Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/05/2024, 14:05
240501-rd1ebagd9t 601/05/2024, 13:01
240501-p9erdafd4t 601/05/2024, 13:01
240501-p87e1afd3y 6Analysis
-
max time kernel
40s -
max time network
36s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/05/2024, 14:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Netflix-CE V3.7.zip
Resource
win11-20240426-en
windows11-21h2-x64
5 signatures
300 seconds
General
-
Target
Netflix-CE V3.7.zip
-
Size
7.0MB
-
MD5
e0114161262d6962d7f0070ceaec7b56
-
SHA1
eaf3a04dcc79f0a1c49ffb8c9664330081520bd8
-
SHA256
9b136612a0fce26212377db945319ec533c7671ace325ccc2616df9c9a5b0e2e
-
SHA512
89362ab507a7363f170b0fec1f758caadd6c7ee6a34cc369a6cf32fd8adc7df8f3740c289fee8a121d96c9aeafb0a394016515d4ed35555aef520b7ed91fe8da
-
SSDEEP
196608:VfRG/lS1WObi8t9FDbBH4ma6bgP6MITd9WrxiXKE4QsK6:VfRGdMk8tHDlysrMwbQiXKE4/
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 pastebin.com 3 pastebin.com -
Drops file in System32 directory 43 IoCs
description ioc Process File opened for modification C:\Windows\System32\KERNEL32.DLL RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\apphelp.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\dxcore.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\windows.storage.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\PROPSYS.dll RobloxStudio.exe File opened for modification C:\Windows\System32\MSCTF.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\Dbghelp.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\ntdll.dll RobloxStudio.exe File opened for modification C:\Windows\System32\msvcp_win.dll RobloxStudio.exe File opened for modification C:\Windows\System32\msvcrt.dll RobloxStudio.exe File opened for modification C:\Windows\System32\comdlg32.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\wsock32.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\hhctrl.ocx RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\wintypes.dll RobloxStudio.exe File opened for modification C:\Windows\System32\oleaut32.dll RobloxStudio.exe File opened for modification C:\Windows\System32\user32.dll RobloxStudio.exe File opened for modification C:\Windows\System32\ws2_32.dll RobloxStudio.exe File opened for modification C:\Windows\System32\KERNELBASE.dll RobloxStudio.exe File opened for modification C:\Windows\System32\RPCRT4.dll RobloxStudio.exe File opened for modification C:\Windows\System32\win32u.dll RobloxStudio.exe File opened for modification C:\Windows\System32\ole32.dll RobloxStudio.exe File opened for modification C:\Windows\System32\shcore.dll RobloxStudio.exe File opened for modification C:\Windows\System32\clbcatq.dll RobloxStudio.exe File opened for modification C:\Windows\system32\explorerframe.dll RobloxStudio.exe File opened for modification C:\Windows\System32\GDI32.dll RobloxStudio.exe File opened for modification C:\Windows\System32\sechost.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\winmm.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\wininet.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\msimg32.dll RobloxStudio.exe File opened for modification C:\Windows\System32\combase.dll RobloxStudio.exe File opened for modification C:\Windows\System32\advapi32.dll RobloxStudio.exe File opened for modification C:\Windows\System32\shell32.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\uxtheme.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\opengl32.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\GLU32.dll RobloxStudio.exe File opened for modification C:\Windows\System32\bcryptPrimitives.dll RobloxStudio.exe File opened for modification C:\Windows\System32\ucrtbase.dll RobloxStudio.exe File opened for modification C:\Windows\System32\gdi32full.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\version.dll RobloxStudio.exe File opened for modification C:\Windows\System32\imm32.dll RobloxStudio.exe File opened for modification C:\Windows\System32\SHLWAPI.dll RobloxStudio.exe File opened for modification C:\Windows\System32\psapi.dll RobloxStudio.exe File opened for modification C:\Windows\SYSTEM32\kernel.appcore.dll RobloxStudio.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22000.1_none_271a8fad6a2d1b1e\comctl32.dll RobloxStudio.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 1504 RobloxStudio.exe Token: SeTcbPrivilege 1504 RobloxStudio.exe Token: SeTcbPrivilege 1504 RobloxStudio.exe Token: SeLoadDriverPrivilege 1504 RobloxStudio.exe Token: SeCreateGlobalPrivilege 1504 RobloxStudio.exe Token: SeLockMemoryPrivilege 1504 RobloxStudio.exe Token: 33 1504 RobloxStudio.exe Token: SeSecurityPrivilege 1504 RobloxStudio.exe Token: SeTakeOwnershipPrivilege 1504 RobloxStudio.exe Token: SeManageVolumePrivilege 1504 RobloxStudio.exe Token: SeBackupPrivilege 1504 RobloxStudio.exe Token: SeCreatePagefilePrivilege 1504 RobloxStudio.exe Token: SeShutdownPrivilege 1504 RobloxStudio.exe Token: SeRestorePrivilege 1504 RobloxStudio.exe Token: 33 1504 RobloxStudio.exe Token: SeIncBasePriorityPrivilege 1504 RobloxStudio.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1504 RobloxStudio.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Netflix-CE V3.7.zip"1⤵PID:1576
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2408
-
C:\Users\Admin\Downloads\Netflix-CE\RobloxStudio.exe"C:\Users\Admin\Downloads\Netflix-CE\RobloxStudio.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1504