Overview
overview
10Static
static
10Cina/Deskt...ize.sh
windows7-x64
3Cina/Deskt...ize.sh
windows10-2004-x64
3Cina/Deskt...GL.dll
windows7-x64
3Cina/Deskt...GL.dll
windows10-2004-x64
3Cina/Deskt...v2.dll
windows7-x64
3Cina/Deskt...v2.dll
windows10-2004-x64
3Cina/Deskt...er.exe
windows7-x64
8Cina/Deskt...er.exe
windows10-2004-x64
8Cina/Deskt...er.dll
windows7-x64
3Cina/Deskt...er.dll
windows10-2004-x64
3Cina/Deskt...-1.dll
windows7-x64
3Cina/Deskt...-1.dll
windows10-2004-x64
3Cina/Deskt...er.exe
windows7-x64
1Cina/Deskt...er.exe
windows10-2004-x64
1Cina/Deskt...ze.exe
windows7-x64
3Cina/Deskt...ze.exe
windows10-2004-x64
3Cina/Deskt...64.exe
windows7-x64
3Cina/Deskt...64.exe
windows10-2004-x64
3Cina/Deskt....0.exe
windows7-x64
1Cina/Deskt....0.exe
windows10-2004-x64
1Cina/Deskt...st.exe
windows7-x64
1Cina/Deskt...st.exe
windows10-2004-x64
1Cina/Deskt.../d.vbs
windows7-x64
8Cina/Deskt.../d.vbs
windows10-2004-x64
8Cina/Deskt...ty.vbs
windows7-x64
1Cina/Deskt...ty.vbs
windows10-2004-x64
1Cina/Deskt.../e.vbs
windows7-x64
1Cina/Deskt.../e.vbs
windows10-2004-x64
1Cina/Deskt...ty.vbs
windows7-x64
8Cina/Deskt...ty.vbs
windows10-2004-x64
8Cina/Deskt...3r.bat
windows7-x64
1Cina/Deskt...3r.bat
windows10-2004-x64
6Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2024 17:49
Behavioral task
behavioral1
Sample
Cina/Desktop (2)/IPRoyalPawns/resources/app/resources/tray-icon/resize.sh
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Cina/Desktop (2)/IPRoyalPawns/resources/app/resources/tray-icon/resize.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Cina/Desktop (2)/IPRoyalPawns/swiftshader/libEGL.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Cina/Desktop (2)/IPRoyalPawns/swiftshader/libEGL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Cina/Desktop (2)/IPRoyalPawns/swiftshader/libGLESv2.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Cina/Desktop (2)/IPRoyalPawns/swiftshader/libGLESv2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Cina/Desktop (2)/IPRoyalPawns/uninstaller.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Cina/Desktop (2)/IPRoyalPawns/uninstaller.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Cina/Desktop (2)/IPRoyalPawns/vk_swiftshader.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
Cina/Desktop (2)/IPRoyalPawns/vk_swiftshader.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Cina/Desktop (2)/IPRoyalPawns/vulkan-1.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Cina/Desktop (2)/IPRoyalPawns/vulkan-1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Cina/Desktop (2)/Installer.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
Cina/Desktop (2)/Installer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Cina/Desktop (2)/KeyFreeze/KeyFreeze.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Cina/Desktop (2)/KeyFreeze/KeyFreeze.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Cina/Desktop (2)/KeyFreeze/KeyFreeze_x64.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Cina/Desktop (2)/KeyFreeze/KeyFreeze_x64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/Windows Lock 2.0.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/Windows Lock 2.0.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/Windows Lock 2.0.vshost.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/Windows Lock 2.0.vshost.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/d.vbs
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/d.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/disablesecurity.vbs
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/disablesecurity.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/e.vbs
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/e.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/extra security.vbs
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
Cina/Desktop (2)/KeyFreeze/Lock2/extra security.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Cina/Desktop (2)/Log L0ck3r.bat
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
Cina/Desktop (2)/Log L0ck3r.bat
Resource
win10v2004-20241007-en
General
-
Target
Cina/Desktop (2)/KeyFreeze/KeyFreeze.exe
-
Size
761KB
-
MD5
d86311df3410d801f595dfa0956cf47a
-
SHA1
86441eb3e00f2f67984492f633941439e2fb8299
-
SHA256
d85eaae00a3360e1d8527a93e6d810fff749015998c21a7b7e9a4576bff17345
-
SHA512
2cefa0ecbec97bcdfdd8d5635675363492c97d6ce11f9a55a6f405e60fc9d962e78800d051679b30ca2addb85b6c16950553d54aebefb9f6d898c1966094d786
-
SSDEEP
12288:maWzgMg7v3qnCikErQohh0F4DCJ8lny0QiFDgKD5nIJ4FxhTZqrLmo:haHMv6CwrjDny0Qiht5w4HhkPmo
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
KeyFreeze.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KeyFreeze.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
KeyFreeze_x64.exepid process 4284 KeyFreeze_x64.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 4544 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4544 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
KeyFreeze_x64.exepid process 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
KeyFreeze_x64.exepid process 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
KeyFreeze_x64.exepid process 4284 KeyFreeze_x64.exe 4284 KeyFreeze_x64.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
KeyFreeze.exedescription pid process target process PID 2096 wrote to memory of 4284 2096 KeyFreeze.exe KeyFreeze_x64.exe PID 2096 wrote to memory of 4284 2096 KeyFreeze.exe KeyFreeze_x64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\KeyFreeze.exe"C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\KeyFreeze.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\KeyFreeze_x64.exe"C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\KeyFreeze_x64.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4284
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3c4 0x4f81⤵
- Suspicious use of AdjustPrivilegeToken
PID:4544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
714B
MD50acb373753cb7ea22a4df998124ed0e1
SHA1e29282175a62d87f811951c9c488dd92a00a2b1a
SHA2561f9e894381ed60692f8ab5dfbdee12b08cba2d0587dfe55c8d12ca98e2e01ab0
SHA5129dc040c1230e58fa8b1e41f7a461b7f5d325f84c15a4fd05b4faf69deba1a87db9b42f921c498e7423d39bc53f84bf815ce205cd5ddfb86915851a24cf7e5eeb