Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-10-2024 17:49
General
-
Target
Cina/Desktop (2)/KeyFreeze/KeyFreeze.exe
-
Size
761KB
-
MD5
d86311df3410d801f595dfa0956cf47a
-
SHA1
86441eb3e00f2f67984492f633941439e2fb8299
-
SHA256
d85eaae00a3360e1d8527a93e6d810fff749015998c21a7b7e9a4576bff17345
-
SHA512
2cefa0ecbec97bcdfdd8d5635675363492c97d6ce11f9a55a6f405e60fc9d962e78800d051679b30ca2addb85b6c16950553d54aebefb9f6d898c1966094d786
-
SSDEEP
12288:maWzgMg7v3qnCikErQohh0F4DCJ8lny0QiFDgKD5nIJ4FxhTZqrLmo:haHMv6CwrjDny0Qiht5w4HhkPmo
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\KeyFreeze.exe"C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\KeyFreeze.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\KeyFreeze_x64.exe"C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\KeyFreeze_x64.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
714B
MD50acb373753cb7ea22a4df998124ed0e1
SHA1e29282175a62d87f811951c9c488dd92a00a2b1a
SHA2561f9e894381ed60692f8ab5dfbdee12b08cba2d0587dfe55c8d12ca98e2e01ab0
SHA5129dc040c1230e58fa8b1e41f7a461b7f5d325f84c15a4fd05b4faf69deba1a87db9b42f921c498e7423d39bc53f84bf815ce205cd5ddfb86915851a24cf7e5eeb