ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

General

Target

chilledwindows.exe
Size

4.4MB
MD5

6a4853cd0584dc90067e15afb43c4962
SHA1

ae59bbb123e98dc8379d08887f83d7e52b1b47fc
SHA256

ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
SHA512

feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996
SSDEEP

98304:XyDt6K4MJVnjOobt/JN1LA5elHc+S4fRp5UvluKo:XyDtK8bbxn+IHcBEV/F

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	chilledwindows.exe
File opened (read-only)	\??\W:	chilledwindows.exe
File opened (read-only)	\??\Y:	chilledwindows.exe
File opened (read-only)	\??\A:	chilledwindows.exe
File opened (read-only)	\??\K:	chilledwindows.exe
File opened (read-only)	\??\L:	chilledwindows.exe
File opened (read-only)	\??\N:	chilledwindows.exe
File opened (read-only)	\??\P:	chilledwindows.exe
File opened (read-only)	\??\E:	chilledwindows.exe
File opened (read-only)	\??\J:	chilledwindows.exe
File opened (read-only)	\??\Q:	chilledwindows.exe
File opened (read-only)	\??\X:	chilledwindows.exe
File opened (read-only)	\??\Z:	chilledwindows.exe
File opened (read-only)	\??\M:	chilledwindows.exe
File opened (read-only)	\??\S:	chilledwindows.exe
File opened (read-only)	\??\R:	chilledwindows.exe
File opened (read-only)	\??\T:	chilledwindows.exe
File opened (read-only)	\??\V:	chilledwindows.exe
File opened (read-only)	\??\B:	chilledwindows.exe
File opened (read-only)	\??\G:	chilledwindows.exe
File opened (read-only)	\??\H:	chilledwindows.exe
File opened (read-only)	\??\I:	chilledwindows.exe
File opened (read-only)	\??\O:	chilledwindows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1168293393-3419776239-306423207-1000\{65872FCF-8515-470A-97C7-8561BCE3DCA5}	chilledwindows.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2480	chilledwindows.exe
Token: SeCreatePagefilePrivilege	2480	chilledwindows.exe
Token: 33	4012	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4012	AUDIODG.EXE
Token: SeShutdownPrivilege	2480	chilledwindows.exe
Token: SeCreatePagefilePrivilege	2480	chilledwindows.exe
Token: SeShutdownPrivilege	2480	chilledwindows.exe
Token: SeCreatePagefilePrivilege	2480	chilledwindows.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	chilledwindows.exe

C:\Users\Admin\AppData\Local\Temp\chilledwindows.exe
"C:\Users\Admin\AppData\Local\Temp\chilledwindows.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2480

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404 0x3e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
512KB

MD5
7ccad3651f6e8ccbf86ae0970db24300

SHA1
cc0d483969da48d989086162b0d509d7f09f5521

SHA256
2668ec8cf22902cbc5378d7bcace30760ec2ccab75e44b7af957ec2591c7f872

SHA512
69447ab3f0e5cabfddb6bd9d037b42fb5adceeb1620ff36331774c8a0aa9e3dcf867b42d9a6a71c047e25518d30e19c3ccad34f9d8d9e95f98b81b2c144c1f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
memory/2480-18-0x00000000230D0000-0x0000000023108000-memory.dmp

Filesize
224KB

Download
memory/2480-2-0x000000001B910000-0x000000001B920000-memory.dmp

Filesize
64KB

Download
memory/2480-14-0x000000001B910000-0x000000001B920000-memory.dmp

Filesize
64KB

Download
memory/2480-16-0x000000001F5B0000-0x000000001F5B8000-memory.dmp

Filesize
32KB

Download
memory/2480-17-0x000000001B910000-0x000000001B920000-memory.dmp

Filesize
64KB

Download
memory/2480-0-0x0000000000710000-0x0000000000B74000-memory.dmp

Filesize
4.4MB

Download
memory/2480-19-0x000000001F830000-0x000000001F83E000-memory.dmp

Filesize
56KB

Download
memory/2480-3-0x000000001B910000-0x000000001B920000-memory.dmp

Filesize
64KB

Download
memory/2480-1-0x00007FFDC2770000-0x00007FFDC3231000-memory.dmp

Filesize
10.8MB

Download
memory/2480-37-0x00007FFDC2770000-0x00007FFDC3231000-memory.dmp

Filesize
10.8MB

Download
memory/2480-38-0x000000001B910000-0x000000001B920000-memory.dmp

Filesize
64KB

Download
memory/2480-39-0x000000001B910000-0x000000001B920000-memory.dmp

Filesize
64KB

Download
memory/2480-40-0x000000001B910000-0x000000001B920000-memory.dmp

Filesize
64KB

Download
memory/2480-54-0x00007FFDC2770000-0x00007FFDC3231000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing