a170d688a2bcf3aa19ceb5c1f315c6ce977710c5a4e60a1b61be5fcb971f803e

Analysis

max time kernel
14s
max time network
31s
platform
windows7_x64
resource
win7-20240508-es
resource tags

arch:x64arch:x86image:win7-20240508-eslocale:es-esos:windows7-x64systemwindows
submitted
09/06/2024, 16:48

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

iptv-smarters-pro-1-1-1.exe
Size

122.6MB
MD5

5d9bf1cd3ff70c2173af2e546a0a1470
SHA1

6372920cd2d43543258a06c82b7efd298160e17f
SHA256

a170d688a2bcf3aa19ceb5c1f315c6ce977710c5a4e60a1b61be5fcb971f803e
SHA512

5bbad0fd68d37d9da081b160172fe887db89ea5f8a076a8d62ff15328b409d35b56ad19c72fed63556423bf76844778461cb5ce0970af19a9196d740bf82bcd4
SSDEEP

3145728:CX9+jFe6HYLo1aMYNRcsm9+jFXQQkH2aMYNRcsR:Y64LyatuspsH2atusR

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2632	IPTVSmartersPro.exe
2576	IPTVSmartersPro.exe

Loads dropped DLL 24 IoCs

pid	Process
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
1224	Process not Found
2632	IPTVSmartersPro.exe
2632	IPTVSmartersPro.exe
1224	Process not Found
1224	Process not Found
1224	Process not Found
1224	Process not Found
2576	IPTVSmartersPro.exe
2576	IPTVSmartersPro.exe
1224	Process not Found
2576	IPTVSmartersPro.exe
2576	IPTVSmartersPro.exe
2576	IPTVSmartersPro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe
3004	iptv-smarters-pro-1-1-1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3004	iptv-smarters-pro-1-1-1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2576	2632	IPTVSmartersPro.exe	30
PID 2632 wrote to memory of 2576	2632	IPTVSmartersPro.exe	30
PID 2632 wrote to memory of 2576	2632	IPTVSmartersPro.exe	30

C:\Users\Admin\AppData\Local\Temp\iptv-smarters-pro-1-1-1.exe
"C:\Users\Admin\AppData\Local\Temp\iptv-smarters-pro-1-1-1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\IPTVSmartersPro.exe
"C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\IPTVSmartersPro.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\IPTVSmartersPro.exe
  "C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\IPTVSmartersPro.exe" --type=renderer --no-sandbox --primordial-pipe-token=ACC1AED9FF3098C457AC9345336FFFCE --lang=es --node-integration=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --mojo-channel-token=DE25AA1CE513EA6EAF6CD586B729B48D --mojo-application-channel-token=ACC1AED9FF3098C457AC9345336FFFCE --channel="2632.0.1302684165\1919009418" --mojo-platform-channel-handle=1224 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2576

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:728

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\blink_image_resources_200_percent.pak

Filesize
54KB

MD5
2a8646401e34a9ad258b09cff76d498c

SHA1
7a59d4dd5e9f5ad3e6efce654621a71ad3456ee4

SHA256
38f5acd24b037f39d17a8f3c6c935cd709a2cd84e9e8dd175c04bd1d2dd24407

SHA512
8a3f1abd2d113a928cd003e15332da8b7886834426f20aceb619ce1e397adad7de863079d91c71d2429ddd89bbf88aa56df121b8f2f81102b42aba6b83b96277

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\content_resources_200_percent.pak

Filesize
15B

MD5
7c321056f805aabd5a503821fa1994cd

SHA1
9c690875c9189c66c93ebd4c0971739653bccd19

SHA256
261e6aad3ad0a5f608b5694919ee39026c4c3eb4256540068f7c1aa46be9315a

SHA512
8a5f4b3726e4513251475ac470f86f0daa0d5ae42bb750019ce96ed871cb04a7391cea2cef79e67c585e3a982041575e60d0f79b3a5bb9ad09be53362787f090

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\content_shell.pak

Filesize
9.4MB

MD5
bfdb450e909347096bea8f6427c3d960

SHA1
9b72d27d7db3721841630fefa879d7ada7794422

SHA256
ad62b146780f67c3bc35dd53eff33ef1cbd9f9351b8ecdfe2fd74555479e0f30

SHA512
8f666a9d5087213a1405cb040dcc2653fea4c4cc0a694d37093ab977eada1d52734949883d5699013f1d943f1b19511a3dead15842164f77dfe5d7f0b64bdf2b

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\icudtl.dat

Filesize
9.7MB

MD5
3ed56e55ff45ab973ffc483e5d483a5a

SHA1
5d9d39c80054ed315fa4cac23cd956e3121ce5d0

SHA256
22b4b162fa9c1a35d086df4b2532485c0ddfee4649de8519cfc52a09f749b8ea

SHA512
b8998b76b2691941ea724f404c9b95bfb1593e6fb17d0d7fd57d04069b180a01eec82934357c2dfd48958b6d3d4e3489b111f7c0078134d300710d76f9ee3daf

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\locales\es.pak

Filesize
4KB

MD5
e395a9ad17dba8c88036e1db9e046584

SHA1
f06ac2abc71333d3765afc1d02390ea21e2db260

SHA256
7cd31efe05e8c62b42f67bc5aeb58b54b30f293768b3e4808997d48f734a6cf6

SHA512
89de2628802fa801f9008e02a013ffc32c51278c1fcf230872a71cfde51a6ae9a9d3ed2d80b386be48d2f033b669fa7e74b94507f2d5b7778e62a769655c757e

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\natives_blob.bin

Filesize
358KB

MD5
16a819fdcc843cddfaa0f1d4c7d143bd

SHA1
48d700ab8c8f22aef074d0a3c9f2b40a84a412d5

SHA256
35d85320e2908240da1dc8a577da3aad702936999336a3dcc0576b00c13e9756

SHA512
571f47911441ac31cea080a5d24a38351331dc5d8c9a09ef0ed7f61d439c4f81b27d4e25d73dbc64e192658d3e5415c42026e64cfd0885fb15cdea17cafdd9de

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\resources\app.asar

Filesize
20.2MB

MD5
5b8af802c2dffa6f5a1cb13faed4e37b

SHA1
003f23614dd372c86e37b1aa3c97a00e73203ca2

SHA256
f2d22aa33edf6fc1410dbfd0eaeaea025b3f4a2590b6a78077c870fd3e548179

SHA512
486251626e2296a129be1e0586545df88b1315eee69b3d6ee012aedceb7d052f7c073c7b779749c1c6774025caa3b996906709ffe21b9b806397dc0041afdb5c

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\resources\electron.asar

Filesize
218KB

MD5
360e7ea118f6328e5b848aa38d4be36d

SHA1
883f3c0d8957a773b53a10999b5b92cc48f9501c

SHA256
62a1a3ff912a627537915a89ce6b8e9b184b69fea86912e8e751952a481abc54

SHA512
d8b35cdd1bbf3ff27206118c4ce9f17464f569d2f5f1ebd6662ecccc137d9e9fd5c4a9b8339a584248ad3fd46ed69df88575c49d20a587ae017f855ddc4654d4

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\resources\wcjs-prebuilt\WebChimera.js.node

Filesize
467KB

MD5
2f688722ba2a2e74eedda4540a4fed71

SHA1
1ba757adf336cacae7f93f98d913413bb04956c8

SHA256
85be7b2aae1a67ab5e611dfa364f98bb3565bf6e4a160182ea7a73a93a13bc14

SHA512
154815de038f629114b847093d4e32a91ab5200728d231b63f1dc4731006a81d340a997f14f080e252755dec3b69063ab97664fa41fc69f2887425d210663420

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\resources\wcjs-prebuilt\index.js

Filesize
50B

MD5
8ec2168ee5748f58ed5c9f5bf12e622a

SHA1
ccb68eb409e610332cfd2608c54d6269685ae942

SHA256
4ecbe8ece258439902e1e51bf25431fb13d2d88e360dd14045d7e6f1bb4ab05b

SHA512
57fc020395c88c45e81a4ccdc513692cf9acd72a9ded6803dd35807832ebfc9e72b33a9fc59bc532c450b0ba343005ee6ec1c08c64ded46778e615b28f58e0e2

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\snapshot_blob.bin

Filesize
798KB

MD5
afbd0030e302852245bbeec7ce2f9851

SHA1
1c3b85d097c0ec87ed9919303b630bad7cdbb8a4

SHA256
c67771768256d97c7e7c22d51d77633aa62aafc2a5328b6aa1d77ea1672c6898

SHA512
9530ab250ddac9ec982ce973f58c8b48efc56ddf8ce37279f07db14951df19d9615db9f794756d4840c38a26ee9d3bf0da175ce51a88e2f706e5931d69d3d6f0

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\ui_resources_200_percent.pak

Filesize
82KB

MD5
7a662d039d00e1f17778700fe84d6033

SHA1
fb2c2ab437400e7dc6517d5cc4dc4b78035bbf38

SHA256
d6130c8ffad8e50588aa8d67ad6b17e6bd5c302b96b127918447f3467823979e

SHA512
1bce59ec7f7d129b9d1da87e42af95c91f1a8cfb66e467957451ca80b5966aaea39e558d81b62063a69d1c448e2468b5ac5d483c7187ce1a3389c2e1e695861f

Download Submit
C:\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\views_resources_200_percent.pak

Filesize
58KB

MD5
33bfef730b188ba8e055bffbce21e3bd

SHA1
d45712e6306a98daba38af821670565761fb414e

SHA256
1fdfb1282c34ad7e4752a8fbbf096a3b5c8e25dbc8e15c27ff9dfd3588b989a3

SHA512
d3da472546bc25184401d0584bc8f2247b1f0ab60473e61cd34b96c7b0648355314490ba622749635f4be50fa152953e42b38fef959fd2ba5b0210e6021594c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5BDE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi3B2D.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\ffmpeg.dll

Filesize
2.2MB

MD5
8c0576bb699509ee6e7688b93989b2a5

SHA1
785e84a4d013ad43e5e6988a70d14a31afe7733a

SHA256
549dc9535b6f8c071a976d4efb20039585627aa819c2b68b0d5a7deb73bdaa47

SHA512
9fc734fccac6f5cd4a4bd611b757a32d8d72400eefe236bdcb73b8338fe7953380ec14a1736a371de939a9d099b14822147ef6364e2b2e2f0235c3c84b6608e1

Download Submit
\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\node.dll

Filesize
15.9MB

MD5
2dcd87222cc29c1e079d3f5d72fd9a7e

SHA1
15b4d95ab0207f9d1d698f2e6685232d024ec3b8

SHA256
77c89c85d4a9ffd1ca1a5ab7c1dd2b33fd621f141114372467cfe46dbd0258bb

SHA512
3bededb47ce55af8028c66577f613a871f510a720bd9e430f1879fd5bf0f108b1470f1ee3cb2f64d6feec62f336682f33c4177db6edae76a11a820ba4c7da295

Download Submit
\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\resources\wcjs-prebuilt\libvlc.dll

Filesize
148KB

MD5
6611170457d3906ccd615f58c4c347c2

SHA1
81c2b81836cad87d1e2c6668ab6f624f86e8281b

SHA256
a9704ab856da74ea75fa024ff0ac1eb91b7c632649cf195437603af43c03a807

SHA512
0115a3392e7b95035279f9f3f24f63fb754708cdc9d13ce4055877745d18c7d6f92eb86593088d515ca5d1191764f5cf5631ecf0e993bc04cf049e392f35b602

Download Submit
\Users\Admin\AppData\Local\Programs\IPTVSmartersPro\resources\wcjs-prebuilt\libvlccore.dll

Filesize
2.6MB

MD5
f2cc731f9c326c49aaf51857c1f81d84

SHA1
aaa37dead4316a26955575be17dc1ce3a3e96334

SHA256
6fb53a2d94371c68b071765b37bcce0023015c524e296eb1b36725af1151b802

SHA512
cd44cd8c034f805aec3e06c1bd00cdd74edcfc01fca9665d5fbfd186c945a81c207c1ad6eab9afc5ad7378bfeff777d56f7f60a7041600be502f0d56d190f41c

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3B2D.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3B2D.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3B2D.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3B2D.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3B2D.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/2576-887-0x0000000074820000-0x000000007484E000-memory.dmp

Filesize
184KB

Download
memory/2576-888-0x0000000074280000-0x000000007452D000-memory.dmp

Filesize
2.7MB

Download
memory/3004-787-0x00000000029C0000-0x00000000029C2000-memory.dmp

Filesize
8KB

Download