LetsDefend- SOC344 — EDR Tampering Attempt via EDR-Freeze

I got an alert on the LetsDefend Practice and i investigate the alert.

An attacker tried to freeze the EDR software — To eliminate its own visibility.

I taked this alert ownership myself. And i started a new case for this Alert.

Look at the Alert Details.

EventID 322: This event id makes log from Launch request ignored or instance already running. Probably EDR Software wasnt launch therefore log created with this event id.

Event Time: This event happened at Sep, 26, 2025, 05:26 P

Hostname: WS-Prod-02

Ip Address : 172.16.20.69

Process Name: EDR-Freeze_1.0.exe\

Process Path: C:\Users\LetsDefend\Downloads\

Parent Process: powershell.exe

Command Line: “C:\Users\LetsDefend\Downloads\EDR-Freeze_1.0.exe” 6080 10000

SHA256 Hash: 970c7834e58b6ef22473875167a333dbb33bf7b667d1cb814829f68579cd85f7

Initial Access

I first entered Log Management section on the right bar. And i filtered by source ip is 172.16.20.69.

I looked at the Logs and i saw an a Download process.

And then i opened victim machine on the LetsDefend. I need to investigate Sysmon logs too.

On the sysmon logs i filtered by first EventID 3. This event id is show network connection events.

Before the downloaded process happened RDP Connection attempt, we confirm the SOC L1.

I need to look this tried to RDP Connection IP Address on the OSINT tools.

This is suspicious.

Network Connection

After this attempt established connection with port 443 and 80. We can say the attacker was established connection and downloaded another payload for the Freeze EDR.

In this case have a many outbound connection to many ip addresses. I need to verify these IP addresses is safe or not.

Payload Execution

Now i look at with Event ID 1. I want to see created process after this downloaded.

Network connection happened at 01.01 therefore i looked at the after this time what happening?

EDR-Freeze_1.0.exe file was executed after the network connection. This .exe file executed with 6080 and 10000 options. 6080 Probably is Process ID. Attacker execute this file an a gave with process id.

I want to see what is this PID 6080 process. With the same filter on the Sysmon Logs i searched this keyword “6080”.

PID = 6080 = MsMpEng.exe this is Windows Defender SubProcess. In the prior question we saw the was used options 6080 and 10000. 10000 Probably is time option. Attacker was freeze Windows Defender.

After attacker was ran the .exe file 54 second is empty. Between the 54 seconds i didnt any log here. I found an a log just Log Management page on the LetsDefend.

This process created at 1:03:32.

StartFunction: CtrlRoutine and StartModule: KERNELBASE.dll. This process call the CtrlRoutine function. Probably sends a signal to an process Ctrl + C.

So,

PID 876 → sent signal to EDR-Freeze.exe

→ Start freeze

→ MsMpEng.exe freezed.

I searched PID 876 everywhere but i didnt find any log source or metada.

Now what we know?

1. Sent many RDP Attempts → Then executed whoami.exe (Source IP: 212.8.243.56, Destination IP: 172.31.1.157 Destination Port: 3389)
2. 01:01 PM → Network Connection Established (Source IP: 172.31.1.157)
3. Executed EDR-Freeze_1.0.exe with 6080 and 10000 options. Command Line: CommandLine: “C:\Users\LetsDefend\Downloads\EDR-Freeze_1.0.exe” 6080 10000
4. MsMpEng.exe freezed PID 6080 = MsMpEng.exe (Windows Defender) and WerFault.exe triggered because Windows Defender Freezed anormally.

IoCs

Hostname: WS-prod2

Host IP Address: 172.16.20.69

Compromise IP Address: 172.31.1.157

File Name: EDR-Freeze_1.0.exe

File Hash: 970c7834e58b6ef22473875167a333dbb33bf7b667d1cb814829f68579cd85f7

Attacker IP Address: 212.8.243.56

Multiple Outbound IP Addresses: 185.19.111.133, 140.82.113.4

Efe Ozel — SOC Analyst