Analysis
- user interaction
yes - max time kernel
925s - max time network
1685s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
25/09/2026, 08:10
Static task
static1
Behavioral task
behavioral1
Sample
freefirewall-setup.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
17 signatures
900 seconds
General
- Target freefirewall-setup.exe
- Size 41.1MB
- Sample260925-j2wr2atake
- SHA256 b6f0d4dd3a673b1f9e0663228c94a684e1d5a76cf943d125d52ae1ad9ba798bd
- MD5 6d6145f263bc2b1a6b0694714a6bca26
- SHA1 7a0eb3d2e59dc7faaeec49a2609a9c74eecf3c02
- SHA512 7f41035272387ef61ca765f02b2ce79e836d9155fe610801d83861970ab8f35c39d226f18629d3bd723432bb6f8c167fb4db7422a597a6305e14c77b7f25ab06
- SSDEEP 786432:FQysFlIe6HbdsuQr5mUXhC/WH4CtNDBT05XbZAwcS4mt5:FgFvuYbXhB4OTsrZASB5
- TLSH T16A9733195A9802B9D061C2BEC4E75451F771F4490732CBEB4695FA2A2F339E8CB39372
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation FreeFirewall.exe Key value queried \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation FreeFirewall.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\48633F10F37C18120070A87C8AE6596D FirewallSvc64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 FirewallSvc64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 FirewallSvc64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1 FirewallSvc64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1 FirewallSvc64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48633F10F37C18120070A87C8AE6596D FirewallSvc64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Evorim\Free Firewall\locales\ja.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\nl.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\sw.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\resources.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\components\jsoncpp.license.txt freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\FirewallSvc64.exe freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\dhcpcsvc.dll freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\icudtl.dat freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\bn.pak freefirewall-setup.exe File opened for modification C:\Program Files\Evorim\Free Firewall\efwtc64.dll freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\components\chromium.html freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\ko.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\ta.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\te.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\snapshot_blob.bin freefirewall-setup.exe File opened for modification C:\Program Files\Evorim\Free Firewall\FirewallSvc32.exe freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\el.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\et.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\fr.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\ml.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\sr.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\zh-TW.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\v8_context_snapshot.bin freefirewall-setup.exe File opened for modification C:\Program Files\Evorim\Free Firewall\efwtc32.dll freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\license_de.txt freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\ms.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\resources\app.asar freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\components\zlib.license.txt freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\dns-cache.json.tmp FirewallSvc64.exe File opened for modification C:\Program Files\Evorim\Free Firewall\license_de.txt freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\ru.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\it.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\lt.pak freefirewall-setup.exe File opened for modification C:\Program Files\Evorim\Free Firewall\license_en.txt freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\alarm.mp3 freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\en-GB.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\fa.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\hr.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\pl.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\components\electron freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\ar.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\cs.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\gu.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\sl.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\th.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\components\lz4.license.txt freefirewall-setup.exe File opened for modification C:\Program Files\Evorim\Free Firewall\resources\app.asar freefirewall-setup.exe File opened for modification C:\Program Files\Evorim\Free Firewall\components\jsoncpp.license.txt freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\da.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\fil.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\hi.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\mr.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\pt-BR.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\sv.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\license_en.txt freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\en-US.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\id.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\nb.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\locales\vi.pak freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\resources\default_app.asar freefirewall-setup.exe File created C:\Program Files\Evorim\Free Firewall\uninstall.exe freefirewall-setup.exe File opened for modification C:\Program Files\Evorim\Free Firewall\components\license.thirdparty.html freefirewall-setup.exe File opened for modification C:\Program Files\Evorim\Free Firewall\components\lz4.license.txt freefirewall-setup.exe - Executes dropped EXE 12 IoCs
pid Process 5072 FirewallSvc64.exe 3044 FreeFirewall.exe 4996 FreeFirewall.exe 1280 FreeFirewall.exe 4224 FreeFirewall.exe 1484 FreeFirewall.exe 2956 FreeFirewall.exe 5088 FreeFirewall.exe 2168 FreeFirewall.exe 1316 FreeFirewall.exe 2672 FirewallSvc32.exe 2064 FirewallSvc64.exe - Loads dropped DLL 16 IoCs
pid Process 3044 FreeFirewall.exe 1280 FreeFirewall.exe 4224 FreeFirewall.exe 4996 FreeFirewall.exe 1484 FreeFirewall.exe 4224 FreeFirewall.exe 4996 FreeFirewall.exe 1484 FreeFirewall.exe 3044 FreeFirewall.exe 1280 FreeFirewall.exe 2956 FreeFirewall.exe 2956 FreeFirewall.exe 5088 FreeFirewall.exe 5088 FreeFirewall.exe 2168 FreeFirewall.exe 2168 FreeFirewall.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeFirewall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeFirewall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeFirewall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeFirewall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeFirewall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FirewallSvc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeFirewall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeFirewall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeFirewall.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000072aeb24c28fa2d9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380172aeb24c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e8410172aeb24c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f72aeb24c00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7172aeb24c00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" FirewallSvc64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing FirewallSvc64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ FirewallSvc64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" FirewallSvc64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" FirewallSvc64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" FirewallSvc64.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\ProgramData\Evorim\FreeFirewall\logs\app2026-09-25_08-50:16.173.log FreeFirewall.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe 3404 freefirewall-setup.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateGlobalPrivilege 3404 freefirewall-setup.exe Token: SeDebugPrivilege 3404 freefirewall-setup.exe Token: SeBackupPrivilege 4988 vssvc.exe Token: SeRestorePrivilege 4988 vssvc.exe Token: SeAuditPrivilege 4988 vssvc.exe Token: SeBackupPrivilege 3404 freefirewall-setup.exe Token: SeRestorePrivilege 3404 freefirewall-setup.exe Token: SeBackupPrivilege 4460 srtasks.exe Token: SeRestorePrivilege 4460 srtasks.exe Token: SeSecurityPrivilege 4460 srtasks.exe Token: SeTakeOwnershipPrivilege 4460 srtasks.exe Token: SeBackupPrivilege 4460 srtasks.exe Token: SeRestorePrivilege 4460 srtasks.exe Token: SeSecurityPrivilege 4460 srtasks.exe Token: SeTakeOwnershipPrivilege 4460 srtasks.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeTakeOwnershipPrivilege 2064 FirewallSvc64.exe Token: SeTakeOwnershipPrivilege 2064 FirewallSvc64.exe Token: SeTakeOwnershipPrivilege 2064 FirewallSvc64.exe Token: SeTakeOwnershipPrivilege 2064 FirewallSvc64.exe Token: SeTakeOwnershipPrivilege 2064 FirewallSvc64.exe Token: SeTakeOwnershipPrivilege 2064 FirewallSvc64.exe Token: SeTakeOwnershipPrivilege 2064 FirewallSvc64.exe Token: SeTakeOwnershipPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe Token: SeDebugPrivilege 2064 FirewallSvc64.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 3404 freefirewall-setup.exe 4224 FreeFirewall.exe 4224 FreeFirewall.exe 4224 FreeFirewall.exe 4224 FreeFirewall.exe 4224 FreeFirewall.exe - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 4224 FreeFirewall.exe 4224 FreeFirewall.exe 4224 FreeFirewall.exe 4224 FreeFirewall.exe 4224 FreeFirewall.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4224 wrote to memory of 2956 4224 FreeFirewall.exe 112 PID 4224 wrote to memory of 5088 4224 FreeFirewall.exe 113 PID 4224 wrote to memory of 2168 4224 FreeFirewall.exe 114 PID 1484 wrote to memory of 1316 1484 FreeFirewall.exe 115 PID 2168 wrote to memory of 2672 2168 FreeFirewall.exe 117 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\freefirewall-setup.exe"C:\Users\Admin\AppData\Local\Temp\freefirewall-setup.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3404
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
C:\Program Files\Evorim\Free Firewall\FirewallSvc64.exe"C:\Program Files\Evorim\Free Firewall\FirewallSvc64.exe"1⤵
- Executes dropped EXE
PID:5072
-
C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3044
-
C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe" --type=gpu-process --field-trial-handle=2000,15960634056296280275,17054119695971889618,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --gpu-preferences=IAAAAAAAAADgAAAgAAAAAAAAYAAAAAAACAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --use-gl=swiftshader-webgl --service-request-channel-token=17305583646484101754 --mojo-platform-channel-handle=2008 --ignored=" --type=renderer " /prefetch:22⤵
- Executes dropped EXE
PID:1316
-
-
C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1280
-
C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4996
-
C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe" --type=gpu-process --field-trial-handle=2012,18434591582570909150,14280701418911053630,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --gpu-preferences=IAAAAAAAAADgAAAgAAAAAAAAYAAAAAAACAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --use-gl=swiftshader-webgl --service-request-channel-token=14015418087416267953 --mojo-platform-channel-handle=2020 --ignored=" --type=renderer " /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2956
-
-
C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe" --type=renderer --field-trial-handle=2012,18434591582570909150,14280701418911053630,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Program Files\Evorim\Free Firewall\resources\app.asar" --no-sandbox --no-zygote --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=4459864735303576129 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2480 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5088
-
-
C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe"C:\Program Files\Evorim\Free Firewall\FreeFirewall.exe" --type=renderer --field-trial-handle=2012,18434591582570909150,14280701418911053630,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Program Files\Evorim\Free Firewall\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=1131054507856163700 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files\Evorim\Free Firewall\FirewallSvc32.exe"C:\Program Files\Evorim\Free Firewall\FirewallSvc32.exe" /start3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672
-
-
-
C:\Program Files\Evorim\Free Firewall\FirewallSvc64.exe"C:\Program Files\Evorim\Free Firewall\FirewallSvc64.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2064
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Evorim\Free Firewall\2.6.2\uninstall.exe
- Size 1.1MB
- SHA256 f5ee1fa5e76f195331e3e8dcdb8454f26e7e393444ae53e8d9d41e5021a6b75f
- MD5 3b93c86a5d37e057278cd33b9537b2be
- SHA1 fd66002ec9f02bc0fb51c3dec8956cab4593e79d
- SHA512 1904f5acbdf57f95bd8f0a8fb8805c30f657c0bee29f85b2efdebd7a8699db8588ce49fad7bb1ea13e6782a7dcb778ada3c13dd2bff3a58742cd7139e3e71aa5
- SSDEEP 24576:9Rl9zitY7Bcy3njid9sil45lzs2Yi/tEpV21fBRQmsQplG5uYafX:Xl5itY7BcyT8b4rzs231fUQis
- TLSH T1FA457C186E9842B5D562C279C5F34552F7B1F4490B31DBEB01A2E62D3F239E48B3A372
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\FirewallSvc32.exe
- Size 911KB
- SHA256 08152d987a8332fa4ef74f658660fdb7e2c84443c07f0efb6a06845fb410f53d
- MD5 3c8ae5a0890393b360b9dac0678a97de
- SHA1 97b995e858de414e582d8e10aa0ce839fd16012d
- SHA512 c8636eadc5724c17bbc253978e2934e62a1e46d47305caff43c5c6a7d0889841f0ee59222358d746aae85a6098498dcf037958bfaed6b5259bf60aa7d85bccde
- SSDEEP 24576:LeC1jB2nHgx43dCzZEI5h9v6FKIt9GAN1wfVLjDqUFF7bTwD:V1+Ax4tqZX5h9v6F4AIfBeUFF7b0
- TLSH T154159F217A85C136D6B1007249ACBAAF543DF5320B742ADB93D81F6C0D6C6D21E36F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\FirewallSvc64.exe
- Size 1.1MB
- SHA256 abe6c01670c2f86540a05f5e22ceb77e710322579b470b85eb8befce7fa6a3b3
- MD5 9aed6883896976510ae85096bd493e87
- SHA1 c3d5096ae0da36ca7c167b4b580562accc0a3d17
- SHA512 939f245e7a831a80a3c1ec03c5e8cf441d42b38687c227f52b8a7fa0a0fd3d601448d33c057333070a3f52387178debe26193f860e4365d3ad3092be76f83ec6
- SSDEEP 24576:H0JXOXyl15tISkFn7zFX/3feIBkjlMEM/K24fBGLjD+pL:UJXOCrgFnvFveIBT/K24f4y
- TLSH T169357D156E5840F5C476C079C9B68A52F7B1F0490B31DBEB42A2E76E3F238E45E3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\dhcpcsvc.dll
- Size 515KB
- SHA256 455821e3608e8cee7c226a184c15827ac4234750c7dc4e925051360ac1dd33c4
- MD5 cd9ecd1a70b34894763e7046f13cb1cd
- SHA1 6d732bc667a96452e342310d218b201db7bb265a
- SHA512 219b28ac0b35a2f129f8352c4dac8944662c98ebda181ad638dc7aaacf8b533c57af4c49c09da57ea0cfb2aeee195b07779947152fa59bf3dc28f9603c8e8807
- SSDEEP 12288:PnzZRLoqEOOs7r62n57+AHQ1gaS1hSTNfxthAgQ8mK2:Pzwpi7b7rN1EhigQLK2
- TLSH T1FFB48D203542C137D6BE05B0597CEA1F106C79680BB86DEB93D86E3A5EBA1C31B31E57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\dns-cache.json.tmp
- Size 14KB
- SHA256 571bc144fa7224917eae3c3f055c553d8802ec163e0d50c52d83b4c1b3c0a23d
- MD5 4cf8e43c61288d5e0904fd72e06fe3f9
- SHA1 68e42e7c8185d8f1b0a0f1af875fc5428e80c231
- SHA512 7180cf9818f9c76a8ca4ad26229839b3a566de31a0ab2d3df17caad6c23806ca0799c6d647c2264249cf9d115bf9c78a38ec544ed7ffeebd6d45ecb57552692b
- SSDEEP 96:hDRDUiBMxDEsthiPWvrPhFt+RjYCk7tazpNHEtJKciJSyn2fc6MJXEEbMqDbcLND:TUuuhAOrPhFY1PQazrWJKc7Z53zpr
- TLSH T16362B304C1613D410E84E3BC6A5D125016EA9F8F4E59BD80F7DE53CE2F6D0AEAEB216D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\ffmpeg.dll
- Size 1.9MB
- SHA256 80f907869968478e2312d2c7a8eb709ca5f32942b9f41ac4fd56128bf89368d5
- MD5 e4ae18f4549d0b0b00ae98bfaef14bd9
- SHA1 eca809609768a449b0bcb283cbc494deb0e1558c
- SHA512 8284b42281b5278e712155378e09cc78b37ab4f34a113d727d0d199051c62c66e1d7bd92884d00829447ed9e829194d8e9d2d004f60395528492983694f35fb8
- SSDEEP 49152:7AP8BDZMYGwx3hgqVipNvvrcYnbjhZGo:7EoDZ9G+SqEplvrcYn5ZGo
- TLSH T15295D081B9A29572D04A1571012EF37FBF3A1B1A5606CA97C7D8AD34FFF27C1024939A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\icudtl.dat
- Size 9.9MB
- SHA256 8c2df1f6e2ea8df2e5fc5e4b016b0cddd64a7ce6985189ca45be3c0ec99472c2
- MD5 4c8a9e9c260dc5a6fee2a3c37520f5bf
- SHA1 5a9883dbeb5314a98e7ab5326f9868e78ba387dc
- SHA512 c0da0b08a0b0eaa898f96c6e6c6fb65bc7f773f5814fc0d612a40e2fcaea4049c67cd2812716a564dbc16d609677ee62eaa9f9747d2a7bc5c9bce43cd2208aa7
- SSDEEP 196608:TzwSv9AA0fJlt5liXUxR0rHc93WhlA6tXQJGX2EXmJNMQ:4Kl0fJlliXUxR0rHc93WhlA6tXQJGX2H
- TLSH T1F3A61647B2EB4EC2F9FB6E70D9F462635526BC456E71815A01002F3B1C777E08762BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\locales\en-US.pak
- Size 69KB
- SHA256 12e4fd083a49e038578ea2993e6c88239083c8d098231527eee861299a4e1c99
- MD5 15e8556f737d17bd4d645513ee190990
- SHA1 a24844d68fe3e9f4c57d14e6091a06f5e6b5f327
- SHA512 4e5c423b2b14def0e6ebb9c7844bdc050198064c9db69d3a880c1444314211995b1f0dec6fcbb12c6d5e59f690c3ffc893c2265bf7168d1ecbc8d83dfa5e1465
- SSDEEP 1536:ffPzC70fzEphskDFVtrhA5sBkSOqJedMKrDhw5R8fDggleLBwI:fzxzEphJ1BiRw56ggle1wI
- TLSH T1A6634E1BE3C4323A09B2436239067366A715D0AAA36115957CBCE16C3377FA4C3776EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\natives_blob.bin
- Size 81KB
- SHA256 354ff502a0e1ed73df4e5c7b52970356b04777461f6e169f72a8567ab5f4c317
- MD5 f8ac49858ca8739658ff44c296f8aba6
- SHA1 427b4da3bd619d85381c36d61daf2ce392e07909
- SHA512 52e875aedbdc5dad21e01a42e333ff5aefed9ae6468a00e80f2bb373b871196f9a82bc3f43a6c72c9dd6be0e4fbc591d3ede41ca47b23a806b788db5aa9bf313
- SSDEEP 1536:+bz4Oif2sMnL8gDpKD0rrr/4or06mGsY3csV3/EBSee0fHVvJ4TGD3zT+2/ei7gP:+bz4Oif2sMHEBSx0fHVvOT6jTVeikwVK
- TLSH T1758366677ED67AB746A5B5F6E38F971EC2B8CD23663958B29408CC84189304C847FF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\resources.pak
- Size 8.1MB
- SHA256 a435fa0e07a9124b0d457811de5e2245aeb225ad55ab99186cb665c6ec6e30ef
- MD5 978e8122033961585e14c65949d15e11
- SHA1 3097d04bbcdfc6ff9e0bb52c2d38f6395e4bb631
- SHA512 5f6706116b7eaec70213f7343cac44eea2dc735de6262524b5508a659b150d8a5ad7f449fec984b45a2e5c170e1cb4feb927a19530c94841f3e6429a2fcaa1c0
- SSDEEP 49152:ArGmCJPhcWHkyxp731tB86deokVpGrzJ1SG1hdAKp3aVo2limCRp6GZLFPZAUkAs:XJ7bh1tB82eKR1h7cocimCRsGzGw/U
- TLSH T18E867D573254003A82EA86BF74BA1603BB376046F45490ACF96CCDCD1BEED429276B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\resources\app.asar
- Size 8.3MB
- SHA256 c6d5c67f5bd265b78df3b1007be1f6642b75eea4da5120c9e161e0c9bb3513e4
- MD5 58bdedd97138b2ebfbf1ad41422bdde6
- SHA1 dae09d2d202aceee5b8d5a8f4228552df3050a70
- SHA512 8f7628151a33454f5010a310ff36713b025c8bfa95009df8278d3ec1a76aa9c66a3aef8813d2cd069889e61be94aa043f1a91e0661f60968b2e832b571e6889d
- SSDEEP 98304:L4MLYRIMG+9Nd67avbDvYIijBU85ztrT45EsdguumSm9Pr:LlEyiNk72nvcjBUqtT4Rguumd9z
- TLSH T11F968D1CB704726EC29783B4582B2899B33FA56D71065690B82EF7C61B6644CC1FBF6C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\resources\electron.asar
- Size 347KB
- SHA256 5d51a50a4de25c6f30c31aaf46e53033e803667cf0ca6dc0b783b2528eb95155
- MD5 a16e13b623abf13e978e7809c98b96e2
- SHA1 e0098ac2d742fe135ac96b0b5e00e19f4d43b119
- SHA512 11a8897d69c5d10259409f8836ce675459aa713cade166069e1a6423927d9fce3fb96616603d955cbf018ab998bab50799ef514afd8c683c0fc7d8b277ea21a6
- SSDEEP 6144:tCE/Hxf2AuM8QyGOv3o29ngGgNJZBz5YZg6EnXNBZjO:dOAuMYgNJZ3YZPEB6
- TLSH T15C74C65A25A962354672B3FEDB036506FA3A4133600981607DAC87E42FF2464D2F6FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Evorim\Free Firewall\v8_context_snapshot.bin
- Size 596KB
- SHA256 71a3723be4d336849ad93174116a1d8566a07fd3fe0a3bed781ea386589fb441
- MD5 4453a66a6e810591ea9f5122514d7cb7
- SHA1 d005ab8967c98338f381af090f68206c31dfdeef
- SHA512 e88fc5a4adfe34ac81668df1703b675a2ee36f0e0bc583b367be6a9c009a79b80b223432dfdc52a2dc76eaefceb577e8f0bf9a9722a08b61f268c994f3bfe928
- SSDEEP 6144:UCGJxnU5gBt8eFHeyTvAqXw30e/cxh5TRSHXKf19Nh1uyQnwWzy:UTJFO/5e/NHuyAwW2
- TLSH T139D4FA619E60D9C3F71D4C7566E28AA23F70A95CBE03872F1E0C5D2E396BBE40C29D51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Evorim\FreeFirewall\app-icons\500950046863670.png
- Size 533B
- SHA256 6c2431538f213ad2c95d28df6446f9a42c785d8241e60bf799832d6b827eea84
- MD5 4762fbae75b467040222b16a94616ac5
- SHA1 5684ad88f049145a099a546d9131264f233c354c
- SHA512 369dc792c430c67b2a6017a0c7cf8b8286d00459f4e9896097c92f3f55a33f03c3d408321972eb56b37d1b0584427d0bbd7ad893b016664dd0bb7b6e98b33b77
- TLSH T143F075C2E2DA6CF5F34D64A3F0E36A70700724A70007A01CECBD84740E5FA444822211
- MD5 SHA1 SHA512 TLSH
