Overview
overview
3Static
static
3NetflixCE ...ode.js
windows10-1703-x64
1NetflixCE ...ram.js
windows10-1703-x64
1NetflixCE ...lox.js
windows10-1703-x64
1NetflixCE ...ion.js
windows10-1703-x64
1NetflixCE ...ap2.js
windows10-1703-x64
1NetflixCE ...eck.js
windows10-1703-x64
1NetflixCE ...gs.bat
windows10-1703-x64
1NetflixCE ...ok.dll
windows10-1703-x64
1NetflixCE ...64.dll
windows10-1703-x64
1NetflixCE ...ass.js
windows10-1703-x64
1NetflixCE ...ok.dll
windows10-1703-x64
3NetflixCE ...64.dll
windows10-1703-x64
1NetflixCE ...nes.js
windows10-1703-x64
1NetflixCE ...64.pot
windows10-1703-x64
1NetflixCE ...32.dll
windows10-1703-x64
3NetflixCE ...64.dll
windows10-1703-x64
1NetflixCE ...32.dll
windows10-1703-x64
1NetflixCE ...64.dll
windows10-1703-x64
1NetflixCE ...lua.js
windows10-1703-x64
1NetflixCE ...32.dll
windows10-1703-x64
3NetflixCE ...64.dll
windows10-1703-x64
1NetflixCE ...ua.exe
windows10-1703-x64
1NetflixCE ...32.exe
windows10-1703-x64
1NetflixCE ...64.exe
windows10-1703-x64
1NetflixCE ...es.bat
windows10-1703-x64
1NetflixCE ...ny.exe
windows10-1703-x64
1NetflixCE ...lp.dll
windows10-1703-x64
1NetflixCE ...lp.dll
windows10-1703-x64
1NetflixCE ...rv.dll
windows10-1703-x64
1NetflixCE ...e3.dll
windows10-1703-x64
1NetflixCE ...rv.dll
windows10-1703-x64
1NetflixCE ...er.exe
windows10-1703-x64
1Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
26/04/2024, 14:21
Static task
static1
Behavioral task
behavioral1
Sample
NetflixCE V4/NetflixCE/autorun/pseudocode.js
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
NetflixCE V4/NetflixCE/autorun/pseudocodediagram.js
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
NetflixCE V4/NetflixCE/autorun/roblox.js
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
NetflixCE V4/NetflixCE/autorun/savesession.js
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
NetflixCE V4/NetflixCE/autorun/ultimap2.js
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
NetflixCE V4/NetflixCE/autorun/versioncheck.js
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
NetflixCE V4/NetflixCE/buildsigs.bat
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
NetflixCE V4/NetflixCE/ced3d9hook.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
NetflixCE V4/NetflixCE/ced3d9hook64.dll
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
NetflixCE V4/NetflixCE/class.js
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
NetflixCE V4/NetflixCE/d3dhook.dll
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
NetflixCE V4/NetflixCE/d3dhook64.dll
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
NetflixCE V4/NetflixCE/defines.js
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
NetflixCE V4/NetflixCE/languages/cheatengine-x86_64.pot
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
NetflixCE V4/NetflixCE/libipt-32.dll
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
NetflixCE V4/NetflixCE/libipt-64.dll
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
NetflixCE V4/NetflixCE/libmikmod32.dll
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
NetflixCE V4/NetflixCE/libmikmod64.dll
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
NetflixCE V4/NetflixCE/lua/lua.js
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
NetflixCE V4/NetflixCE/lua53-32.dll
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
NetflixCE V4/NetflixCE/lua53-64.dll
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
NetflixCE V4/NetflixCE/lua_extra/lua.exe
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
NetflixCE V4/NetflixCE/lua_extra/luac32.exe
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
NetflixCE V4/NetflixCE/lua_extra/luac64.exe
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
NetflixCE V4/NetflixCE/packfiles.bat
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
NetflixCE V4/NetflixCE/tiny.exe
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
NetflixCE V4/NetflixCE/win64/dbghelp.dll
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
NetflixCE V4/NetflixCE/win64/old/dbghelp.dll
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
NetflixCE V4/NetflixCE/win64/old/symsrv.dll
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
NetflixCE V4/NetflixCE/win64/sqlite3.dll
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
NetflixCE V4/NetflixCE/win64/symsrv.dll
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
NetflixCE V4/rbxfpsunlocker.exe
Resource
win10-20240404-en
General
-
Target
NetflixCE V4/NetflixCE/languages/cheatengine-x86_64.pot
-
Size
237KB
-
MD5
8319dc1e7c2c2b5b66adf2a088dc8f1c
-
SHA1
8cba7064d859baa4875bcc22d9fd5b7b230fd9f9
-
SHA256
3bf0c50a35e924128ff5eeb7786260c37e08d44e759fc1c63d3f30ff6a744545
-
SHA512
8f1952a5122fd7bf34bc041f37b4ac2b940dc9128a52f9175c7f986a606c3b1e8f51879f0f394cfc9e6db51e43ab0c6a24cce0559cbed4498be9495d31fb0fbf
-
SSDEEP
3072:wY4EriDlRO2vY6qyih6yie4UI6x1bZCiLINMUVqKEZ:wY4EB6qyNe48MNM2qKEZ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4912 POWERPNT.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4912 POWERPNT.EXE 4912 POWERPNT.EXE 4912 POWERPNT.EXE 4912 POWERPNT.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\NetflixCE V4\NetflixCE\languages\cheatengine-x86_64.pot" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4912