File name:

Faronics_DFS.zip

Full analysis: https://app.any.run/tasks/8e7df3ce-6597-43f7-8aaf-7363df77c518
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 31, 2024, 22:20:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

68DAE0B63E600D35F45979378C83343C

SHA1:

C289C2F6A6E42007F26262E9E6568D4CEE5CC655

SHA256:

A18B25E22C36A51E84745023198A6B98E363CC72A1DA8FFEE89CB61D44E876C0

SSDEEP:

98304:c+OmPBb1CJY+Id80IjLleiaaNU/dK9iWXUesrNJU47cY1ioV2R0nwLmx3h906+mJ:+d/YDOoFl04gBuAIwUXm0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1380)
      • DFStd.exe (PID: 2796)
      • DeepFreeze_C.exe (PID: 3644)

    • Creates a writable file in the system directory

      • DeepFreeze_C.exe (PID: 3644)
      • mofcomp.exe (PID: 3880)
      • mofcomp.exe (PID: 2136)
      • mofcomp.exe (PID: 1812)

    • Registers / Runs the DLL via REGSVR32.EXE

      • DeepFreeze_C.exe (PID: 3644)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • DFStd.exe (PID: 2796)
      • DeepFreeze_C.exe (PID: 3644)

    • Drops a system driver (possible attempt to evade defenses)

      • DeepFreeze_C.exe (PID: 3644)

    • Creates files in the driver directory

      • DeepFreeze_C.exe (PID: 3644)

    • Starts CMD.EXE for commands execution

      • DeepFreeze_C.exe (PID: 3644)

    • Reads the Internet Settings

      • sipnotify.exe (PID: 2380)
      • sipnotify.exe (PID: 2268)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 2368)
      • sipnotify.exe (PID: 2380)
      • sipnotify.exe (PID: 2268)
      • ctfmon.exe (PID: 2256)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 2380)
      • sipnotify.exe (PID: 2268)

  • INFO

    • Manual execution by a user

      • DFStd.exe (PID: 1072)
      • DFStd.exe (PID: 2796)
      • IMEKLMG.EXE (PID: 2520)
      • wmpnscfg.exe (PID: 2760)
      • wmpnscfg.exe (PID: 2780)
      • IMEKLMG.EXE (PID: 2512)
      • IMEKLMG.EXE (PID: 2408)
      • IMEKLMG.EXE (PID: 2392)
      • wmpnscfg.exe (PID: 2644)
      • wmpnscfg.exe (PID: 2664)

    • Reads the computer name

      • DFStd.exe (PID: 2796)
      • DeepFreeze_C.exe (PID: 3644)
      • DFServ.exe (PID: 292)
      • IMEKLMG.EXE (PID: 2520)
      • wmpnscfg.exe (PID: 2780)
      • FrzState2k.exe (PID: 2888)
      • IMEKLMG.EXE (PID: 2512)
      • wmpnscfg.exe (PID: 2760)
      • IMEKLMG.EXE (PID: 2392)
      • IMEKLMG.EXE (PID: 2408)
      • DFLocker.exe (PID: 904)
      • wmpnscfg.exe (PID: 2664)
      • FrzState2k.exe (PID: 2772)
      • wmpnscfg.exe (PID: 2644)

    • Checks supported languages

      • DFStd.exe (PID: 2796)
      • DeepFreeze_C.exe (PID: 3644)
      • ReAgentc.exe (PID: 1196)
      • DFServ.exe (PID: 292)
      • IMEKLMG.EXE (PID: 2520)
      • wmpnscfg.exe (PID: 2760)
      • wmpnscfg.exe (PID: 2780)
      • FrzState2k.exe (PID: 2888)
      • IMEKLMG.EXE (PID: 2512)
      • ReAgentc.exe (PID: 1184)
      • IMEKLMG.EXE (PID: 2392)
      • IMEKLMG.EXE (PID: 2408)
      • DFLocker.exe (PID: 904)
      • wmpnscfg.exe (PID: 2644)
      • wmpnscfg.exe (PID: 2664)
      • FrzState2k.exe (PID: 2772)

    • Reads the machine GUID from the registry

      • DFStd.exe (PID: 2796)
      • DeepFreeze_C.exe (PID: 3644)
      • FrzState2k.exe (PID: 2888)
      • FrzState2k.exe (PID: 2772)

    • Create files in a temporary directory

      • DFStd.exe (PID: 2796)
      • DeepFreeze_C.exe (PID: 3644)
      • mofcomp.exe (PID: 3880)
      • mofcomp.exe (PID: 2136)
      • mofcomp.exe (PID: 1812)
      • FrzState2k.exe (PID: 2888)
      • FrzState2k.exe (PID: 2772)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1380)

    • Creates files in the program directory

      • DFStd.exe (PID: 2796)
      • DeepFreeze_C.exe (PID: 3644)
      • FrzState2k.exe (PID: 2888)
      • FrzState2k.exe (PID: 2772)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 2380)
      • sipnotify.exe (PID: 2268)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 2512)
      • IMEKLMG.EXE (PID: 2520)
      • IMEKLMG.EXE (PID: 2408)
      • IMEKLMG.EXE (PID: 2392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:08:24 13:38:04
ZipCRC: 0xf799afb8
ZipCompressedSize: 12229092
ZipUncompressedSize: 17961904
ZipFileName: Faronics_DFS/DFStd.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
32
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe dfstd.exe no specs dfstd.exe deepfreeze_c.exe cmd.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs regsvr32.exe no specs regsvr32.exe no specs dfserv.exe no specs regsvr32.exe no specs regsvr32.exe no specs reagentc.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs frzstate2k.exe dflocker.exe no specs regsvr32.exe no specs regsvr32.exe no specs reagentc.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs frzstate2k.exe

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe" /INSTALL /SILENTC:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe—DeepFreeze_C.exe
User:
admin
Company:
Faronics Corporation
Integrity Level:
HIGH
Description:
Deep Freeze Service
Exit code:
0
Version:
8,71,20,5734
Modules
Images
c:\program files\faronics\deep freeze\install c-0\dfserv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
904"C:\Windows\TEMP\DFLocker.exe"C:\Windows\Temp\DFLocker.exe—DFServ.exe
User:
SYSTEM
Company:
Faronics Corporation
Integrity Level:
SYSTEM
Description:
Deep Freeze Show Message Helper
Exit code:
0
Version:
8,71,20,5734
Modules
Images
c:\windows\temp\dflocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
944C:\Windows\system32\regsvr32.exe /s /u "C:\Program Files\Faronics\Deep Freeze\Install C-0\DeepFreezeAdapter.dll"C:\Windows\System32\regsvr32.exe—DFServ.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
948C:\Windows\system32\regsvr32.exe /s /u "C:\Program Files\Faronics\Deep Freeze\Install C-0\DeepFreezeAdapter.dll"C:\Windows\System32\regsvr32.exe—DFServ.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1072"C:\Users\admin\Desktop\Faronics_DFS\DFStd.exe" C:\Users\admin\Desktop\Faronics_DFS\DFStd.exe—explorer.exe
User:
admin
Company:
Faronics Corporation
Integrity Level:
MEDIUM
Description:
Install program for Deep Freeze Standard
Exit code:
3221226540
Version:
8,71,20,5734
Modules
Images
c:\users\admin\desktop\faronics_dfs\dfstd.exe
c:\windows\system32\ntdll.dll
1156C:\Windows\system32\regsvr32.exe /s "C:\Program Files\Faronics\Deep Freeze\Install C-0\DeepFreezeAdapter.dll"C:\Windows\System32\regsvr32.exe—DFServ.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1160C:\Windows\system32\regsvr32.exe /s "C:\Program Files\Faronics\Deep Freeze\Install C-0\DeepFreezeAdapter.dll"C:\Windows\System32\regsvr32.exe—DFServ.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1184C:\WINDOWS\SYSTEM32\ReagentC.exe /disableC:\Windows\System32\ReAgentc.exe—DFServ.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\system32\reagentc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1196C:\Windows\system32\regsvr32.exe /s /u "C:\Program Files\Faronics\Deep Freeze\Install C-0\DeepFreezeAdapter.dll"C:\Windows\System32\regsvr32.exe—DeepFreeze_C.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1196C:\WINDOWS\SYSTEM32\ReagentC.exe /disableC:\Windows\System32\ReAgentc.exe—DFServ.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\system32\reagentc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
14 727
Read events
14 529
Write events
122
Delete events
76

Modification events

(PID) Process:(1380) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
15
Suspicious files
21
Text files
27
Unknown types
5

Dropped files

PID
Process
Filename
Type
1380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1380.13847\Faronics_DFS\Documentation\English\Deep Freeze Standard User Guide.urlurl
MD5:31190415F7A9D269A21678247E007F88
SHA256:AE6AF8377B14D1744DF3ABF3AED7A427D69E5479C09D98968164C3869FE21F9B
1380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1380.13847\Faronics_DFS\Documentation\Espanol\Deep Freeze Standard Guiüa de usuario.urlurl
MD5:632D44C61955F3DB1680529FDBF077B4
SHA256:79BABE9CD9DAF02AE2BED1A6A4196EEBB49FE4748845B00674D18A32DF3CBE25
1380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1380.13847\Faronics_DFS\Documentation\Espanol\Data Igloo Guiüa de usuario.urlurl
MD5:5CBE2AD2988D24218BBD497AEE44716C
SHA256:AC61831B842BB17C40DC047A32CD42253467AD66CC08AEDFA16606225CA42BA2
1380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1380.13847\Faronics_DFS\Documentation\Deutsch\Data Igloo Benutzerhandbuch.urlurl
MD5:A120FBA0F516B4652BB7F57DC9EE8F39
SHA256:CAD41215863779C97D96C3D209F7AB5C82BF5F92323F68122BF3B405CAC22A77
1380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1380.13847\Faronics_DFS\Documentation\English\Data Igloo User Guide.urlurl
MD5:5954FE160C4533AB2113261D327F2C5F
SHA256:A72F11F35CBEEC043F08468CD4D8E8605FB0907A85D3D36ABF65F39A5481EEEB
1380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1380.13847\Faronics_DFS\Documentation\Japanese\Deep Freeze Standard User Guide.urlurl
MD5:F143037F4CDAD5E228840F4C855D8DA6
SHA256:4BAA1E3D54352386C5B9D62DEFA3989D7CB46D290BACD8E0FC3D4AEC51B823BE
1380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1380.13847\Faronics_DFS\Documentation\Japanese\Data Igloo User Guide.urlurl
MD5:93DFF501D597EBDF8141B6C5F267EA2F
SHA256:E09937D664933D16F2CBC5958D046B6DBC0527C5BCE3D87D21CCDFE3D706A569
1380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1380.13847\Faronics_DFS\Documentation\Francais\Deep Freeze Standard Manuel de l'utilisateur.urlurl
MD5:5C078540122FEC4C04685284BC39D691
SHA256:5A9E03416841356767528DCC9F68C622FA531C3D2AC6DB1822A3E9272E3884EB
1380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1380.13847\Faronics_DFS\Documentation\Simplified Chinese\Data Igloo User Guide.urlurl
MD5:25D8067B7F9C836AE1AE6072013DE0B5
SHA256:DA306FD5213575EC947DDA29590046A4068A2D612A3E63754A15E1C02C605986
1380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1380.13847\Faronics_DFS\Documentation\Simplified Chinese\Deep Freeze Standard User Guide.urlurl
MD5:2654FEF42E9D23CEE31239C354FE7507
SHA256:94B5520D0C93263E00E11C5493D9634EAA344A7D31270F660F13EDA7E4A86A18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
24
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2380
sipnotify.exe
HEAD
200
23.197.138.118:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133512133936710000
unknown
—
—
unknown
2380
sipnotify.exe
HEAD
200
23.197.138.118:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133512134705460000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
1736
svchost.exe
239.255.255.250:3702
—
—
—
unknown
1388
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2380
sipnotify.exe
23.197.138.118:80
query.prod.cms.rt.microsoft.com
Akamai International B.V.
US
unknown
2888
FrzState2k.exe
50.112.159.225:443
connector.deepfreeze.com
AMAZON-02
US
unknown
1724
svchost.exe
239.255.255.250:3702
—
—
—
unknown
1388
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 23.197.138.118
whitelisted
connector.deepfreeze.com
  • 50.112.159.225
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Faronics_DFS.zip