51f1c56cf6078e15d05e0ccd8a373db6cd114a574f0e3d1f8f55e5d50022244d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Frost Launcher/Frost.deps.json
Size

110KB
MD5

9699d34e46914de2d30b395067993ac8
SHA1

5e91128624473ca2b33119145c55934d23bb1f7d
SHA256

4f86617970999a75562521ccd1452f7c61ae1366c77850fb5a60d758830d7336
SHA512

f2832795a642a5ef2cc5abc71ab7ffda0cf872b8a86218821220c428b3acad44e4734759a5bbf768954c35e8028fbb211751d5e558048261e6b87a6995679fe8
SSDEEP

3072:qX+CROPbt9lcu72usgveq9eRyhzOqQ04CZJSopI2Pw:rIP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2700 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2700 AcroRd32.exe
2700 AcroRd32.exe

pid	process
2700	AcroRd32.exe

pid	process
2700	AcroRd32.exe
2700	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2156 wrote to memory of 2800	2156	cmd.exe	rundll32.exe
PID 2156 wrote to memory of 2800	2156	cmd.exe	rundll32.exe
PID 2156 wrote to memory of 2800	2156	cmd.exe	rundll32.exe
PID 2800 wrote to memory of 2700	2800	rundll32.exe	AcroRd32.exe
PID 2800 wrote to memory of 2700	2800	rundll32.exe	AcroRd32.exe
PID 2800 wrote to memory of 2700	2800	rundll32.exe	AcroRd32.exe
PID 2800 wrote to memory of 2700	2800	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Frost Launcher\Frost.deps.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Frost Launcher\Frost.deps.json
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2800

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Frost Launcher\Frost.deps.json"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c2ab2996ddcca735a0c1752b967b3e49

SHA1
f960665563706e375f1eb8d76c577a32f7d502a1

SHA256
24b18be396c771847482538f06a991ac016586509096896f07d6a2cbfebae51c

SHA512
0797ccd2a0d6a666e2286f2f7111fdb50ba91d7e2b7d664233fe86b1f645539e7c2029bc87e10c01f76e06abf3a5722d2ff34a30e5ffcdcff5323b8b7ba98625

Download Submit