Analysis
-
max time kernel
97s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-02-2024 20:12
Static task
static1
Behavioral task
behavioral1
Sample
FluentIcons.Common.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
FluentIcons.Common.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
FluentIcons.WPF.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
FluentIcons.WPF.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Wpf.Ui.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
Wpf.Ui.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
fPoeSmoother.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
fPoeSmoother.exe
Resource
win10v2004-20231215-en
General
-
Target
FluentIcons.Common.dll
-
Size
116KB
-
MD5
f7d27af73d2bafcbe27607956fd0f398
-
SHA1
f583f8bae81f282dd5a5d0d65f718314b7668f5b
-
SHA256
e8f26a6c886c03103a8102eaa3dc1ccf2be829c0a359ba44b50228fc036f11ce
-
SHA512
8279f0f8023f51cf654a6c32296835a2c73ce3e6274064cdad48262d9e4736f575fea141e58142b88b952a804be0a9a312465460197ce29e4ba4414c755eaf01
-
SSDEEP
1536:zKpf036zYvtYyfuVicqNZBjmpyYAuesAUFZfHPcPSPIXkdIlCiFdzeCSjgJYqCy:zXoYFYyWVWLDrsmaPIXkSlPftnR
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2580 chrome.exe 2580 chrome.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2612 2580 chrome.exe 33 PID 2580 wrote to memory of 2612 2580 chrome.exe 33 PID 2580 wrote to memory of 2612 2580 chrome.exe 33 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1928 2580 chrome.exe 35 PID 2580 wrote to memory of 1764 2580 chrome.exe 36 PID 2580 wrote to memory of 1764 2580 chrome.exe 36 PID 2580 wrote to memory of 1764 2580 chrome.exe 36 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37 PID 2580 wrote to memory of 2520 2580 chrome.exe 37
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\FluentIcons.Common.dll,#11⤵PID:2200
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2892
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef63e9758,0x7fef63e9768,0x7fef63e97782⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:22⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:82⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:82⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2268 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:12⤵PID:680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:12⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1420 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:22⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2916 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:22⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3288 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:12⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3808 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:82⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3776 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:12⤵PID:812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3648 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:12⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2592 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:12⤵PID:2448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3772 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:12⤵PID:980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3572 --field-trial-handle=1280,i,16494367324845463520,16962908008641704391,131072 /prefetch:12⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD5ce0b8d11a00256be872539d386e3f8e5
SHA164658a28b3b3a52c5332c9e1fdb8875411a4f9d2
SHA2563a009c2e78435c0b5f5454d3a39090a76111f8dcdb35ae665332afacb6f2d83e
SHA51206fd4d8b19f485e8fafabaebef5f48217d86ff8d59a1889e3a47bc28eaafb23892fe0f85d4e2165cdfbe70761fc006c0650e7304b2534960ee8962fdcef8cb4a
-
Filesize
194KB
MD5ac84f1282f8542dee07f8a1af421f2a7
SHA1261885284826281a99ff982428a765be30de9029
SHA256193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0
SHA5129f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
683B
MD564536fd6b14a220267ee005bafe4153c
SHA1756171595009a72dad435f84d1d8b3b39ddb3886
SHA25699c166c3e79e0e1db133257e2e8a5b3c8efd0a3facebe005497c63f03e4a8d13
SHA512db93ec05c8a690973e303d8d0873dd9cb4654b4e2d11d2e31db2a73324d03437e732b997403312ea53fea6f8e2fd489204f74b9e14cc918e06015f2524314591
-
Filesize
5KB
MD5ac85409eee55bf4c6589c875ac1f92c5
SHA1df3113284ce99dcf92ebf56b2a109d5a740dbeaf
SHA25660c5e80b222f4c4d1873b1bc12a63d463af560015e44715250367f8326b13aab
SHA512e5485e6f2ac8fd4dba86ab8b8616a76017bcc267f244d7f5e707f62e0dcdcb39a326c0410d27a72cd5a99831c9d94b8202abe02a006475cd2e6cd02e495b771a
-
Filesize
5KB
MD5c0671c878dde580ff9027c1715dc757f
SHA17ae631ce4813c4406e0c72dbdbb09cca2f182c64
SHA256d644a9a5c5940b641f381d140142595051bfa75518cfafbe3fbe43c023a84a27
SHA51289df3a973b1e894c667d418a18b416097efb8fa162c23654c3c27ed9c9ac3b103c6ea03847b90bb7478fb078c725933cf5733b5ddd1e6ee52d4690ec969f8eb0
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
240KB
MD564515191e11bdbbb9e9d5bd7d1926c5b
SHA12a1a954a966d409be06c1feb3cf0ccacf55825e3
SHA2563366e9592eb8faf7689ddd45c1a72a2804f0a4cb01ceb46a0a61cb0b7b5bc8fa
SHA512fabd8512527b8fcbfbcb90abbb0690a2f089f7c5da66bd25e4fdffe787543dfcebca07d5c74931db88ad850096b3e19f55b02bea14ddfe9507c6f8447bad0bea