Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 22:11

General

  • Target

    Netflix Tools PACK/NetFlix Checker by xRisky v2/debug/Launcher.exe

  • Size

    53KB

  • MD5

    c6d4c881112022eb30725978ecd7c6ec

  • SHA1

    ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

  • SHA256

    0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

  • SHA512

    3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

  • SSDEEP

    768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\NetFlix Checker by xRisky v2\debug\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\NetFlix Checker by xRisky v2\debug\Launcher.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4732
    • C:\Windows\IMF\Windows Services.exe
      "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Windows\IMF\Secure System Shell.exe
        "C:\Windows\IMF\Secure System Shell.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f2lnow2c.m4b.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Windows\IMF\Runtime Explorer.exe

    Filesize

    144KB

    MD5

    5ea4ee24f01613f1bd403312c46b9ec9

    SHA1

    3d76201186437c8e0daba0ee37472fe3c4ef546d

    SHA256

    c81755fe990f1b023bf9b88eed4856c088755af050ea4627ed081a8203f03472

    SHA512

    73b0cc6d49db601b50a5c89b4b0f083a69efd6ff063edc03c93cac16c104173b8a1d172279e88f8a1b17b3b56f27a9fe6f207fde51729292cbacb272c75c8f53

  • C:\Windows\IMF\Secure System Shell.exe

    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

  • C:\Windows\IMF\Windows Services.exe

    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

  • memory/1760-65-0x00000000007C0000-0x00000000007D2000-memory.dmp

    Filesize

    72KB

  • memory/2988-84-0x0000000000960000-0x0000000000972000-memory.dmp

    Filesize

    72KB

  • memory/3264-4-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3264-7-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3264-6-0x00000000069F0000-0x0000000006A6E000-memory.dmp

    Filesize

    504KB

  • memory/3264-66-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3264-0-0x000000007506E000-0x000000007506F000-memory.dmp

    Filesize

    4KB

  • memory/3264-5-0x0000000005340000-0x000000000534A000-memory.dmp

    Filesize

    40KB

  • memory/3264-50-0x0000000006630000-0x000000000664E000-memory.dmp

    Filesize

    120KB

  • memory/3264-49-0x0000000006650000-0x00000000066C6000-memory.dmp

    Filesize

    472KB

  • memory/3264-3-0x0000000005360000-0x00000000053F2000-memory.dmp

    Filesize

    584KB

  • memory/3264-2-0x0000000005AD0000-0x0000000006074000-memory.dmp

    Filesize

    5.6MB

  • memory/3264-1-0x0000000000AA0000-0x0000000000AB4000-memory.dmp

    Filesize

    80KB

  • memory/4732-10-0x0000000004E20000-0x0000000005448000-memory.dmp

    Filesize

    6.2MB

  • memory/4732-80-0x0000000006DD0000-0x0000000006E73000-memory.dmp

    Filesize

    652KB

  • memory/4732-27-0x0000000005C90000-0x0000000005CDC000-memory.dmp

    Filesize

    304KB

  • memory/4732-25-0x00000000055E0000-0x0000000005934000-memory.dmp

    Filesize

    3.3MB

  • memory/4732-20-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4732-13-0x0000000005500000-0x0000000005566000-memory.dmp

    Filesize

    408KB

  • memory/4732-14-0x0000000005570000-0x00000000055D6000-memory.dmp

    Filesize

    408KB

  • memory/4732-12-0x0000000004D20000-0x0000000004D42000-memory.dmp

    Filesize

    136KB

  • memory/4732-11-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4732-9-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4732-68-0x0000000070200000-0x000000007024C000-memory.dmp

    Filesize

    304KB

  • memory/4732-78-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

    Filesize

    120KB

  • memory/4732-67-0x00000000061B0000-0x00000000061E2000-memory.dmp

    Filesize

    200KB

  • memory/4732-26-0x0000000005BE0000-0x0000000005BFE000-memory.dmp

    Filesize

    120KB

  • memory/4732-8-0x00000000022C0000-0x00000000022F6000-memory.dmp

    Filesize

    216KB

  • memory/4732-87-0x0000000007550000-0x0000000007BCA000-memory.dmp

    Filesize

    6.5MB

  • memory/4732-88-0x0000000006F10000-0x0000000006F2A000-memory.dmp

    Filesize

    104KB

  • memory/4732-89-0x0000000006F80000-0x0000000006F8A000-memory.dmp

    Filesize

    40KB

  • memory/4732-90-0x0000000007190000-0x0000000007226000-memory.dmp

    Filesize

    600KB

  • memory/4732-91-0x0000000007110000-0x0000000007121000-memory.dmp

    Filesize

    68KB

  • memory/4732-92-0x0000000007140000-0x000000000714E000-memory.dmp

    Filesize

    56KB

  • memory/4732-93-0x0000000007150000-0x0000000007164000-memory.dmp

    Filesize

    80KB

  • memory/4732-94-0x0000000007250000-0x000000000726A000-memory.dmp

    Filesize

    104KB

  • memory/4732-95-0x0000000007230000-0x0000000007238000-memory.dmp

    Filesize

    32KB

  • memory/4732-98-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB