Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    23-04-2024 20:03

General

  • Target

    DeepFreeze.exe

  • Size

    202KB

  • MD5

    606d848584caad00d05e933758bc2620

  • SHA1

    7dce40e1d7dfb125570c0a2445264b7791967e6b

  • SHA256

    69ca4d42492cef4caa9e2b85988c13e0dda8e8d8d962dd1cc3fc4adb4b3478f1

  • SHA512

    3e66acb0a21ad606bcb78721a46fd513e702723cd31adbf04506ac1d74cc974111b3c0b84c3f471d1096b884c27c943bcbac463f7d8c63b6e55d53cb2ccfd945

  • SSDEEP

    6144:gLV6Bta6dtJmakIM5elE4UXkD2rovrO6mlOdu:gLV6Btpmkt24ttvr5du

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DeepFreeze.exe
    "C:\Users\Admin\AppData\Local\Temp\DeepFreeze.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2316-0-0x0000000074BE0000-0x000000007518B000-memory.dmp

    Filesize

    5.7MB

  • memory/2316-1-0x0000000000490000-0x00000000004D0000-memory.dmp

    Filesize

    256KB

  • memory/2316-2-0x0000000074BE0000-0x000000007518B000-memory.dmp

    Filesize

    5.7MB

  • memory/2316-5-0x0000000074BE0000-0x000000007518B000-memory.dmp

    Filesize

    5.7MB

  • memory/2316-6-0x0000000000490000-0x00000000004D0000-memory.dmp

    Filesize

    256KB