-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmpFilesize
8KB
-
memory/1948-55-0x000007FEF3C00000-0x000007FEF4623000-memory.dmpFilesize
10.1MB
-
memory/1948-56-0x000007FEF30A0000-0x000007FEF3BFD000-memory.dmpFilesize
11.4MB
-
memory/1948-57-0x0000000002794000-0x0000000002797000-memory.dmpFilesize
12KB
-
memory/1948-58-0x000000001B700000-0x000000001B9FF000-memory.dmpFilesize
3.0MB
-
memory/1948-59-0x000000000279B000-0x00000000027BA000-memory.dmpFilesize
124KB