Overview
overview
7Static
static
3FREAKIN.rar
windows7-x64
3FREAKIN.rar
windows10-2004-x64
7FREAKIN/jr...mo.dll
windows7-x64
3FREAKIN/jr...mo.dll
windows10-2004-x64
3FREAKIN/jr...pl.dll
windows7-x64
1FREAKIN/jr...pl.dll
windows10-2004-x64
1FREAKIN/jr...pl.exe
windows7-x64
1FREAKIN/jr...pl.exe
windows10-2004-x64
1FREAKIN/jr...nt.dll
windows7-x64
1FREAKIN/jr...nt.dll
windows10-2004-x64
1FREAKIN/jr...2k.dll
windows7-x64
3FREAKIN/jr...2k.dll
windows10-2004-x64
3FREAKIN/jr...io.dll
windows7-x64
3FREAKIN/jr...io.dll
windows10-2004-x64
3FREAKIN/jr...aw.exe
windows7-x64
1FREAKIN/jr...aw.exe
windows10-2004-x64
1FREAKIN/jr...ws.exe
windows7-x64
1FREAKIN/jr...ws.exe
windows10-2004-x64
1FREAKIN/jr...wt.dll
windows7-x64
1FREAKIN/jr...wt.dll
windows10-2004-x64
1FREAKIN/jr...wp.dll
windows7-x64
3FREAKIN/jr...wp.dll
windows10-2004-x64
3FREAKIN/jr...fr.dll
windows7-x64
3FREAKIN/jr...fr.dll
windows10-2004-x64
3FREAKIN/jr...ia.dll
windows7-x64
1FREAKIN/jr...ia.dll
windows10-2004-x64
1FREAKIN/jr...it.dll
windows7-x64
3FREAKIN/jr...it.dll
windows10-2004-x64
3FREAKIN/jr...js.exe
windows7-x64
1FREAKIN/jr...js.exe
windows10-2004-x64
1FREAKIN/jr...li.dll
windows7-x64
1FREAKIN/jr...li.dll
windows10-2004-x64
3Analysis
-
max time kernel
136s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
FREAKIN.rar
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
FREAKIN.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
FREAKIN/jre/bin/java_crw_demo.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
FREAKIN/jre/bin/java_crw_demo.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
FREAKIN/jre/bin/javacpl.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
FREAKIN/jre/bin/javacpl.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral7
Sample
FREAKIN/jre/bin/javacpl.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
FREAKIN/jre/bin/javacpl.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
FREAKIN/jre/bin/javafx_font.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
FREAKIN/jre/bin/javafx_font.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
FREAKIN/jre/bin/javafx_font_t2k.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
FREAKIN/jre/bin/javafx_font_t2k.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
FREAKIN/jre/bin/javafx_iio.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
FREAKIN/jre/bin/javafx_iio.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
FREAKIN/jre/bin/javaw.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
FREAKIN/jre/bin/javaw.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
FREAKIN/jre/bin/javaws.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
FREAKIN/jre/bin/javaws.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
FREAKIN/jre/bin/jawt.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
FREAKIN/jre/bin/jawt.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
FREAKIN/jre/bin/jdwp.dll
Resource
win7-20240319-en
Behavioral task
behavioral22
Sample
FREAKIN/jre/bin/jdwp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
FREAKIN/jre/bin/jfr.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
FREAKIN/jre/bin/jfr.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
FREAKIN/jre/bin/jfxmedia.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
FREAKIN/jre/bin/jfxmedia.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
FREAKIN/jre/bin/jfxwebkit.dll
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
FREAKIN/jre/bin/jfxwebkit.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
FREAKIN/jre/bin/jjs.exe
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
FREAKIN/jre/bin/jjs.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
FREAKIN/jre/bin/jli.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
FREAKIN/jre/bin/jli.dll
Resource
win10v2004-20240226-en
General
-
Target
FREAKIN.rar
-
Size
98.7MB
-
MD5
62844fd18f3714d44b85a78245011cf8
-
SHA1
e2739de0cdea1049f6ab49d02d5ad04d8a563a2c
-
SHA256
75f2450c9475b0adef291c84d08dd8ba99c011d2ee34caef0f34340ef4c6b4e6
-
SHA512
5cdea12276ba92bdfabb10cb227ba9bcf67b23d6748ca738192b5940756de26c344e6febf8230a0edd4fd0a7e1478bf41e2b05a4ddc586613bb61163d6f8587c
-
SSDEEP
3145728:A6Kcho1+eJ1HC7qtu2hVMzRgCq8u0zuWM3VVtYN:A8oUeXUqVeItJWM/tk
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3360 7zFM.exe Token: 35 3360 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3360 7zFM.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 228 wrote to memory of 3360 228 cmd.exe 89 PID 228 wrote to memory of 3360 228 cmd.exe 89
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FREAKIN.rar1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\FREAKIN.rar"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3360
-