Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/05/2026, 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
freefn.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
freefn.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target freefn.exe
- Size 313KB
- Sample260530-gvxpmsgz9q
- SHA256 85818c88e44e2dfbdf364912b79e0278c37bbf547c0765478f086e7443fb700a
- MD5 2065e0a8daf4f1924de401c871cf23a3
- SHA1 319d4921b4b1391790bf497353df7388e316a3c4
- SHA512 20aafa9ee18e6176c6f37911c2c2a7808245a9a661aa32ecd40965d2f5b0491e218b2d5e4cb0099338d791503098830a5ec015becd984dbe0f8c55fbf5d868c1
- SSDEEP 6144:elePy+ProReRl+n7JwXu8RTsg1FZBzM923wRdrXcGHvlJ1+bcltnl:hPdcUh3zM923+lJDtnl
- TLSH T17F648E86F1A490E9E097507992ABF70FE9353819032056CB73F849583BE37F07DBA652
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 3 2980 freefn.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\JUoIFCcaTcSvdBlApfYW\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\JUoIFCcaTcSvdBlApfYW" MAPPER.exe - Executes dropped EXE 1 IoCs
pid Process 1588 MAPPER.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 3 raw.githubusercontent.com - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1312 freefn.exe 1312 freefn.exe 1588 MAPPER.exe 1588 MAPPER.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe 2980 freefn.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1588 MAPPER.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1588 MAPPER.exe Token: SeLoadDriverPrivilege 1588 MAPPER.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1312 wrote to memory of 2980 1312 freefn.exe 90 PID 2980 wrote to memory of 1588 2980 freefn.exe 105 PID 2980 wrote to memory of 2800 2980 freefn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\freefn.exe"C:\Users\Admin\AppData\Local\Temp\freefn.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\freefn.exe"C:\Users\Admin\AppData\Local\Temp\freefn.exe"2⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\MAPPER.exe"C:\Users\Admin\AppData\Local\Temp\MAPPER.exe" "C:\Users\Admin\AppData\Local\Temp\premium.sys"3⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2800
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MAPPER.exe
- Size 141KB
- SHA256 bdf853881bf56cac5d25fb6c2d1b0ff02fab450d57a66d39d4770c2117e7b9ae
- MD5 4029e51efe7e8cfa57c108acf7d99826
- SHA1 ac3fa8db792c5a05dae18c7adc6f236ef9730176
- SHA512 82dfb08fbb31e26481b3c8c5aee7b3eb8b1d274314401e75fd0d3e56589ca0ec2ad703e54147bb25206d2c239e4de6c07b49eb3c52d16f48a2bdae380d904050
- SSDEEP 3072:5+dljD5C2nYMgLakwvmJTQSaMm5/61JbJ29:5+DjVCKkXWluz2
- TLSH T1B7E31857A3E500A8E5B7E6BC9AB20612F7B278550774D3CF1390807D0F627D1AE3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH