Resubmissions
27/05/2024, 22:11
240527-14ae9ada431027/05/2024, 21:15
240527-z3zhbabd591013/02/2024, 12:11
240213-pcwzdshd2w1013/02/2024, 12:08
240213-pa6qtahc7y1018/12/2023, 08:13
231218-j4g2nabaf51005/12/2023, 08:54
231205-kt32taae271005/12/2023, 07:41
231205-jjdthahh6w1005/12/2023, 07:38
231205-jgmcvshh5x1027/11/2023, 23:37
231127-3mae2adf8326/11/2023, 09:39
231126-lmxf5agd8710Analysis
- max time kernel
118s - max time network
120s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
13/02/2024, 12:11
General
- Target Malware-database-main/ChilledWindows.exe
- Size 4.4MB
- Sample240213-pcwzdshd2w
- SHA256 ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
chilledwindows.mp4
memory/2060-34-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/2060-38-0x000000001B590000-0x000000001B610000-memory.dmp
memory/2060-4-0x0000000002360000-0x000000000236A000-memory.dmp
memory/2060-3-0x000000001B590000-0x000000001B610000-memory.dmp
memory/2060-5-0x0000000002360000-0x000000000236A000-memory.dmp
memory/2060-0-0x00000000002B0000-0x0000000000714000-memory.dmp
memory/2060-14-0x0000000002410000-0x000000000241A000-memory.dmp
memory/2060-12-0x000007FEEB710000-0x000007FEEBB01000-memory.dmp
memory/2060-15-0x0000000002410000-0x000000000241A000-memory.dmp
memory/2060-16-0x0000000002410000-0x000000000241A000-memory.dmp
memory/2060-39-0x000000001B590000-0x000000001B610000-memory.dmp
memory/2060-18-0x0000000002410000-0x000000000241A000-memory.dmp
memory/2060-31-0x00000000024B0000-0x00000000024BA000-memory.dmp
memory/2060-32-0x000007FEEB480000-0x000007FEEB5C3000-memory.dmp
memory/2060-33-0x000007FF18A10000-0x000007FF18A1A000-memory.dmp
memory/2060-1-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp
memory/2060-2-0x000000001B590000-0x000000001B610000-memory.dmp
memory/2060-36-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp
memory/2060-20-0x0000000002410000-0x000000000241A000-memory.dmp
memory/2060-40-0x0000000002360000-0x000000000236A000-memory.dmp
memory/2060-41-0x0000000002360000-0x000000000236A000-memory.dmp
memory/2060-42-0x000007FEEB710000-0x000007FEEBB01000-memory.dmp
memory/2060-47-0x0000000002410000-0x000000000241A000-memory.dmp
memory/2060-46-0x0000000002410000-0x000000000241A000-memory.dmp
memory/2060-45-0x0000000002410000-0x000000000241A000-memory.dmp
memory/2060-44-0x0000000002410000-0x000000000241A000-memory.dmp
memory/2060-43-0x0000000002410000-0x000000000241A000-memory.dmp
memory/2060-48-0x00000000024B0000-0x00000000024BA000-memory.dmp
memory/2060-49-0x000007FEEB480000-0x000007FEEB5C3000-memory.dmp
memory/2060-50-0x000007FF18A10000-0x000007FF18A1A000-memory.dmp
memory/2060-51-0x00000000024B0000-0x00000000024BA000-memory.dmp
memory/2060-55-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp
memory/2060-56-0x000007FEEB710000-0x000007FEEBB01000-memory.dmp
memory/2060-57-0x000007FEEB480000-0x000007FEEB5C3000-memory.dmp