FreemeMalware
- Freezing
Freezing crypto ransomware encrypts user data using AES, and then requires a ransom in # BTC to return the files. Original title: not indicated in the note. The file says: FreeMe.exeFrom MISP Galaxy
Last reported 3 days ago, by Qualys Threat Research1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1003.001LSASS Memory
“Figure 17: mimikatz sekurlsa::logonpasswords extracting a cached domain-administrator NTLM hash from LSASS memory under the SYSTEM shell.”
- T1003.002Security Account Manager
“During this stage, the exploit manipulates the process by redirecting Windows Defender’s file access to the system’s Security Account Manager (SAM) file, located at \??\<fullvsspath>\Windows\System32\Config\SAM on the previously captured shadow copy.”
- T1550.002Pass the Hash
“Still, in the lab, it reached NT AUTHORITY\SYSTEM, recovered domain-admin credentials from LSASS, and moved laterally via pass-the-hash.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
The Science of Exploitability: Decoding BlueHammer“Stage 3 — Freezing MsMpEng.exe via the CloudFilter Callback”
Indicators in its reports
named in the reports above- f4ffef4204880031…462fa5b6b4a0in 1 report
- 8846f7eaee8fb117ad06bdd830b7586cin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.