Resubmissions
27/05/2024, 22:11
240527-14ae9ada431027/05/2024, 21:15
240527-z3zhbabd591013/02/2024, 12:11
240213-pcwzdshd2w1013/02/2024, 12:08
240213-pa6qtahc7y1018/12/2023, 08:13
231218-j4g2nabaf51005/12/2023, 08:54
231205-kt32taae271005/12/2023, 07:41
231205-jjdthahh6w1005/12/2023, 07:38
231205-jgmcvshh5x1027/11/2023, 23:37
231127-3mae2adf8326/11/2023, 09:39
231126-lmxf5agd8710Analysis
- max time kernel
117s - max time network
122s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
27/05/2024, 22:11
General
- Target Malware-database-main/ChilledWindows.exe
- Size 4.4MB
- Sample240527-14ae9ada43
- SHA256 ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
chilledwindows.mp4
memory/3016-35-0x000007FEF55D3000-0x000007FEF55D4000-memory.dmp
memory/3016-37-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp
memory/3016-5-0x00000000006C0000-0x00000000006CA000-memory.dmp
memory/3016-4-0x00000000006C0000-0x00000000006CA000-memory.dmp
memory/3016-3-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp
memory/3016-1-0x0000000000DF0000-0x0000000001254000-memory.dmp
memory/3016-25-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp
memory/3016-31-0x0000000002790000-0x000000000279A000-memory.dmp
memory/3016-30-0x0000000002790000-0x000000000279A000-memory.dmp
memory/3016-32-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp
memory/3016-29-0x0000000002670000-0x000000000267A000-memory.dmp
memory/3016-28-0x0000000002670000-0x000000000267A000-memory.dmp
memory/3016-27-0x0000000002670000-0x000000000267A000-memory.dmp
memory/3016-26-0x0000000002670000-0x000000000267A000-memory.dmp
memory/3016-2-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp
memory/3016-33-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp
memory/3016-39-0x00000000006C0000-0x00000000006CA000-memory.dmp
memory/3016-38-0x00000000006C0000-0x00000000006CA000-memory.dmp
memory/3016-0-0x000007FEF55D3000-0x000007FEF55D4000-memory.dmp
memory/3016-40-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp
memory/3016-46-0x0000000002790000-0x000000000279A000-memory.dmp
memory/3016-47-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp
memory/3016-45-0x0000000002670000-0x000000000267A000-memory.dmp
memory/3016-44-0x0000000002670000-0x000000000267A000-memory.dmp
memory/3016-43-0x0000000002670000-0x000000000267A000-memory.dmp
memory/3016-42-0x0000000002670000-0x000000000267A000-memory.dmp
memory/3016-41-0x0000000002670000-0x000000000267A000-memory.dmp
memory/3016-48-0x0000000002790000-0x000000000279A000-memory.dmp
memory/3016-49-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp
memory/3016-53-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp
memory/3016-54-0x00000000006C0000-0x00000000006C2000-memory.dmp