Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 20:11
Behavioral task
behavioral1
Sample
DeepFreeze3.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
DeepFreeze3.exe
-
Size
202KB
-
MD5
638057af238763e319b034c984156cfe
-
SHA1
1e7f30c505182ef7f4ea704d495bbde942682e42
-
SHA256
283655432a294659d3532ab8624eab8b8ce6e7dade0a7eb98107f2a77186489c
-
SHA512
beb8204be20e2377f33f20c772a71e7d98707de1879f37ed46053431037d692d8ae850f8ed1a8c77cdc0f13b717992665ee5710e5043cbae8a1df25792dcdcfb
-
SSDEEP
6144:gLV6Bta6dtJmakIM5SlE4UXkD2rovrO6mlOZ:gLV6BtpmkN24ttvr5Z
Malware Config
Signatures
-
Processes:
DeepFreeze3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DeepFreeze3.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs
Processes:
flow ioc 31 0.tcp.in.ngrok.io 33 0.tcp.in.ngrok.io 38 0.tcp.in.ngrok.io 40 0.tcp.in.ngrok.io 49 0.tcp.in.ngrok.io 13 0.tcp.in.ngrok.io 22 0.tcp.in.ngrok.io 29 0.tcp.in.ngrok.io 2 0.tcp.in.ngrok.io 24 0.tcp.in.ngrok.io 15 0.tcp.in.ngrok.io 4 0.tcp.in.ngrok.io 6 0.tcp.in.ngrok.io 11 0.tcp.in.ngrok.io 20 0.tcp.in.ngrok.io 42 0.tcp.in.ngrok.io 47 0.tcp.in.ngrok.io -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
DeepFreeze3.exepid process 2220 DeepFreeze3.exe 2220 DeepFreeze3.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
DeepFreeze3.exepid process 2220 DeepFreeze3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DeepFreeze3.exedescription pid process Token: SeDebugPrivilege 2220 DeepFreeze3.exe