Overview
overview
7Static
static
3ui.exe
windows7-x64
7ui.exe
windows10-2004-x64
3data/app.so
ubuntu-20.04-amd64
1data/flutt...st.bin
windows7-x64
3data/flutt...st.bin
windows10-2004-x64
3data/flutt...t.json
windows7-x64
3data/flutt...t.json
windows10-2004-x64
3data/flutt...t.json
windows7-x64
3data/flutt...t.json
windows10-2004-x64
3data/flutt...CES.gz
windows7-x64
3data/flutt...CES.gz
windows10-2004-x64
7NOTICES.z
windows7-x64
3NOTICES.z
windows10-2004-x64
3data/flutt...er.png
windows7-x64
3data/flutt...er.png
windows10-2004-x64
3data/flutt...go.ico
windows7-x64
3data/flutt...go.ico
windows10-2004-x64
3data/flutt...go.png
windows7-x64
3data/flutt...go.png
windows10-2004-x64
3data/flutt...s.json
windows7-x64
3data/flutt...s.json
windows10-2004-x64
3data/flutt...g.json
windows7-x64
3data/flutt...g.json
windows10-2004-x64
3data/flutt...ar.otf
windows7-x64
3data/flutt...ar.otf
windows10-2004-x64
7data/flutt...ns.ttf
windows7-x64
3data/flutt...ns.ttf
windows10-2004-x64
7data/flutt...se.png
windows7-x64
3data/flutt...se.png
windows10-2004-x64
3data/flutt...ze.png
windows7-x64
3data/flutt...ze.png
windows10-2004-x64
3data/flutt...ze.png
windows7-x64
3Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 20:32
Static task
static1
Behavioral task
behavioral1
Sample
ui.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ui.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
data/app.so
Resource
ubuntu2004-amd64-20240418-en
Behavioral task
behavioral4
Sample
data/flutter_assets/AssetManifest.bin
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
data/flutter_assets/AssetManifest.bin
Resource
win10v2004-20240419-en
Behavioral task
behavioral6
Sample
data/flutter_assets/AssetManifest.json
Resource
win7-20231129-en
Behavioral task
behavioral7
Sample
data/flutter_assets/AssetManifest.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral8
Sample
data/flutter_assets/FontManifest.json
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
data/flutter_assets/FontManifest.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral10
Sample
data/flutter_assets/NOTICES.gz
Resource
win7-20240221-en
Behavioral task
behavioral11
Sample
data/flutter_assets/NOTICES.gz
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
NOTICES.z
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
NOTICES.z
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
data/flutter_assets/assets/Banner.png
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
data/flutter_assets/assets/Banner.png
Resource
win10v2004-20240419-en
Behavioral task
behavioral16
Sample
data/flutter_assets/assets/Logo.ico
Resource
win7-20240215-en
Behavioral task
behavioral17
Sample
data/flutter_assets/assets/Logo.ico
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
data/flutter_assets/assets/Logo.png
Resource
win7-20240419-en
Behavioral task
behavioral19
Sample
data/flutter_assets/assets/Logo.png
Resource
win10v2004-20240419-en
Behavioral task
behavioral20
Sample
data/flutter_assets/assets/animations/success.json
Resource
win7-20240215-en
Behavioral task
behavioral21
Sample
data/flutter_assets/assets/animations/success.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral22
Sample
data/flutter_assets/assets/defaultConfig.json
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
data/flutter_assets/assets/defaultConfig.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral24
Sample
data/flutter_assets/fonts/MaterialIcons-Regular.otf
Resource
win7-20240419-en
Behavioral task
behavioral25
Sample
data/flutter_assets/fonts/MaterialIcons-Regular.otf
Resource
win10v2004-20240419-en
Behavioral task
behavioral26
Sample
data/flutter_assets/packages/cupertino_icons/assets/CupertinoIcons.ttf
Resource
win7-20240220-en
Behavioral task
behavioral27
Sample
data/flutter_assets/packages/cupertino_icons/assets/CupertinoIcons.ttf
Resource
win10v2004-20240419-en
Behavioral task
behavioral28
Sample
data/flutter_assets/packages/window_manager/images/ic_chrome_close.png
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
data/flutter_assets/packages/window_manager/images/ic_chrome_close.png
Resource
win10v2004-20240419-en
Behavioral task
behavioral30
Sample
data/flutter_assets/packages/window_manager/images/ic_chrome_maximize.png
Resource
win7-20231129-en
Behavioral task
behavioral31
Sample
data/flutter_assets/packages/window_manager/images/ic_chrome_maximize.png
Resource
win10v2004-20240419-en
Behavioral task
behavioral32
Sample
data/flutter_assets/packages/window_manager/images/ic_chrome_minimize.png
Resource
win7-20240221-en
General
-
Target
data/flutter_assets/FontManifest.json
-
Size
208B
-
MD5
dc3d03800ccca4601324923c0b1d6d57
-
SHA1
bca264548730f8b1871672891b0ad0c02444bfaf
-
SHA256
cd7e03645bc44b2dd47b7cb626f51c4ecbf55a197ab77241628b47ac165fbe21
-
SHA512
eda04affa31ef1d3fe4b081762380a6a5a9364a48e7b6998e870c84495f51a9658724e3f496d90a574f7d5e13740dcf47ccc1c7914b77b6ef0826fe87379cdf8
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.json rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2704 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2704 AcroRd32.exe 2704 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2348 wrote to memory of 2632 2348 cmd.exe rundll32.exe PID 2348 wrote to memory of 2632 2348 cmd.exe rundll32.exe PID 2348 wrote to memory of 2632 2348 cmd.exe rundll32.exe PID 2632 wrote to memory of 2704 2632 rundll32.exe AcroRd32.exe PID 2632 wrote to memory of 2704 2632 rundll32.exe AcroRd32.exe PID 2632 wrote to memory of 2704 2632 rundll32.exe AcroRd32.exe PID 2632 wrote to memory of 2704 2632 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\FontManifest.json1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\FontManifest.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\FontManifest.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5d9bcfdba8485ba2b185f881d202afae0
SHA1ad13c44d18a5d1c8e9a4615f58c54d76a7b66a9b
SHA25675acde1f6efc17affd9a7f6d0bf3d2c768be2bb3720fb1bb8602efcce7089860
SHA5128f074f77b5b63e2e89503ff24950760a5a0e059f85fbcb0929031e42fb07b111861b74c19ccd31817a0312617acb4a7c4576bcc93b6fc04082aa73ce38fb3e8e