ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

General

Target

chilledwindows.exe
Size

4.4MB
MD5

6a4853cd0584dc90067e15afb43c4962
SHA1

ae59bbb123e98dc8379d08887f83d7e52b1b47fc
SHA256

ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
SHA512

feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996
SSDEEP

98304:XyDt6K4MJVnjOobt/JN1LA5elHc+S4fRp5UvluKo:XyDtK8bbxn+IHcBEV/F

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	chilledwindows.exe
File opened (read-only)	\??\R:	chilledwindows.exe
File opened (read-only)	\??\T:	chilledwindows.exe
File opened (read-only)	\??\U:	chilledwindows.exe
File opened (read-only)	\??\Y:	chilledwindows.exe
File opened (read-only)	\??\B:	chilledwindows.exe
File opened (read-only)	\??\G:	chilledwindows.exe
File opened (read-only)	\??\J:	chilledwindows.exe
File opened (read-only)	\??\K:	chilledwindows.exe
File opened (read-only)	\??\Q:	chilledwindows.exe
File opened (read-only)	\??\S:	chilledwindows.exe
File opened (read-only)	\??\W:	chilledwindows.exe
File opened (read-only)	\??\Z:	chilledwindows.exe
File opened (read-only)	\??\A:	chilledwindows.exe
File opened (read-only)	\??\E:	chilledwindows.exe
File opened (read-only)	\??\H:	chilledwindows.exe
File opened (read-only)	\??\O:	chilledwindows.exe
File opened (read-only)	\??\V:	chilledwindows.exe
File opened (read-only)	\??\I:	chilledwindows.exe
File opened (read-only)	\??\M:	chilledwindows.exe
File opened (read-only)	\??\N:	chilledwindows.exe
File opened (read-only)	\??\P:	chilledwindows.exe
File opened (read-only)	\??\X:	chilledwindows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2780	chilledwindows.exe
Token: SeIncBasePriorityPrivilege	2780	chilledwindows.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2780	chilledwindows.exe

C:\Users\Admin\AppData\Local\Temp\chilledwindows.exe
"C:\Users\Admin\AppData\Local\Temp\chilledwindows.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
memory/2780-34-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-37-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-5-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/2780-4-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/2780-3-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-1-0x00000000009E0000-0x0000000000E44000-memory.dmp

Filesize
4.4MB

Download
memory/2780-18-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-31-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-17-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-16-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-15-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-14-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-11-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-32-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-33-0x0000000000990000-0x000000000099A000-memory.dmp

Filesize
40KB

Download
memory/2780-0-0x000007FEF5713000-0x000007FEF5714000-memory.dmp

Filesize
4KB

Download
memory/2780-2-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-38-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/2780-36-0x000007FEF5713000-0x000007FEF5714000-memory.dmp

Filesize
4KB

Download
memory/2780-40-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-39-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/2780-46-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-45-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-44-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-43-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-42-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-47-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2780-48-0x0000000000990000-0x000000000099A000-memory.dmp

Filesize
40KB

Download
memory/2780-49-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-50-0x0000000000990000-0x000000000099A000-memory.dmp

Filesize
40KB

Download
memory/2780-51-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-55-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-56-0x00000000005C0000-0x00000000005C2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing