Analysis
-
max time kernel
149s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-10-2024 17:49
General
-
Target
Cina/Desktop (2)/KeyFreeze/KeyFreeze_x64.exe
-
Size
909KB
-
MD5
e15fba7ccf9b7a68ddb26338e313a1b9
-
SHA1
d4d3b5ebb77241510e3714adc742e0c34e4adb27
-
SHA256
fe43c86dd9fa0120f9d708900e3cc5a7f970c00d296191c6849e474b0f7c0292
-
SHA512
acdb455d135c2b59f66f323d66fdc4ba88acc978f78a2e6b64a2094e437de193756a6ab1d134e710816481b574d7d3f5787b7b2a5752399988a3b58011577ca8
-
SSDEEP
24576:Q2DW/xb/X2YIbLQsu3/PNLMQUHyMnhv4Fro0:Q2E7XSQsW/PNAQk7hAJ
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\KeyFreeze_x64.exe"C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\KeyFreeze_x64.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x45c 0x38c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
714B
MD50acb373753cb7ea22a4df998124ed0e1
SHA1e29282175a62d87f811951c9c488dd92a00a2b1a
SHA2561f9e894381ed60692f8ab5dfbdee12b08cba2d0587dfe55c8d12ca98e2e01ab0
SHA5129dc040c1230e58fa8b1e41f7a461b7f5d325f84c15a4fd05b4faf69deba1a87db9b42f921c498e7423d39bc53f84bf815ce205cd5ddfb86915851a24cf7e5eeb