1e4519b90828e71ac7b3f6e6eeb3463a02462640433e6b384206cf852931c4a4

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PROGRAMFILES/FREEzeFrog/bin/2.0.19.0/FREEzeFrogSA.exe
Size

780KB
MD5

508a2ca25ed1235d38844f48f9b64c7f
SHA1

2d5d3ddbe6a3119be28763e58d90e0e4f272790a
SHA256

74b2952b87d5f4ef1697cc6843b947fbf891a8ad8cc52c280940d78175aebdd7
SHA512

b7598b87e335272bd96707804790d6ea61ca9eb9b02be2ff0e4b502c72069b63db77fa0c626b918e7c71e3c0b0fb0148933c03862f85c934443b683b2c88d378
SSDEEP

12288:JG8YCWRwg3n/UUf0sJxK0JXDl53wkZWILKvHlwtvcpW22Ty+TaqCZxTN3g/y:JG8YvVt0sJxK0F31/uvHls2rIaRPWq

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	FREEzeFrogSA.exe
File opened (read-only)	\??\r:	FREEzeFrogSA.exe
File opened (read-only)	\??\i:	FREEzeFrogSA.exe
File opened (read-only)	\??\j:	FREEzeFrogSA.exe
File opened (read-only)	\??\n:	FREEzeFrogSA.exe
File opened (read-only)	\??\w:	FREEzeFrogSA.exe
File opened (read-only)	\??\z:	FREEzeFrogSA.exe
File opened (read-only)	\??\g:	FREEzeFrogSA.exe
File opened (read-only)	\??\q:	FREEzeFrogSA.exe
File opened (read-only)	\??\o:	FREEzeFrogSA.exe
File opened (read-only)	\??\h:	FREEzeFrogSA.exe
File opened (read-only)	\??\k:	FREEzeFrogSA.exe
File opened (read-only)	\??\l:	FREEzeFrogSA.exe
File opened (read-only)	\??\p:	FREEzeFrogSA.exe
File opened (read-only)	\??\s:	FREEzeFrogSA.exe
File opened (read-only)	\??\t:	FREEzeFrogSA.exe
File opened (read-only)	\??\u:	FREEzeFrogSA.exe
File opened (read-only)	\??\e:	FREEzeFrogSA.exe
File opened (read-only)	\??\x:	FREEzeFrogSA.exe
File opened (read-only)	\??\y:	FREEzeFrogSA.exe
File opened (read-only)	\??\v:	FREEzeFrogSA.exe

C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\FREEzeFrog\bin\2.0.19.0\FREEzeFrogSA.exe
"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\FREEzeFrog\bin\2.0.19.0\FREEzeFrogSA.exe"
1⤵
- Enumerates connected drives
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads