948a55e050f0d8fbaf359ddb6b6abbb6132af66354d7e930c7ce901c76f5e7b9

Analysis

max time kernel
138s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PenguinProxy.exe
Size

68.7MB
MD5

96684c702e0c0de05558dc02cb86f81d
SHA1

53594ede3e37f193c5f25fda819588e7e526af94
SHA256

948a55e050f0d8fbaf359ddb6b6abbb6132af66354d7e930c7ce901c76f5e7b9
SHA512

8f0c0fe22cf73b0f09ecdd2301b60af2b4721800e315a2edca4965754e449f47c9cba681c38ffa2fcf29ef9f68fd05613c274502f65337ebc5ceac0302dda8e4
SSDEEP

1572864:MvPu4OjcNP43qLW6GRXS2Fgh53VIRTR3qw7uTvury4B03T4O:OuAyfS2Fgh53Vy3X7Uury3TN

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\com.squirrel.PenguinProxy.PenguinProxy = "C:\\Users\\Admin\\AppData\\Local\\PenguinProxy\\app-0.3.1\\PenguinProxy.exe"	PenguinProxy.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com
27	raw.githubusercontent.com
28	raw.githubusercontent.com
31	raw.githubusercontent.com

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Control Panel\International\Geo\Nation	PenguinProxy.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 7 IoCs

pid	Process
2332	Update.exe
2792	PenguinProxy.exe
2284	PenguinProxy.exe
2136	PenguinProxy.exe
1040	PenguinProxy.exe
1628	PenguinProxy.exe
2664	PenguinProxy.exe

Loads dropped DLL 18 IoCs

pid	Process
3000	PenguinProxy.exe
2332	Update.exe
2332	Update.exe
2332	Update.exe
2332	Update.exe
2332	Update.exe
2792	PenguinProxy.exe
2284	PenguinProxy.exe
2136	PenguinProxy.exe
1040	PenguinProxy.exe
1628	PenguinProxy.exe
2136	PenguinProxy.exe
2136	PenguinProxy.exe
2136	PenguinProxy.exe
2664	PenguinProxy.exe
2664	PenguinProxy.exe
2664	PenguinProxy.exe
2664	PenguinProxy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PenguinProxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PenguinProxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PenguinProxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PenguinProxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PenguinProxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PenguinProxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PenguinProxy.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	PenguinProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	PenguinProxy.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2332	Update.exe
2332	Update.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	Update.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2332	Update.exe
2284	PenguinProxy.exe
2284	PenguinProxy.exe
2284	PenguinProxy.exe
2284	PenguinProxy.exe
2284	PenguinProxy.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2284	PenguinProxy.exe
2284	PenguinProxy.exe
2284	PenguinProxy.exe
2284	PenguinProxy.exe
2284	PenguinProxy.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2332	3000	PenguinProxy.exe	30
PID 3000 wrote to memory of 2332	3000	PenguinProxy.exe	30
PID 3000 wrote to memory of 2332	3000	PenguinProxy.exe	30
PID 3000 wrote to memory of 2332	3000	PenguinProxy.exe	30
PID 3000 wrote to memory of 2332	3000	PenguinProxy.exe	30
PID 3000 wrote to memory of 2332	3000	PenguinProxy.exe	30
PID 3000 wrote to memory of 2332	3000	PenguinProxy.exe	30
PID 2332 wrote to memory of 2792	2332	Update.exe	31
PID 2332 wrote to memory of 2792	2332	Update.exe	31
PID 2332 wrote to memory of 2792	2332	Update.exe	31
PID 2332 wrote to memory of 2792	2332	Update.exe	31
PID 2332 wrote to memory of 2284	2332	Update.exe	32
PID 2332 wrote to memory of 2284	2332	Update.exe	32
PID 2332 wrote to memory of 2284	2332	Update.exe	32
PID 2332 wrote to memory of 2284	2332	Update.exe	32
PID 2284 wrote to memory of 2136	2284	PenguinProxy.exe	33
PID 2284 wrote to memory of 2136	2284	PenguinProxy.exe	33
PID 2284 wrote to memory of 2136	2284	PenguinProxy.exe	33
PID 2284 wrote to memory of 2136	2284	PenguinProxy.exe	33
PID 2284 wrote to memory of 2132	2284	PenguinProxy.exe	34
PID 2284 wrote to memory of 2132	2284	PenguinProxy.exe	34
PID 2284 wrote to memory of 2132	2284	PenguinProxy.exe	34
PID 2284 wrote to memory of 2132	2284	PenguinProxy.exe	34
PID 2284 wrote to memory of 1184	2284	PenguinProxy.exe	35
PID 2284 wrote to memory of 1184	2284	PenguinProxy.exe	35
PID 2284 wrote to memory of 1184	2284	PenguinProxy.exe	35
PID 2284 wrote to memory of 1184	2284	PenguinProxy.exe	35
PID 2284 wrote to memory of 2240	2284	PenguinProxy.exe	38
PID 2284 wrote to memory of 2240	2284	PenguinProxy.exe	38
PID 2284 wrote to memory of 2240	2284	PenguinProxy.exe	38
PID 2284 wrote to memory of 2240	2284	PenguinProxy.exe	38
PID 2284 wrote to memory of 1404	2284	PenguinProxy.exe	40
PID 2284 wrote to memory of 1404	2284	PenguinProxy.exe	40
PID 2284 wrote to memory of 1404	2284	PenguinProxy.exe	40
PID 2284 wrote to memory of 1404	2284	PenguinProxy.exe	40
PID 1184 wrote to memory of 1068	1184	cmd.exe	42
PID 1184 wrote to memory of 1068	1184	cmd.exe	42
PID 1184 wrote to memory of 1068	1184	cmd.exe	42
PID 1184 wrote to memory of 1068	1184	cmd.exe	42
PID 2240 wrote to memory of 896	2240	cmd.exe	41
PID 2240 wrote to memory of 896	2240	cmd.exe	41
PID 2240 wrote to memory of 896	2240	cmd.exe	41
PID 2240 wrote to memory of 896	2240	cmd.exe	41
PID 2284 wrote to memory of 1628	2284	PenguinProxy.exe	45
PID 2284 wrote to memory of 1628	2284	PenguinProxy.exe	45
PID 2284 wrote to memory of 1628	2284	PenguinProxy.exe	45
PID 2284 wrote to memory of 1628	2284	PenguinProxy.exe	45
PID 2284 wrote to memory of 1040	2284	PenguinProxy.exe	46
PID 2284 wrote to memory of 1040	2284	PenguinProxy.exe	46
PID 2284 wrote to memory of 1040	2284	PenguinProxy.exe	46
PID 2284 wrote to memory of 1040	2284	PenguinProxy.exe	46
PID 2132 wrote to memory of 2568	2132	cmd.exe	43
PID 2132 wrote to memory of 2568	2132	cmd.exe	43
PID 2132 wrote to memory of 2568	2132	cmd.exe	43
PID 2132 wrote to memory of 2568	2132	cmd.exe	43
PID 1404 wrote to memory of 1656	1404	cmd.exe	47
PID 1404 wrote to memory of 1656	1404	cmd.exe	47
PID 1404 wrote to memory of 1656	1404	cmd.exe	47
PID 1404 wrote to memory of 1656	1404	cmd.exe	47
PID 2284 wrote to memory of 2664	2284	PenguinProxy.exe	48
PID 2284 wrote to memory of 2664	2284	PenguinProxy.exe	48
PID 2284 wrote to memory of 2664	2284	PenguinProxy.exe	48
PID 2284 wrote to memory of 2664	2284	PenguinProxy.exe	48

C:\Users\Admin\AppData\Local\Temp\PenguinProxy.exe
"C:\Users\Admin\AppData\Local\Temp\PenguinProxy.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe
    "C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe" --squirrel-install 0.3.1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2792
- - C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe
    "C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe" --squirrel-firstrun
    3⤵
    - Adds Run key to start application
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe
      "C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe" --type=gpu-process --enable-features=SharedArrayBuffer --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=14694501790752275826 --mojo-platform-channel-handle=952 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL /t REG_SZ /d "https://www.penguinproxy.com/static/download/config.pac" /f"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1184
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL /t REG_SZ /d "https://www.penguinproxy.com/static/download/config.pac" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /t REG_Binary /d 46000000050000000500000000000000000000003700000068747470733A2F2F7777772E70656E6775696E70726F78792E636F6D2F7374617469632F646F776E6C6F61642F636F6E6669672E7061630000000000000000000000000000000000000000000000000000000000000000 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2240
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /t REG_Binary /d 46000000050000000500000000000000000000003700000068747470733A2F2F7777772E70656E6775696E70726F78792E636F6D2F7374617469632F646F776E6C6F61642F636F6E6669672E7061630000000000000000000000000000000000000000000000000000000000000000 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:896
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v SavedLegacySettings /t REG_Binary /d 46000000050000000500000000000000000000003700000068747470733A2F2F7777772E70656E6775696E70726F78792E636F6D2F7374617469632F646F776E6C6F61642F636F6E6669672E7061630000000000000000000000000000000000000000000000000000000000000000 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v SavedLegacySettings /t REG_Binary /d 46000000050000000500000000000000000000003700000068747470733A2F2F7777772E70656E6775696E70726F78792E636F6D2F7374617469632F646F776E6C6F61642F636F6E6669672E7061630000000000000000000000000000000000000000000000000000000000000000 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1656
  - - C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe
      "C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe" --type=renderer --no-sandbox --enable-features=SharedArrayBuffer --service-pipe-token=3436332418067241056 --lang=en-US --app-user-model-id=com.squirrel.PenguinProxy.PenguinProxy --app-path="C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\resources\app.asar" --node-integration=true --webview-tag=true --no-sandbox --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=3436332418067241056 --renderer-client-id=4 --mojo-platform-channel-handle=1324 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1628
  - - C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe
      "C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe" --type=renderer --no-sandbox --enable-features=SharedArrayBuffer --service-pipe-token=9587732904055868101 --lang=en-US --app-user-model-id=com.squirrel.PenguinProxy.PenguinProxy --app-path="C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\resources\app.asar" --node-integration=true --webview-tag=true --no-sandbox --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=9587732904055868101 --renderer-client-id=6 --mojo-platform-channel-handle=1420 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1040
  - - C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe
      "C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\PenguinProxy.exe" --type=gpu-process --enable-features=SharedArrayBuffer --disable-gpu-sandbox --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=3094385517678997761 --mojo-platform-channel-handle=2508 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\D3DCompiler_47.dll

Filesize
3.5MB

MD5
587a415cd5ac2069813adef5f7685021

SHA1
ca0e2fe1922b3cdc9e96e636a73e5c85a838e863

SHA256
2ad0d4987fc4624566b190e747c9d95038443956ed816abfd1e2d389b5ec0851

SHA512
0fa0e89ea1c1cb27ac7f621feb484438e378a8f5675eca7a91f24e0569174bd848d470d6b3e237fe6ab27ca1eb1ecc09b5f044e53a6d98bf908e77ac511183e2

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\chrome_100_percent.pak

Filesize
163KB

MD5
6b0554d58e8c0cdbf0bb88ee032fdc4b

SHA1
0985707237768abbf89acb3d362c7e62f9ef80bb

SHA256
ebc1a06972979c372fda5711d505a3b5041e6ee448d80de84f9eda84d37e4a86

SHA512
c01af1a038030f0141988cc4c0e6676c50934e705f13046dc57b00b4814abb37c88d623aa1c64ae0740be191bf261e6ce3c1a05100037a9c33eb877b0b8b95ad

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\chrome_200_percent.pak

Filesize
243KB

MD5
8ab92f2b5d78419af2e4e66d4391dfd2

SHA1
220e001d9fac6f01217b6f6d9b167aa5d9654620

SHA256
b2d93b68f9b8e3b6ccfa4d0225af4d6e55e2a47ace53e4e64d105ce7183a04d6

SHA512
afdb8d9345720ac7bcecb376ce21bc07ebed978e8b8c451762b50b1108127b1dbb04a1010cd746cc06084339b2e0dcc38dde16192ae26faa1d5030b87fee729c

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\ffmpeg.dll

Filesize
1.9MB

MD5
44bea9a3cc38abd2e34dbdd5eea97cc2

SHA1
35249b19a3eb3da54cbc2502cec1e9247d56a57e

SHA256
1bbcae9241fdc6ddeeeb125abeb307700c05868525f02cf8637d7d3a965510b0

SHA512
71760eef5354f88292f136a5a9e25887b454fa72d915cbddaa025a0d2fd3b84a7663f3f46b2b9845eab8db0bf133b9cf95a3eca1d98e90f97c37222d94d71956

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\icudtl.dat

Filesize
9.7MB

MD5
8cda09112153ff6dc3aded6ffeb6835f

SHA1
bdbbdfd4079b3a418272e8bdf015e1b259aa1333

SHA256
6c98bb4ccc3888ad4f94163d1654578442506f04012d5da819445a80bb85636f

SHA512
65727e37d6802ed42b4be4e4d9a172e0cb28c85dcefd5567888bf2342a58541fcfe0c1248822f17d7641ea40af1262fa6f5733417a62b9e19c8bedd357ad625c

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\locales\en-US.pak

Filesize
58KB

MD5
104437c82defe34717b1dc667d9e28aa

SHA1
844b450de3f12e1c4b76bb32f3513ab3a7331dc8

SHA256
df2f5f3830fc3fdeaf4f941b6b30cf051ab52b592bc6e31ae7176eecfda0c1a7

SHA512
f7d917bc492c8aba74eb2148baf9836bb6cb3ed058c53ae3eac7128f5156da54384d5dac2134b35f6b5ae05bf086fcaf2977e9a4374f14aee64d942329042572

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\natives_blob.bin

Filesize
122KB

MD5
99e9ed492dc4b9318704745f69e3ff43

SHA1
4276e245efeb0256bbbdefa77063d2585712198e

SHA256
ad6654fca057a8b8735c8b5cdba9d322396befe7e706429b8236c234a3941da1

SHA512
5163af106d268ff2a324519eac9a17572191add3a5283496170dcff10f52bd9854e47a00c4fe40d83c01b8cd21eaaa0665647044ddb038cf7191ff19c95af539

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\resources.pak

Filesize
8.3MB

MD5
c1ec43bae5c76eac7b228b26656c5257

SHA1
a76383f0208d864fdc8dce15552fcd1345a958b6

SHA256
e2dfed05af7e2a59b90cf3cdd257d0922f1a2ca4533ecaa7e0702d7d49305d24

SHA512
57088d1f9ebfdd964785668edca30fa6dd6cf68445337fc6083a127aeb6013a1584391a397ff9ef98783c45a131eef2dac4db1b011cdd5e1bb41ab4933a459c9

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\resources\app.asar

Filesize
32.8MB

MD5
c811d07f609dc91deb08ddf3fe98dc61

SHA1
231529766ae86a4194e828ea66754a9eaa79f390

SHA256
bb6d4648979e16cd77f3a071f313ab7d52e8feb77be8cb000a3f714b3dbeaee4

SHA512
65c6a5573fa28e0012bdfca8c5dbc0e686dd783eb9844ca984dca62847f8685e629640330dba1550d221612e27fa92a004aab807205e37d8913d774f5a0d41e4

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\resources\electron.asar

Filesize
270KB

MD5
0769239ccfdfd438696737af57c9e9a5

SHA1
45a4667e0f98c7db78de1785274b00f142d8dc0a

SHA256
9c4559f387d6d9157f2e7c9eca0ada63468c07a3a2b6d471b0ccd134595b8fd0

SHA512
4827b9b0123e1b382ed3b1b61d889e32374906009723db109aae6ec662252416af4e640ada4a4bebdba219d0a5583d17752b50f0f2b2b0c99703aa04f9504077

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\swiftshader\libegl.dll

Filesize
114KB

MD5
b984b93be6b2694d57025bad3019a24d

SHA1
ba86f04511b3b2e0f10715f7824f4356dd844c4c

SHA256
fe3f081756ae2cea66d85104e2be506ba3bc563352b74ed0933d075d378c6c95

SHA512
a9fc05386a34e3505e86f6093e31c6fb566d76928951d28f75f458952877bea2cfabfb73a747382ca78bec7d48947fba14fa6c7949b327f358b4b2c85b2cbf70

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\swiftshader\libglesv2.dll

Filesize
2.1MB

MD5
b53176cc73ec1659486076db5465f812

SHA1
ecd75d965a6a985ff068d52f5ef964bf74562d38

SHA256
b1689d18ef96c35ea07a658662a842f1ade67b787820537e86d37fbfed382220

SHA512
2c7bb81a92030008a944537ed60a3db2ff1e19505ad95a255753527458607d8da1be9cc6aef9ddd0f969ffed195134ac5175cacba50bae0e04db6fe32b268f3e

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\app-0.3.1\v8_context_snapshot.bin

Filesize
1.5MB

MD5
4348e3d1404c42e69f86de6f182288e3

SHA1
0445fe9e300b2ffb53c7a61e31ef7191dc125747

SHA256
1f2575702e760efc0ceb73fa521bc16aa801e3d8bc97be613c107938b40edc79

SHA512
6b30cbeee40ded83fc97d299b07b67809b89ec4b484db6e5cda3cd0f2070b3681a708e62ab9cae36798565d16e2b82e694a2d32d6d6fc159b18632c64fae0bf4

Download Submit
C:\Users\Admin\AppData\Local\PenguinProxy\packages\RELEASES

Filesize
82B

MD5
eea6b17bdb75f336eba41849d3a8c6e1

SHA1
6b69f33920b36a3c3a0778cda84f2189aad7dc4d

SHA256
915d639f30cd0abb16f04a1872e3918d413cf2baeb474000c3bed227e3d539d1

SHA512
9cd8e7e61a421c06d768f44d15186b98d2bffb99c4d510995c8737b10d526bc655cb79e12762676403db960580df38833c6639f02625da2bc51a3ab4aa95fa3a

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

Filesize
79B

MD5
f310866be12de8996c140f2d9b39279e

SHA1
56adf0b77ac69f682a1b8fd9fe146589b49f59c1

SHA256
9e9ba6c77707a05f5e82f0985dface2240c50226ad6552e503ee2c5790d351de

SHA512
d2ff39082588be4c6d6d8dfc3c4a42fb3c6642b1ecf8ae8f32ce4adead79cbfd7491f5ad5d0b6fad3069e96a0a19806ac1d54e918321430c0b5535cff5f89b20

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

Filesize
20KB

MD5
397d481010dca12cd7acdf8fefa120f5

SHA1
e8e165794a182fd656dc3f5f2bb497a3e7e00dca

SHA256
cb5eb255c8d52fa7e4eee86e3e3b9285c3447ce31c420fa443bf9921d831b61a

SHA512
77a48c78d9c04027d4ef037f3969e27d6794cef9886c3f0c180eee84e13c47057bb1b084b40c15c5dcba187bc7be018806348230882cd1351e06597a5f1b7255

Download Submit
C:\Users\Admin\AppData\Local\Temp\706f34ea-b7f1-4033-9a54-c8cc30b40716.tmp.ico

Filesize
3KB

MD5
969845c6c54d535b599bd80e9d8a1bdf

SHA1
4ee9e59b8bd5b5dde0c4e9917ffa401e47779d1e

SHA256
d6d0a15aad78eadc670b606d0ddb07525a218f6532527cf52b3485d2b0b4bd18

SHA512
659ec00e1f4a0e81350fa91e4bb6fd9ce49615d2f3a59cbb13f97aec63892d8aa14335d20d0e991c7a21451db87620fd70f0fb907a19b5a3038b22a67cf1e8c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA74.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAAA6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\PenguinProxy\Settings

Filesize
553B

MD5
5c5c7c2b37374c1fe9ccd5ba83537a5c

SHA1
9867f68ff736af52a710fcd6f7d88bde3fb42362

SHA256
49456bcefac83401d37eeb1a79c563425b70cd7b5f569be8fc24d9bda6bcc7e2

SHA512
8b25d5eedeb81809e68bf0b34a904a6ffdbffe2d4e011a1f8e8a594c1a0a964f701a31ef0c9f5cb849bf663130c7d9502342d8b06c8199ed9cc2681a5e300f9f

Download Submit
\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.8MB

MD5
b30b80f3ad32d8ad0bc4339b4e776e11

SHA1
97f12b3febe164994a0d8ecf867a5e774c8b39b6

SHA256
0a24c5eae41415f19dc7673cdd651727f78dcc9814e4fc6e3858b00bd419959c

SHA512
dabb51a751f3fddbc35d8cfbf9c29aa6bda703604e7cd8c71a801ea76a3d6297ed570477bcca763dc241f2f6f77d2060505ec5aed9534ab1edb90318d0717abb

Download Submit
memory/2332-9-0x00000000746DE000-0x00000000746DF000-memory.dmp

Filesize
4KB

Download
memory/2332-21-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2332-205-0x00000000746DE000-0x00000000746DF000-memory.dmp

Filesize
4KB

Download
memory/2332-10-0x0000000000D00000-0x0000000000EC4000-memory.dmp

Filesize
1.8MB

Download
memory/2332-11-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2332-262-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2332-263-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2332-274-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download