Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 19:57
Behavioral task
behavioral1
Sample
DeepFreeze.exe
Resource
win7-20231129-en
8 signatures
150 seconds
General
-
Target
DeepFreeze.exe
-
Size
202KB
-
MD5
606d848584caad00d05e933758bc2620
-
SHA1
7dce40e1d7dfb125570c0a2445264b7791967e6b
-
SHA256
69ca4d42492cef4caa9e2b85988c13e0dda8e8d8d962dd1cc3fc4adb4b3478f1
-
SHA512
3e66acb0a21ad606bcb78721a46fd513e702723cd31adbf04506ac1d74cc974111b3c0b84c3f471d1096b884c27c943bcbac463f7d8c63b6e55d53cb2ccfd945
-
SSDEEP
6144:gLV6Bta6dtJmakIM5elE4UXkD2rovrO6mlOdu:gLV6Btpmkt24ttvr5du
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
DeepFreeze.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe" DeepFreeze.exe -
Processes:
DeepFreeze.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DeepFreeze.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs
Processes:
flow ioc 20 0.tcp.in.ngrok.io 31 0.tcp.in.ngrok.io 29 0.tcp.in.ngrok.io 2 0.tcp.in.ngrok.io 11 0.tcp.in.ngrok.io 15 0.tcp.in.ngrok.io 6 0.tcp.in.ngrok.io 22 0.tcp.in.ngrok.io 47 0.tcp.in.ngrok.io 33 0.tcp.in.ngrok.io 38 0.tcp.in.ngrok.io 40 0.tcp.in.ngrok.io 42 0.tcp.in.ngrok.io 4 0.tcp.in.ngrok.io 13 0.tcp.in.ngrok.io 24 0.tcp.in.ngrok.io -
Drops file in Program Files directory 2 IoCs
Processes:
DeepFreeze.exedescription ioc process File opened for modification C:\Program Files (x86)\TCP Service\tcpsv.exe DeepFreeze.exe File created C:\Program Files (x86)\TCP Service\tcpsv.exe DeepFreeze.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
DeepFreeze.exepid process 2352 DeepFreeze.exe 2352 DeepFreeze.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
DeepFreeze.exepid process 2352 DeepFreeze.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DeepFreeze.exedescription pid process Token: SeDebugPrivilege 2352 DeepFreeze.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DeepFreeze.exe"C:\Users\Admin\AppData\Local\Temp\DeepFreeze.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2352