Overview

overview

10

Static

static

3

FreeWill.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FreeWill.exe

  • Size

    7.1MB

  • Sample

    250402-vegkdazyft

  • MD5

    4318d93e4b3d3590f3b4c6c2cdd794f3

  • SHA1

    166c8a860d24671c6236944d32f5713a91449893

  • SHA256

    ebbb8769086dcf3f7bdaf9366cf6a5ac4c5ac981e4be3c69d08ce06fc80c2f28

  • SHA512

    291b8fa416147008a6c703d1cae0006f26b91b1561e6919208bdf329622c1f1137bd7dad3f4f2707c33241db93d243ded74317aa7cb1bccfdb6926057f5413da

  • SSDEEP

    196608:JOoKoTbXauPIo+8izlrAjDCbXauPIo+8iAo:XlT70Rcu7M

Score
10/10
credential_accessdefense_evasiondiscoveryevasionexploitpersistenceransomwarespywarestealertrojan

Malware Config

Targets

    • Target

      FreeWill.exe

    • Size

      7.1MB

    • MD5

      4318d93e4b3d3590f3b4c6c2cdd794f3

    • SHA1

      166c8a860d24671c6236944d32f5713a91449893

    • SHA256

      ebbb8769086dcf3f7bdaf9366cf6a5ac4c5ac981e4be3c69d08ce06fc80c2f28

    • SHA512

      291b8fa416147008a6c703d1cae0006f26b91b1561e6919208bdf329622c1f1137bd7dad3f4f2707c33241db93d243ded74317aa7cb1bccfdb6926057f5413da

    • SSDEEP

      196608:JOoKoTbXauPIo+8izlrAjDCbXauPIo+8iAo:XlT70Rcu7M

    Score
    10/10
    credential_accessdefense_evasiondiscoveryevasionexploitpersistenceransomwarespywarestealertrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • UAC bypass

      defense_evasiontrojan

    • Renames multiple (1003) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Disables RegEdit via registry modification

      defense_evasion

    • Disables Task Manager via registry modification

      defense_evasion

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      defense_evasiontrojan

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

File and Directory Permissions Modification

1
T1222

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Modify Registry

6
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Tasks