Overview
overview
7Static
static
3ui.exe
windows7-x64
7ui.exe
windows10-2004-x64
3data/app.so
ubuntu-20.04-amd64
1data/flutt...st.bin
windows7-x64
3data/flutt...st.bin
windows10-2004-x64
3data/flutt...t.json
windows7-x64
3data/flutt...t.json
windows10-2004-x64
3data/flutt...t.json
windows7-x64
3data/flutt...t.json
windows10-2004-x64
3data/flutt...CES.gz
windows7-x64
3data/flutt...CES.gz
windows10-2004-x64
7NOTICES.z
windows7-x64
3NOTICES.z
windows10-2004-x64
3data/flutt...er.png
windows7-x64
3data/flutt...er.png
windows10-2004-x64
3data/flutt...go.ico
windows7-x64
3data/flutt...go.ico
windows10-2004-x64
3data/flutt...go.png
windows7-x64
3data/flutt...go.png
windows10-2004-x64
3data/flutt...s.json
windows7-x64
3data/flutt...s.json
windows10-2004-x64
3data/flutt...g.json
windows7-x64
3data/flutt...g.json
windows10-2004-x64
3data/flutt...ar.otf
windows7-x64
3data/flutt...ar.otf
windows10-2004-x64
7data/flutt...ns.ttf
windows7-x64
3data/flutt...ns.ttf
windows10-2004-x64
7data/flutt...se.png
windows7-x64
3data/flutt...se.png
windows10-2004-x64
3data/flutt...ze.png
windows7-x64
3data/flutt...ze.png
windows10-2004-x64
3data/flutt...ze.png
windows7-x64
3Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 20:32
Static task
static1
Behavioral task
behavioral1
Sample
ui.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ui.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
data/app.so
Resource
ubuntu2004-amd64-20240418-en
Behavioral task
behavioral4
Sample
data/flutter_assets/AssetManifest.bin
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
data/flutter_assets/AssetManifest.bin
Resource
win10v2004-20240419-en
Behavioral task
behavioral6
Sample
data/flutter_assets/AssetManifest.json
Resource
win7-20231129-en
Behavioral task
behavioral7
Sample
data/flutter_assets/AssetManifest.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral8
Sample
data/flutter_assets/FontManifest.json
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
data/flutter_assets/FontManifest.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral10
Sample
data/flutter_assets/NOTICES.gz
Resource
win7-20240221-en
Behavioral task
behavioral11
Sample
data/flutter_assets/NOTICES.gz
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
NOTICES.z
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
NOTICES.z
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
data/flutter_assets/assets/Banner.png
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
data/flutter_assets/assets/Banner.png
Resource
win10v2004-20240419-en
Behavioral task
behavioral16
Sample
data/flutter_assets/assets/Logo.ico
Resource
win7-20240215-en
Behavioral task
behavioral17
Sample
data/flutter_assets/assets/Logo.ico
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
data/flutter_assets/assets/Logo.png
Resource
win7-20240419-en
Behavioral task
behavioral19
Sample
data/flutter_assets/assets/Logo.png
Resource
win10v2004-20240419-en
Behavioral task
behavioral20
Sample
data/flutter_assets/assets/animations/success.json
Resource
win7-20240215-en
Behavioral task
behavioral21
Sample
data/flutter_assets/assets/animations/success.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral22
Sample
data/flutter_assets/assets/defaultConfig.json
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
data/flutter_assets/assets/defaultConfig.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral24
Sample
data/flutter_assets/fonts/MaterialIcons-Regular.otf
Resource
win7-20240419-en
Behavioral task
behavioral25
Sample
data/flutter_assets/fonts/MaterialIcons-Regular.otf
Resource
win10v2004-20240419-en
Behavioral task
behavioral26
Sample
data/flutter_assets/packages/cupertino_icons/assets/CupertinoIcons.ttf
Resource
win7-20240220-en
Behavioral task
behavioral27
Sample
data/flutter_assets/packages/cupertino_icons/assets/CupertinoIcons.ttf
Resource
win10v2004-20240419-en
Behavioral task
behavioral28
Sample
data/flutter_assets/packages/window_manager/images/ic_chrome_close.png
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
data/flutter_assets/packages/window_manager/images/ic_chrome_close.png
Resource
win10v2004-20240419-en
Behavioral task
behavioral30
Sample
data/flutter_assets/packages/window_manager/images/ic_chrome_maximize.png
Resource
win7-20231129-en
Behavioral task
behavioral31
Sample
data/flutter_assets/packages/window_manager/images/ic_chrome_maximize.png
Resource
win10v2004-20240419-en
Behavioral task
behavioral32
Sample
data/flutter_assets/packages/window_manager/images/ic_chrome_minimize.png
Resource
win7-20240221-en
General
-
Target
data/flutter_assets/assets/animations/success.json
-
Size
12KB
-
MD5
36ba0c9961f80adb7c58ef450fbcd79b
-
SHA1
d8af03f91df9d777bb68a06583d32d2498e0ea87
-
SHA256
1584e226904a5456af0ceb35d0a1cb57b714d92908ef386b975d75619104a9fd
-
SHA512
ba4281ac74a54d51942a4813e3fab86d114b335211b77b97e4dc56c7d0a96334940199616eed00c8f0314eaa096e1850dbef4a7f1ed345eaac4bf38ecf44f4a4
-
SSDEEP
192:NWOEuyrOPSY7nITOOGFCoCOOxOeOYWOoyrO9YGYvjIi00G16k87E71iM:Uec4ITXGAoCXxb8bc4hh6/7Gn
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\json_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.json rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2736 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2736 AcroRd32.exe 2736 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1888 wrote to memory of 2556 1888 cmd.exe rundll32.exe PID 1888 wrote to memory of 2556 1888 cmd.exe rundll32.exe PID 1888 wrote to memory of 2556 1888 cmd.exe rundll32.exe PID 2556 wrote to memory of 2736 2556 rundll32.exe AcroRd32.exe PID 2556 wrote to memory of 2736 2556 rundll32.exe AcroRd32.exe PID 2556 wrote to memory of 2736 2556 rundll32.exe AcroRd32.exe PID 2556 wrote to memory of 2736 2556 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\assets\animations\success.json1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\assets\animations\success.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\assets\animations\success.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD548c77c33a70c31e47ea47a839f7c561e
SHA1b82e0f13cde66ba0fdec4e80edac8cd78fc7da8a
SHA256f1fa9474ba62b232b7152cc782350682b2f503efaf23bca5de0ebde2ce1188e0
SHA5129b63c98c9113c0384ccf17cbb04e49272699cf664ff6cb349b4060edbb86203d710426fd5ee2a20a9bb24ac98b8a6a64294f13f063a6f480e5535a4028945d6a