mimic | 44ee695b532eb984e46de29569ce35854b37d409efaabb6bcf9f5316e2b0546d

Resubmissions

18-04-2024 18:50

240418-xha8wabh29 10

01-01-2024 15:12

240101-slnwxsfeh4 10

Analysis

max time kernel
1565s
max time network
1579s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe
Size

4.0MB
MD5

d59aa49740acb5e45ecb65da070035e3
SHA1

4086107b3fb71fb02361306da6099a85be97ae1d
SHA256

80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4
SHA512

459805b020b78399fae8ac5e8ed439df1b8852519014029833794d2eaad1b1f2aecc3aaba99ae52a0881cf57987d4a60298acce04a9fa9299e9d21a832a335a5
SSDEEP

98304:4gwRDvguPP+oGPn58kcuf2ilfio/roYs30f2hi:4govYoGPn5/ui8hi

Score

10^/10

mimic evasion persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\FreeWorld-Contact.txt

Ransom Note

I encrypted your system with a vulnerability in your system. If you want your information, you must pay us. The ransomware project I use on your system is a completely private project. it cannot be broken. unsolvable. People who say they can help you often come to us and they ask us for help on your behalf . In this case, you have to pay more than what you normally pay. If you contact us directly, the fee you will pay will be lower. You may not trust us . but we are trying our best to help you. We can direct you to a company whose data we opened and helped within 48 hours. We want you to know that we have references all over the world. We do not work in a specific region or country. The company we will direct you to can be from any part of the world. We may also share various images and videos with you. We will open the encrypted data. this is our job. We get paid and we help. We cover your vulnerabilities. We ensure your safety and give advice. It is not just your data that you will buy from us. also your safety Our aim is to return the hacked systems back to you. But we want to be rewarded for our services. The most important thing we want from you. be quick . Respond quickly when communicating and quickly conclude the case. We don't want to waste time. We can prove to you that we can open encrypted data. You can send the sample file you want with .png ,jpg,avi,pdf file extensions that are not important to you. We will send the file back to you in working condition. Our file limit is 3 . we can't open more for you for free. You can send us your database files. After we have your database file working, we can send you a screenshot of the table you want. If you want to talk to us instantly, you can contact us via qtox. qtox program address: https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe My qtox address is: E12919AB09D54CB3F6903091580F0C4AADFB6396B1E6C7B8520D878275F56E7803D963E639AE Email address: [email protected] Contact number : JIXNEcLEd_L6ScfTAS_qNCCv24RnCF6PTnA8uDRjvmQ*FreeWorldEncryption When you contact us, share your contact number with us.

Emails

[email protected]

URLs

https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe

Signatures

Detects Mimic ransomware 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\50000.exe	family_mimic

Mimic
Ransomware family was first exploited in the wild in 2022.
ransomware mimic
Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

DC.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3" DC.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3"	DC.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

FreeWorld.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	FreeWorld.exe

Clears Windows event logs 1 TTPs 3 IoCs
evasion ransomware

Indicator Removal
T1070

Processes:

wevtutil.exewevtutil.exewevtutil.exe

pid process

2352 wevtutil.exe
2992 wevtutil.exe
2408 wevtutil.exe
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2380 bcdedit.exe
1888 bcdedit.exe
Renames multiple (6574) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes System State backups 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1908 wbadmin.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

2408 wbadmin.exe

pid	process
2352	wevtutil.exe
2992	wevtutil.exe
2408	wevtutil.exe

pid	process
2380	bcdedit.exe
1888	bcdedit.exe

pid	process
1908	wbadmin.exe

pid	process
2408	wbadmin.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

FreeWorld.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe	FreeWorld.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2196 cmd.exe

pid	process
2196	cmd.exe

Executes dropped EXE 14 IoCs

Processes:

7za.exe7za.exe50000.exeFreeWorld.exeDC.exeFreeWorld.exeFreeWorld.exeFreeWorld.exeEverything.exeEverything.exesdel64.exesdel64.exesdel64.exesdel64.exe

pid	process
2776	7za.exe
2948	7za.exe
2720	50000.exe
2876	FreeWorld.exe
312	DC.exe
1520	FreeWorld.exe
1912	FreeWorld.exe
2704	FreeWorld.exe
840	Everything.exe
3068	Everything.exe
1904	sdel64.exe
896	sdel64.exe
2204	sdel64.exe
1648	sdel64.exe

Loads dropped DLL 26 IoCs

Processes:

80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe50000.exeFreeWorld.execmd.exeFreeWorld.exeFreeWorld.exeFreeWorld.execmd.exe

pid	process
2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe
2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe
2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe
2720	50000.exe
2720	50000.exe
2876	FreeWorld.exe
2504	cmd.exe
1520	FreeWorld.exe
1912	FreeWorld.exe
2704	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
1708
268
2700
888	cmd.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

50000.exeFreeWorld.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	50000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	50000.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	50000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	FreeWorld.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell\open\command	FreeWorld.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	FreeWorld.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell\open\command	50000.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell	50000.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell\open	50000.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	FreeWorld.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

DC.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection DC.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	DC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

FreeWorld.exe50000.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FreeWorld.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\FreeWorld-Contact.txt\""	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FreeWorld = "\"C:\\Users\\Admin\\AppData\\Local\\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\\FreeWorld.exe\" "	50000.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

FreeWorld.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" FreeWorld.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FreeWorld.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

FreeWorld.exeEverything.exeEverything.exe

description	ioc	process
File opened (read-only)	\??\R:	FreeWorld.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\T:	FreeWorld.exe
File opened (read-only)	\??\Y:	FreeWorld.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\A:	FreeWorld.exe
File opened (read-only)	\??\U:	FreeWorld.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\G:	FreeWorld.exe
File opened (read-only)	\??\V:	FreeWorld.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\X:	FreeWorld.exe
File opened (read-only)	\??\Z:	FreeWorld.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\B:	FreeWorld.exe
File opened (read-only)	\??\K:	FreeWorld.exe
File opened (read-only)	\??\O:	FreeWorld.exe
File opened (read-only)	\??\P:	FreeWorld.exe
File opened (read-only)	\??\W:	FreeWorld.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\E:	FreeWorld.exe
File opened (read-only)	\??\L:	FreeWorld.exe
File opened (read-only)	\??\Q:	FreeWorld.exe
File opened (read-only)	\??\M:	FreeWorld.exe
File opened (read-only)	\??\N:	FreeWorld.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\J:	FreeWorld.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\I:	FreeWorld.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\H:	FreeWorld.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe

Drops file in System32 directory 2 IoCs

Processes:

DC.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	DC.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	DC.exe

Drops file in Program Files directory 64 IoCs

Processes:

FreeWorld.exe

description	ioc	process
File opened for modification	C:\Program Files\GroupExit.vdw.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\settings.css.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\es-ES\Sidebar.exe.mui.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\weather.js.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\THMBNAIL.PNG.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\THMBNAIL.PNG.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\PREVIEW.GIF.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\ICE.INF.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\timeZones.js.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\CST6CDT.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\ja-JP\TableTextService.dll.mui.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\jsprofilerui.dll.mui.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\it-IT\msadcfr.dll.mui.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\msdaorar.dll.mui.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_s.png.FreeWorldEncryption	FreeWorld.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 19 IoCs

Processes:

50000.exeFreeWorld.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	50000.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	FreeWorld.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.FreeWorldEncryption\ = "mimicfile"	FreeWorld.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell	50000.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	FreeWorld.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.FreeWorldEncryption	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	50000.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell\open	50000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\FreeWorld-Contact.txt\""	FreeWorld.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile	50000.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell\open\command	50000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	FreeWorld.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell\open\command	FreeWorld.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	50000.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1936 PING.EXE

pid	process
1936	PING.EXE

Suspicious behavior: EnumeratesProcesses 55 IoCs

Processes:

DC.exeFreeWorld.exeFreeWorld.exeFreeWorld.exepowershell.exepowershell.exepowershell.exe

pid	process
312	DC.exe
312	DC.exe
312	DC.exe
312	DC.exe
1520	FreeWorld.exe
2704	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe
944	powershell.exe
2132	powershell.exe
900	powershell.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
1520	FreeWorld.exe
2704	FreeWorld.exe
2704	FreeWorld.exe
2876	FreeWorld.exe
2876	FreeWorld.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7za.exe7za.exe50000.exeFreeWorld.exeDC.exeFreeWorld.exe

description	pid	process
Token: SeRestorePrivilege	2776	7za.exe
Token: 35	2776	7za.exe
Token: SeRestorePrivilege	2948	7za.exe
Token: 35	2948	7za.exe
Token: SeSecurityPrivilege	2948	7za.exe
Token: SeSecurityPrivilege	2948	7za.exe
Token: SeIncreaseQuotaPrivilege	2720	50000.exe
Token: SeSecurityPrivilege	2720	50000.exe
Token: SeTakeOwnershipPrivilege	2720	50000.exe
Token: SeLoadDriverPrivilege	2720	50000.exe
Token: SeSystemProfilePrivilege	2720	50000.exe
Token: SeSystemtimePrivilege	2720	50000.exe
Token: SeProfSingleProcessPrivilege	2720	50000.exe
Token: SeIncBasePriorityPrivilege	2720	50000.exe
Token: SeCreatePagefilePrivilege	2720	50000.exe
Token: SeBackupPrivilege	2720	50000.exe
Token: SeRestorePrivilege	2720	50000.exe
Token: SeShutdownPrivilege	2720	50000.exe
Token: SeDebugPrivilege	2720	50000.exe
Token: SeSystemEnvironmentPrivilege	2720	50000.exe
Token: SeChangeNotifyPrivilege	2720	50000.exe
Token: SeRemoteShutdownPrivilege	2720	50000.exe
Token: SeUndockPrivilege	2720	50000.exe
Token: SeManageVolumePrivilege	2720	50000.exe
Token: SeImpersonatePrivilege	2720	50000.exe
Token: SeCreateGlobalPrivilege	2720	50000.exe
Token: 33	2720	50000.exe
Token: 34	2720	50000.exe
Token: 35	2720	50000.exe
Token: SeIncreaseQuotaPrivilege	2876	FreeWorld.exe
Token: SeSecurityPrivilege	2876	FreeWorld.exe
Token: SeTakeOwnershipPrivilege	2876	FreeWorld.exe
Token: SeLoadDriverPrivilege	2876	FreeWorld.exe
Token: SeSystemProfilePrivilege	2876	FreeWorld.exe
Token: SeSystemtimePrivilege	2876	FreeWorld.exe
Token: SeProfSingleProcessPrivilege	2876	FreeWorld.exe
Token: SeIncBasePriorityPrivilege	2876	FreeWorld.exe
Token: SeCreatePagefilePrivilege	2876	FreeWorld.exe
Token: SeBackupPrivilege	2876	FreeWorld.exe
Token: SeRestorePrivilege	2876	FreeWorld.exe
Token: SeShutdownPrivilege	2876	FreeWorld.exe
Token: SeDebugPrivilege	2876	FreeWorld.exe
Token: SeSystemEnvironmentPrivilege	2876	FreeWorld.exe
Token: SeChangeNotifyPrivilege	2876	FreeWorld.exe
Token: SeRemoteShutdownPrivilege	2876	FreeWorld.exe
Token: SeUndockPrivilege	2876	FreeWorld.exe
Token: SeManageVolumePrivilege	2876	FreeWorld.exe
Token: SeImpersonatePrivilege	2876	FreeWorld.exe
Token: SeCreateGlobalPrivilege	2876	FreeWorld.exe
Token: 33	2876	FreeWorld.exe
Token: 34	2876	FreeWorld.exe
Token: 35	2876	FreeWorld.exe
Token: SeDebugPrivilege	312	DC.exe
Token: SeAssignPrimaryTokenPrivilege	312	DC.exe
Token: SeIncreaseQuotaPrivilege	312	DC.exe
Token: 0	312	DC.exe
Token: SeIncreaseQuotaPrivilege	1520	FreeWorld.exe
Token: SeSecurityPrivilege	1520	FreeWorld.exe
Token: SeTakeOwnershipPrivilege	1520	FreeWorld.exe
Token: SeLoadDriverPrivilege	1520	FreeWorld.exe
Token: SeSystemProfilePrivilege	1520	FreeWorld.exe
Token: SeSystemtimePrivilege	1520	FreeWorld.exe
Token: SeProfSingleProcessPrivilege	1520	FreeWorld.exe
Token: SeIncBasePriorityPrivilege	1520	FreeWorld.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Everything.exeEverything.exe

pid process

840 Everything.exe
3068 Everything.exe

pid	process
840	Everything.exe
3068	Everything.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe50000.exeFreeWorld.execmd.exe

description	pid	process	target process
PID 2060 wrote to memory of 2776	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	7za.exe
PID 2060 wrote to memory of 2776	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	7za.exe
PID 2060 wrote to memory of 2776	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	7za.exe
PID 2060 wrote to memory of 2776	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	7za.exe
PID 2060 wrote to memory of 2948	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	7za.exe
PID 2060 wrote to memory of 2948	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	7za.exe
PID 2060 wrote to memory of 2948	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	7za.exe
PID 2060 wrote to memory of 2948	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	7za.exe
PID 2060 wrote to memory of 2720	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	50000.exe
PID 2060 wrote to memory of 2720	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	50000.exe
PID 2060 wrote to memory of 2720	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	50000.exe
PID 2060 wrote to memory of 2720	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	50000.exe
PID 2720 wrote to memory of 2876	2720	50000.exe	FreeWorld.exe
PID 2720 wrote to memory of 2876	2720	50000.exe	FreeWorld.exe
PID 2720 wrote to memory of 2876	2720	50000.exe	FreeWorld.exe
PID 2720 wrote to memory of 2876	2720	50000.exe	FreeWorld.exe
PID 2876 wrote to memory of 2504	2876	FreeWorld.exe	cmd.exe
PID 2876 wrote to memory of 2504	2876	FreeWorld.exe	cmd.exe
PID 2876 wrote to memory of 2504	2876	FreeWorld.exe	cmd.exe
PID 2876 wrote to memory of 2504	2876	FreeWorld.exe	cmd.exe
PID 2504 wrote to memory of 312	2504	cmd.exe	DC.exe
PID 2504 wrote to memory of 312	2504	cmd.exe	DC.exe
PID 2504 wrote to memory of 312	2504	cmd.exe	DC.exe
PID 2504 wrote to memory of 312	2504	cmd.exe	DC.exe
PID 2876 wrote to memory of 1912	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 1912	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 1912	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 1912	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 1520	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 1520	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 1520	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 1520	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 2704	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 2704	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 2704	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 2704	2876	FreeWorld.exe	FreeWorld.exe
PID 2876 wrote to memory of 840	2876	FreeWorld.exe	Everything.exe
PID 2876 wrote to memory of 840	2876	FreeWorld.exe	Everything.exe
PID 2876 wrote to memory of 840	2876	FreeWorld.exe	Everything.exe
PID 2876 wrote to memory of 840	2876	FreeWorld.exe	Everything.exe
PID 2060 wrote to memory of 2196	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	cmd.exe
PID 2060 wrote to memory of 2196	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	cmd.exe
PID 2060 wrote to memory of 2196	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	cmd.exe
PID 2060 wrote to memory of 2196	2060	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	cmd.exe
PID 2876 wrote to memory of 2960	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 2960	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 2960	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 2960	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 2144	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 2144	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 2144	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 2144	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1152	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1152	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1152	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1152	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1468	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1468	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1468	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1468	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1916	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1916	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1916	2876	FreeWorld.exe	powercfg.exe
PID 2876 wrote to memory of 1916	2876	FreeWorld.exe	powercfg.exe

System policy modification 1 TTPs 13 IoCs

evasion

Modify Registry

T1112

Processes:

FreeWorld.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " "	FreeWorld.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "I encrypted your system with a vulnerability in your system.\nIf you want your information, you must pay us.\nThe ransomware project I use on your system is a completely private project. it cannot be broken. unsolvable. People who say they can help you often come to us and they ask us for help on your behalf . In this case, you have to pay more than what you normally pay. If you contact us directly, the fee you will pay will be lower.\nYou may not trust us . but we are trying our best to help you.\nWe can direct you to a company whose data we opened and helped within 48 hours.\nWe want you to know that we have references all over the world.\nWe do not work in a specific region or country. The company we will direct you to can be from any part of the world. We may also share various images and videos with you.\nWe will open the encrypted data. this is our job. We get paid and we help. We cover your vulnerabilities. We ensure your safety and give advice.\nIt is not just your data that you will buy from us. also your safety\nOur aim is to return the hacked systems back to you.\nBut we want to be rewarded for our services.\nThe most important thing we want from you. be quick . Respond quickly when communicating and quickly conclude the case. We don't want to waste time.\nWe can prove to you that we can open encrypted data.\nYou can send the sample file you want with .png ,jpg,avi,pdf file extensions that are not important to you. We will send the file back to you in working condition. Our file limit is 3 . we can't open more for you for free.\nYou can send us your database files. After we have your database file working, we can send you a screenshot of the table you want.\nIf you want to talk to us instantly, you can contact us via qtox.\n\nqtox program address: https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe\nMy qtox address is: E12919AB09D54CB3F6903091580F0C4AADFB6396B1E6C7B8520D878275F56E7803D963E639AE\nEmail address: [email protected]\nContact number : JIXNEcLEd_L6ScfTAS_qNCCv24RnCF6PTnA8uDRjvmQ*FreeWorldEncryption\n\nWhen you contact us, share your contact number with us."	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	FreeWorld.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe
"C:\Users\Admin\AppData\Local\Temp\80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p105689248955111405 Everything64.dll
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\50000.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\50000.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe
    "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe"
    3⤵
    - UAC bypass
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2876
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c DC.exe /D
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\DC.exe
        
        DC.exe /D
        5⤵
        Modifies security service
        Executes dropped EXE
        Windows security modification
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:312
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe" -e watch -pid 2876 -!
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1912
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe" -e ul1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1520
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe" -e ul2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2704
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:840
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -H off
      4⤵
      PID:2960
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:2144
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:1152
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:1468
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:1916
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:2020
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:1668
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:616
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:1608
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:1824
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:1164
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:2164
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:2996
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      PID:1096
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
      4⤵
      PID:308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2132
  - - C:\Windows\system32\bcdedit.exe
      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2380
  - - C:\Windows\system32\bcdedit.exe
      bcdedit.exe /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1888
  - - C:\Windows\system32\wbadmin.exe
      wbadmin.exe DELETE SYSTEMSTATEBACKUP
      4⤵
      Deletes System State backups
      PID:1908
  - - C:\Windows\system32\wbadmin.exe
      wbadmin.exe delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:2408
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:3068
  - - C:\Windows\SysWOW64\notepad.exe
      notepad.exe "C:\Users\Admin\AppData\Local\FreeWorld-Contact.txt"
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\sdel64.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\sdel64.exe" -accepteula -p 1 -c C:\
      4⤵
      Executes dropped EXE
      PID:1904
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\sdel64.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\sdel64.exe" -accepteula -p 1 -c F:\
      4⤵
      Executes dropped EXE
      PID:896
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\sdel64.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\sdel64.exe" -accepteula -p 1 -c Z:\
      4⤵
      Executes dropped EXE
      PID:2204
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil.exe cl security
      4⤵
      Clears Windows event logs
      PID:2408
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil.exe cl system
      4⤵
      Clears Windows event logs
      PID:2992
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil.exe cl application
      4⤵
      Clears Windows event logs
      PID:2352
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /d /c "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\sd.bat"
      4⤵
      Loads dropped DLL
      PID:888
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.2 -n 5
        5⤵
        Runs ping.exe
        
        PID:1936
    - - C:\Windows\SysWOW64\fsutil.exe
        
        fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe"
        5⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\sdel64.exe
        
        sdel64.exe -accepteula -p 3 -q FreeWorld.exe
        5⤵
        Executes dropped EXE
        
        PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Deletes itself
  PID:2196

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2096

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2860

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1416

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\FreeWorld-Contact.txt

Filesize
2KB

MD5
e9364360e31c4c632530cb678851931f

SHA1
8e816e2442a091055f0497b69078f01fb5274663

SHA256
f59c6ceecc3c9f4cd28ce98b5c05c288db22127e5876921708b8e56bf720338c

SHA512
28f2965bc22d83346235e9cd6b246ddc7eaaf4433763e1d9e3b49c09eb016043880a4c7bcfda7e3d7548c7d197d9bf19b61552abce28fe6eeb8c72e31afa1e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
300B

MD5
1f092347239d24d54055fc4162ed1404

SHA1
b48e8e2fdd3bf1f49affdc036d71f49888a2c95b

SHA256
49f4a0c7f862edce8ba313e0da16d0acb0588f6c5143257bc6d201366f805120

SHA512
e81b0d3ba26ecceec925550564fa22d5e9da950e131a44da88014fda0a2406ac421f6e77a4ac73fb8b7a97c8c0aee08c86bae8e77369678c5c456384d56b0318

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\50000.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini

Filesize
548B

MD5
742c2400f2de964d0cce4a8dabadd708

SHA1
c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

SHA256
2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

SHA512
63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini

Filesize
550B

MD5
51014c0c06acdd80f9ae4469e7d30a9e

SHA1
204e6a57c44242fad874377851b13099dfe60176

SHA256
89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

SHA512
79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll

Filesize
3.0MB

MD5
607e58bd01a843958ca6d890b80412ae

SHA1
ed8b3cb3e47e46479ad20d84675901448788b33c

SHA256
83b3488020127bead102071c6aa0148e78f253fe73cdbc5123a8cbcffdaac2fc

SHA512
8e640b22e6ed34f9c500eb0b2a40e50c036072182e2c7db50094b79cfeb6fdad52a1d5ea6b9b87b7aade45ca357e165f587d352942bdb33c1586e89b94555926

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sdel.exe

Filesize
350KB

MD5
803df907d936e08fbbd06020c411be93

SHA1
4aa4b498ae037a2b0479659374a5c3af5f6b8d97

SHA256
e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

SHA512
5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sdel64.exe

Filesize
448KB

MD5
e2114b1627889b250c7fd0425ba1bd54

SHA1
97412dba3cbeb0125c71b7b2ab194ea2fdff51b2

SHA256
5434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60

SHA512
76ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.db

Filesize
9.2MB

MD5
ade30d9227d1ba3724df48722142b7ea

SHA1
762cb358b2cd28eb5814a516a821c7d981b67786

SHA256
506b344e622d5003d10b4146542afa8f95c769ac010c624f64752edc5c121bd8

SHA512
59b681eb3401cd7c80427fc91496af55a4a9a6f2546ac95caf5da8e0849115745851bb57981cb2752a9649c8830100d16318f397255faca3871ba38ce93fedd2

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.ini

Filesize
20KB

MD5
f86bdbce18a0cde69c6f827ab9a93fa3

SHA1
847c63c95b4de8d7d9828795ef4960b4f308db2c

SHA256
0d8cfd50922ff5dad4e234ec73f795d2335daa77a9eedef9ca5cbdd0bee8d5df

SHA512
08fd614f6bb6518898191c48fcd82e112e3ba8979bd97b2e6071fee0c17e6bf2db16f6bbdf1f5359bd91759b443ed3f4ad499d67c66b901ea6226ad6f522397b

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.ini.tmp

Filesize
20KB

MD5
30e7699f0597b0917062716f7f8060ca

SHA1
6063e9d56c39123578ce53ce607cbff1570620f1

SHA256
ad1895f9811fcbdd436ffa832451e61662fce540308a5a27fac8e188ccb8c014

SHA512
bd21402a5534bcda3608c09a85866da91dfa7e1d0caccec029ffb4ced86b28dbb73be456570b8021b7675d93730b2f0cb3ab1f684c78b9616e2c3f996bc9c0b4

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\session.tmp

Filesize
32B

MD5
930848fd498c81c623c6ea7d594de150

SHA1
e25a64693a3448f89b71ca504f11aac1a69cbd78

SHA256
8bf44b62058eade9480e0fdbe30883100af3b4e87a5e0e66655d0065fc79724b

SHA512
7510039f0f8b79a44d6ca51ab5efcf3d7e388c09b9c3608524d0edd7ac4276df906e6b35ae3f98e05c8385c2aa109cce8d60d1e2e7453b946cbdbe08b934e1da

Download Submit
C:\Users\Admin\AppData\Local\{F80FDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.DDD

Filesize
3.5MB

MD5
d43b6e399b083f5f163c96da35479761

SHA1
fb91e8ec8687be4936a06cd3f94d6be839a18547

SHA256
8bd0ef2dc9160bceab25a5c689102b473999f90fdc23f3c1f303bc89951013ba

SHA512
66f63c550d734b700cd766629bbb60707ae22913e02af547d8fcbea049ecc0c8eddaae10d8ad66d7b13da290fe224f0e14b2cc93ad81afd0f785118d732b816d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ce8f1dda1d63211afeb34a0a12cb9ded

SHA1
848510244ace3942b27bddc692aaf30899bfea17

SHA256
18a1817cee0547f306a277e794c7693f343d80b2715e61c061d9e48cb7485138

SHA512
6779cac5855103f300fd74307f0f9655ea025182adb5cd221ddcea82fa18ccabf6979e419de815bcebd21fdba74570164aedaa8d6ed2ac58efea831b8260f1d4

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
233B

MD5
cd4326a6fd01cd3ca77cfd8d0f53821b

SHA1
a1030414d1f8e5d5a6e89d5a309921b8920856f9

SHA256
1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c

SHA512
29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe

Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll

Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
memory/900-158-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/900-157-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/900-164-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/900-163-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/900-162-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/900-161-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/944-159-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/944-153-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/944-151-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/944-141-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/944-150-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/944-152-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/944-155-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2132-154-0x0000000002A70000-0x0000000002AF0000-memory.dmp

Filesize
512KB

Download
memory/2132-160-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/2132-156-0x0000000002A70000-0x0000000002AF0000-memory.dmp

Filesize
512KB

Download
memory/2132-148-0x0000000002A70000-0x0000000002AF0000-memory.dmp

Filesize
512KB

Download
memory/2132-147-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/2132-140-0x000000001B440000-0x000000001B722000-memory.dmp

Filesize
2.9MB

Download
memory/2132-149-0x0000000002A70000-0x0000000002AF0000-memory.dmp

Filesize
512KB

Download