hxxp://194[.]163[.]191[.]205[:]6963/builds/Netflix_Checker[.]exe

Resubmissions

05/08/2024, 23:10

240805-25r75avgqf 8

05/08/2024, 22:48

240805-2rkacsvdjb 8

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://194.163.191.205:6963/builds/Netflix_Checker.exe

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 881462.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
4444	msedge.exe
4444	msedge.exe
964	identity_helper.exe
964	identity_helper.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3876	4444	msedge.exe	84
PID 4444 wrote to memory of 3876	4444	msedge.exe	84
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 3764	4444	msedge.exe	85
PID 4444 wrote to memory of 2072	4444	msedge.exe	86
PID 4444 wrote to memory of 2072	4444	msedge.exe	86
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87
PID 4444 wrote to memory of 1676	4444	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://194.163.191.205:6963/builds/Netflix_Checker.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc603146f8,0x7ffc60314708,0x7ffc60314718
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16107682368794867371,1346511635606012340,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c45b21cd91f7444e640de8d49fdca632

SHA1
d303b85d4a321af45a74a0e8d14f1171a7cc2da5

SHA256
3483a8804a019bf761e6dfa784317b86808e9f06b439a999213bb8be6f1b809b

SHA512
6f85456a14af1e4d7a3b6450bef4f1228941ec883b5a1b77424746e4abaa1e62e56b2a75fdb7af1ec9d17a10054734285ea30966906928a0b487e821d613dbd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ab5ff713bd6635def72ac6c41ab3eba

SHA1
6facb40e9083ae8e472031d3750fb6ab1eae8f7f

SHA256
4c8335c60c8c6beecc366dcae644590559efe2274d615346ac8190aeb428d1be

SHA512
13128a73cdd3965d81bb354f6fbd3bae1b6405394447d609eb5e7f80ab6cccee4928d6c1d727fc4e7525bca0039bf2c7d431b05de70b1bce2c2ec2c4bf88cdb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7d1ccbefbf7fc969e838c2aadd8a9a77

SHA1
529b60233428346bb111d43283fd2d548238ff57

SHA256
724eb372038d241196a31421af696f89436e4d239843e74fd32fd0bab3dd6414

SHA512
c56a767c23ce33810e369d0e4412463c1afb0034b6271e6be5200168817e3ae3d55c9b759755a5f4dd6852c42f9a04af56cf9abc46d522a0f9fbc3874938523d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 881462.crdownload

Filesize
33.8MB

MD5
228bd60ac9836c6a02cbf14efaf15b58

SHA1
94196ef67cbfafe833fa9831ea167daa2c35d3a4

SHA256
a96a6b9ef81a1f7ad1b29e8b50c6dee1ad65df1006f72c6b7a65f382a9fb12c1

SHA512
b844db9e01b1ff362beb0ea48aea35f8a9b37506d55d1ce2d72f753e8848159e795ddc8fa6378b135d15cce1d632e9047329e1a6cfa32411d58e0d81aaff1517

Download Submit