Overview
overview
7Static
static
3FluffyPeng....9.exe
windows7-x64
7FluffyPeng....9.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3FluffyPenguin.exe
windows7-x64
7FluffyPenguin.exe
windows10-2004-x64
7LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
3ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
3libGLESv2.dll
windows10-2004-x64
3resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1resources/...er.dll
windows7-x64
1resources/...er.dll
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
3vk_swiftshader.dll
windows10-2004-x64
3vulkan-1.dll
windows7-x64
3Analysis
- max time kernel
121s - max time network
146s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 02:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FluffyPenguin-Setup-1.5.9.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
FluffyPenguin-Setup-1.5.9.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
FluffyPenguin.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
FluffyPenguin.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
LICENSES.chromium.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/plugins/pepflashplayer.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/plugins/pepflashplayer.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
swiftshader/libEGL.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
vk_swiftshader.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
vulkan-1.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
General
- Target FluffyPenguin.exe
- Size 104.7MB
- Sample240613-dg5asasbpc
- SHA256 ea6acec46bf0106d111cb0ca33a98150a651ebf4f762faf65b2ea40dd69e1f46
- MD5 0ab466e97ea5e2384cce1f0edc48cc33
- SHA1 b9296be11a32e157ac6f4bad2c6dbf3e063f2622
- SHA512 f19e19118390cade67d52bf258f0b04c00435b894b8b7577ba8b6d47bf3a858561e2acc24996d3d4a2df3797c10a412115499e3c93fd56a736d415a530a8e3bb
- SSDEEP 1572864:vKqxYPeXS8KTM9GUvTkbVn/HEuLyywaom8Wbw9vIqprmCOj6hXGX5WAtF4Kalz9d:iCnCREuLyywaoZ9EOrGpvT+r
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation FluffyPenguin.exe Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation FluffyPenguin.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FluffyPenguin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FluffyPenguin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FluffyPenguin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 FluffyPenguin.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2244 FluffyPenguin.exe 2612 FluffyPenguin.exe 2520 FluffyPenguin.exe 2520 FluffyPenguin.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2652 2520 FluffyPenguin.exe 28 PID 2520 wrote to memory of 2244 2520 FluffyPenguin.exe 29 PID 2520 wrote to memory of 2244 2520 FluffyPenguin.exe 29 PID 2520 wrote to memory of 2244 2520 FluffyPenguin.exe 29 PID 2520 wrote to memory of 2244 2520 FluffyPenguin.exe 29 PID 2520 wrote to memory of 2612 2520 FluffyPenguin.exe 30 PID 2520 wrote to memory of 2612 2520 FluffyPenguin.exe 30 PID 2520 wrote to memory of 2612 2520 FluffyPenguin.exe 30 PID 2520 wrote to memory of 2612 2520 FluffyPenguin.exe 30 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31 PID 2520 wrote to memory of 1456 2520 FluffyPenguin.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe"C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe"C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe" --type=gpu-process --field-trial-handle=988,17035694627023458880,8424516204488295574,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1004 /prefetch:22⤵PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe"C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=988,17035694627023458880,8424516204488295574,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1344 /prefetch:82⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2244
-
-
C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe"C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe" --type=renderer --field-trial-handle=988,17035694627023458880,8424516204488295574,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-plugins --no-sandbox --no-zygote --context-isolation --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1432 /prefetch:12⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe"C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe" --type=gpu-process --field-trial-handle=988,17035694627023458880,8424516204488295574,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1004 /prefetch:22⤵PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe"C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe" --type=ppapi --field-trial-handle=988,17035694627023458880,8424516204488295574,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --ppapi-flash-args --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=1652 /prefetch:32⤵PID:1868
-
-
C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe"C:\Users\Admin\AppData\Local\Temp\FluffyPenguin.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=988,17035694627023458880,8424516204488295574,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2012 /prefetch:82⤵PID:956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar3E20.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\ffpenguin-app\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 390a358a834a57373b071661f967e6c5969a30af9e38fb3d2da086cc458943d3
- MD5 b00e6c5ace0314cea93cd769aac42c13
- SHA1 784d531e37a764845713eaf763c78aaae7e75e52
- SHA512 da182f165b50ff269834915420102c875427cd3fde877893a21f55cc47b64183407778a65cf61d6e217f99ebaf5354620dfd610cbe3f663c59923ffbbdab5fc1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\ffpenguin-app\Dictionaries\en-US-9-0.bdic
- Size 441KB
- SHA256 0d6803758ff8f87081fafd62e90f0950dfb2dd7991e9607fe76a8f92d0e893fa
- MD5 a78ad14e77147e7de3647e61964c0335
- SHA1 cecc3dd41f4cea0192b24300c71e1911bd4fce45
- SHA512 dde24d5ad50d68fc91e9e325d31e66ef8f624b6bb3a07d14ffed1104d3ab5f4ef1d7969a5cde0dfbb19cb31c506f7de97af67c2f244f7e7e8e10648ea8321101
- SSDEEP 12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
- MD5 SHA1 SHA512 SSDEEP