9fa02f23b5a381b507a923bbd93452c20a3aa12f585ac04095a383f9939a214e

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SubzeroFree.exe
Size

16.2MB
MD5

6941b02bd3846caad086353b70264f09
SHA1

e1c7389d804a9ca7d53ad9c1b60718d0e258900e
SHA256

9fa02f23b5a381b507a923bbd93452c20a3aa12f585ac04095a383f9939a214e
SHA512

65554334dfd1c504ee087356b9d58aa55f376276f957070f1f03a27e1b38ae633934a9f726de394c394cb22581f23f8e155a48ff76549e36910a9b3b95b9daa3
SSDEEP

98304:FHMwajbQfcYf2MUzwcGD7eFRGYmm9sb9kHVc5XzVIhGn4+InpYY4cTVw4k1uAn0U:FCj6YMe6AsxkHql3ypBxk1u6f/yKseWi

Score

8^/10

evasion persistence vmprotect

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\afhubQhXFfTeqm\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\afhubQhXFfTeqm"	maps.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 1 IoCs

pid	Process
2792	maps.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4028-0-0x00007FF7BE9D0000-0x00007FF7BFF41000-memory.dmp	vmprotect
behavioral2/memory/4028-3-0x00007FF7BE9D0000-0x00007FF7BFF41000-memory.dmp	vmprotect
behavioral2/memory/4028-27-0x00007FF7BE9D0000-0x00007FF7BFF41000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4028	SubzeroFree.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5016	sc.exe
1368	sc.exe
3128	sc.exe
4552	sc.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
4956	taskkill.exe
3740	taskkill.exe
3420	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4028	SubzeroFree.exe
4028	SubzeroFree.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
2792	maps.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	3420	taskkill.exe
Token: SeLoadDriverPrivilege	2792	maps.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 1256	4028	SubzeroFree.exe	92
PID 4028 wrote to memory of 1256	4028	SubzeroFree.exe	92
PID 1256 wrote to memory of 3128	1256	cmd.exe	93
PID 1256 wrote to memory of 3128	1256	cmd.exe	93
PID 4028 wrote to memory of 3088	4028	SubzeroFree.exe	94
PID 4028 wrote to memory of 3088	4028	SubzeroFree.exe	94
PID 3088 wrote to memory of 4552	3088	cmd.exe	95
PID 3088 wrote to memory of 4552	3088	cmd.exe	95
PID 4028 wrote to memory of 4188	4028	SubzeroFree.exe	96
PID 4028 wrote to memory of 4188	4028	SubzeroFree.exe	96
PID 4188 wrote to memory of 4956	4188	cmd.exe	97
PID 4188 wrote to memory of 4956	4188	cmd.exe	97
PID 4028 wrote to memory of 4580	4028	SubzeroFree.exe	99
PID 4028 wrote to memory of 4580	4028	SubzeroFree.exe	99
PID 4580 wrote to memory of 3740	4580	cmd.exe	100
PID 4580 wrote to memory of 3740	4580	cmd.exe	100
PID 4028 wrote to memory of 232	4028	SubzeroFree.exe	101
PID 4028 wrote to memory of 232	4028	SubzeroFree.exe	101
PID 232 wrote to memory of 3420	232	cmd.exe	102
PID 232 wrote to memory of 3420	232	cmd.exe	102
PID 4028 wrote to memory of 2056	4028	SubzeroFree.exe	103
PID 4028 wrote to memory of 2056	4028	SubzeroFree.exe	103
PID 2056 wrote to memory of 5016	2056	cmd.exe	104
PID 2056 wrote to memory of 5016	2056	cmd.exe	104
PID 4028 wrote to memory of 3500	4028	SubzeroFree.exe	105
PID 4028 wrote to memory of 3500	4028	SubzeroFree.exe	105
PID 3500 wrote to memory of 1368	3500	cmd.exe	106
PID 3500 wrote to memory of 1368	3500	cmd.exe	106
PID 4028 wrote to memory of 3180	4028	SubzeroFree.exe	107
PID 4028 wrote to memory of 3180	4028	SubzeroFree.exe	107
PID 3180 wrote to memory of 2792	3180	cmd.exe	108
PID 3180 wrote to memory of 2792	3180	cmd.exe	108
PID 4028 wrote to memory of 748	4028	SubzeroFree.exe	109
PID 4028 wrote to memory of 748	4028	SubzeroFree.exe	109

C:\Users\Admin\AppData\Local\Temp\SubzeroFree.exe
"C:\Users\Admin\AppData\Local\Temp\SubzeroFree.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop BEService > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\system32\sc.exe
    sc stop BEService
    3⤵
    - Launches sc.exe
    PID:3128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheat > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM EpicGamesLauncher.exe > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM EpicGamesLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheat.exe > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM EasyAntiCheat.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create SubzFree binPath=C:\amifldrv64.sys type=kernel > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\sc.exe
    sc create SubzFree binPath=C:\amifldrv64.sys type=kernel
    3⤵
    - Launches sc.exe
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start SubzFree > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\sc.exe
    sc start SubzFree
    3⤵
    - Launches sc.exe
    PID:1368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\maps.exe C:\drvs.sys > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\maps.exe
    C:\maps.exe C:\drvs.sys
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5164 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\maps.exe

Filesize
133KB

MD5
284396aa4d663e010b4ecee9ddf90269

SHA1
1746d269a0c3f2fb2b75750a732c8339f0cfbfe9

SHA256
2a9e2f0f019399b393354db70af0cfabda83f87251943db7d93e50e716c824fb

SHA512
bd9466f00e71b5787bddaf410b71b04af37a7ca60deff6550df344af8dcae5d3ad138e8371dabd3003e3f6e92b92ce457ffa1d83134bf3f68fb2bd090903f062

Download Submit
memory/4028-0-0x00007FF7BE9D0000-0x00007FF7BFF41000-memory.dmp

Filesize
21.4MB

Download
memory/4028-1-0x00007FF8B35F0000-0x00007FF8B35F2000-memory.dmp

Filesize
8KB

Download
memory/4028-2-0x00007FF8B3600000-0x00007FF8B3602000-memory.dmp

Filesize
8KB

Download
memory/4028-3-0x00007FF7BE9D0000-0x00007FF7BFF41000-memory.dmp

Filesize
21.4MB

Download
memory/4028-27-0x00007FF7BE9D0000-0x00007FF7BFF41000-memory.dmp

Filesize
21.4MB

Download