Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Netflix Ch...nt.dll
windows7-x64
1Netflix Ch...nt.dll
windows10-2004-x64
1Netflix Ch...et.dll
windows7-x64
1Netflix Ch...et.dll
windows10-2004-x64
1Netflix Ch...nt.dll
windows7-x64
1Netflix Ch...nt.dll
windows10-2004-x64
1Netflix Ch...et.dll
windows7-x64
1Netflix Ch...et.dll
windows10-2004-x64
1Netflix Ch...ix.exe
windows7-x64
7Netflix Ch...ix.exe
windows10-2004-x64
7Netflix Ch...x1.exe
windows7-x64
10Netflix Ch...x1.exe
windows10-2004-x64
10Netflix Ch...on.dll
windows7-x64
1Netflix Ch...on.dll
windows10-2004-x64
1Netflix Ch...on.dll
windows7-x64
1Netflix Ch...on.dll
windows10-2004-x64
1Netflix Ch...er.bat
windows7-x64
10Netflix Ch...er.bat
windows10-2004-x64
10Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/11/2024, 06:17
Behavioral task
behavioral1
Sample
Netflix Checker/Data/Jint.dll
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Netflix Checker/Data/Jint.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Netflix Checker/Data/Leaf.xNet.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Netflix Checker/Data/Leaf.xNet.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Netflix Checker/Data/Modules/Jint.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Netflix Checker/Data/Modules/Jint.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Netflix Checker/Data/Modules/Leaf.xNet.dll
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
Netflix Checker/Data/Modules/Leaf.xNet.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Netflix Checker/Data/Modules/Netflix.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Netflix Checker/Data/Modules/Netflix.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Netflix Checker/Data/Modules/Netflix1.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Netflix Checker/Data/Modules/Netflix1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Netflix Checker/Data/Modules/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Netflix Checker/Data/Modules/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Netflix Checker/Data/Newtonsoft.Json.dll
Resource
win7-20241023-en
Behavioral task
behavioral16
Sample
Netflix Checker/Data/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Netflix Checker/Start Checker.bat
Resource
win7-20240903-en
General
-
Target
Netflix Checker/Start Checker.bat
-
Size
63B
-
MD5
2b82a3b6410ab67ea4626cecc7738f85
-
SHA1
a08e383f0425af31b60297f640826cad1c1dbb54
-
SHA256
78af9d7b81f8de001f209e072a9184b350d0621392cfabb4ef9395d854bac82c
-
SHA512
35c9d284d0d4185491700f7a84a7c6d1efd7454df9e04d2dd3664329243a4e837aa6abbb4dde5c5b71fef89b9d103923e88fa39b4c6aacf7fafd0043f75b2fd5
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral17/memory/1892-43-0x0000000000D70000-0x0000000000DB0000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1684 powershell.exe 1408 powershell.exe 2232 powershell.exe 704 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Netflix1.exe -
Loads dropped DLL 7 IoCs
pid Process 2680 Netflix.exe 2680 Netflix.exe 2680 Netflix.exe 2680 Netflix.exe 2680 Netflix.exe 2680 Netflix.exe 2680 Netflix.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 10 discord.com 9 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1856 PING.EXE 2540 cmd.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2140 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1856 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1892 Netflix1.exe 1684 powershell.exe 1408 powershell.exe 2232 powershell.exe 1636 powershell.exe 704 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1892 Netflix1.exe Token: SeIncreaseQuotaPrivilege 1116 wmic.exe Token: SeSecurityPrivilege 1116 wmic.exe Token: SeTakeOwnershipPrivilege 1116 wmic.exe Token: SeLoadDriverPrivilege 1116 wmic.exe Token: SeSystemProfilePrivilege 1116 wmic.exe Token: SeSystemtimePrivilege 1116 wmic.exe Token: SeProfSingleProcessPrivilege 1116 wmic.exe Token: SeIncBasePriorityPrivilege 1116 wmic.exe Token: SeCreatePagefilePrivilege 1116 wmic.exe Token: SeBackupPrivilege 1116 wmic.exe Token: SeRestorePrivilege 1116 wmic.exe Token: SeShutdownPrivilege 1116 wmic.exe Token: SeDebugPrivilege 1116 wmic.exe Token: SeSystemEnvironmentPrivilege 1116 wmic.exe Token: SeRemoteShutdownPrivilege 1116 wmic.exe Token: SeUndockPrivilege 1116 wmic.exe Token: SeManageVolumePrivilege 1116 wmic.exe Token: 33 1116 wmic.exe Token: 34 1116 wmic.exe Token: 35 1116 wmic.exe Token: SeIncreaseQuotaPrivilege 1116 wmic.exe Token: SeSecurityPrivilege 1116 wmic.exe Token: SeTakeOwnershipPrivilege 1116 wmic.exe Token: SeLoadDriverPrivilege 1116 wmic.exe Token: SeSystemProfilePrivilege 1116 wmic.exe Token: SeSystemtimePrivilege 1116 wmic.exe Token: SeProfSingleProcessPrivilege 1116 wmic.exe Token: SeIncBasePriorityPrivilege 1116 wmic.exe Token: SeCreatePagefilePrivilege 1116 wmic.exe Token: SeBackupPrivilege 1116 wmic.exe Token: SeRestorePrivilege 1116 wmic.exe Token: SeShutdownPrivilege 1116 wmic.exe Token: SeDebugPrivilege 1116 wmic.exe Token: SeSystemEnvironmentPrivilege 1116 wmic.exe Token: SeRemoteShutdownPrivilege 1116 wmic.exe Token: SeUndockPrivilege 1116 wmic.exe Token: SeManageVolumePrivilege 1116 wmic.exe Token: 33 1116 wmic.exe Token: 34 1116 wmic.exe Token: 35 1116 wmic.exe Token: SeDebugPrivilege 1684 powershell.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeDebugPrivilege 1636 powershell.exe Token: SeIncreaseQuotaPrivilege 772 wmic.exe Token: SeSecurityPrivilege 772 wmic.exe Token: SeTakeOwnershipPrivilege 772 wmic.exe Token: SeLoadDriverPrivilege 772 wmic.exe Token: SeSystemProfilePrivilege 772 wmic.exe Token: SeSystemtimePrivilege 772 wmic.exe Token: SeProfSingleProcessPrivilege 772 wmic.exe Token: SeIncBasePriorityPrivilege 772 wmic.exe Token: SeCreatePagefilePrivilege 772 wmic.exe Token: SeBackupPrivilege 772 wmic.exe Token: SeRestorePrivilege 772 wmic.exe Token: SeShutdownPrivilege 772 wmic.exe Token: SeDebugPrivilege 772 wmic.exe Token: SeSystemEnvironmentPrivilege 772 wmic.exe Token: SeRemoteShutdownPrivilege 772 wmic.exe Token: SeUndockPrivilege 772 wmic.exe Token: SeManageVolumePrivilege 772 wmic.exe Token: 33 772 wmic.exe Token: 34 772 wmic.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2368 2352 cmd.exe 31 PID 2352 wrote to memory of 2368 2352 cmd.exe 31 PID 2352 wrote to memory of 2368 2352 cmd.exe 31 PID 2352 wrote to memory of 1892 2352 cmd.exe 33 PID 2352 wrote to memory of 1892 2352 cmd.exe 33 PID 2352 wrote to memory of 1892 2352 cmd.exe 33 PID 2368 wrote to memory of 2680 2368 Netflix.exe 34 PID 2368 wrote to memory of 2680 2368 Netflix.exe 34 PID 2368 wrote to memory of 2680 2368 Netflix.exe 34 PID 1892 wrote to memory of 1116 1892 Netflix1.exe 35 PID 1892 wrote to memory of 1116 1892 Netflix1.exe 35 PID 1892 wrote to memory of 1116 1892 Netflix1.exe 35 PID 1892 wrote to memory of 296 1892 Netflix1.exe 38 PID 1892 wrote to memory of 296 1892 Netflix1.exe 38 PID 1892 wrote to memory of 296 1892 Netflix1.exe 38 PID 1892 wrote to memory of 1684 1892 Netflix1.exe 40 PID 1892 wrote to memory of 1684 1892 Netflix1.exe 40 PID 1892 wrote to memory of 1684 1892 Netflix1.exe 40 PID 1892 wrote to memory of 1408 1892 Netflix1.exe 42 PID 1892 wrote to memory of 1408 1892 Netflix1.exe 42 PID 1892 wrote to memory of 1408 1892 Netflix1.exe 42 PID 1892 wrote to memory of 2232 1892 Netflix1.exe 44 PID 1892 wrote to memory of 2232 1892 Netflix1.exe 44 PID 1892 wrote to memory of 2232 1892 Netflix1.exe 44 PID 1892 wrote to memory of 1636 1892 Netflix1.exe 46 PID 1892 wrote to memory of 1636 1892 Netflix1.exe 46 PID 1892 wrote to memory of 1636 1892 Netflix1.exe 46 PID 1892 wrote to memory of 772 1892 Netflix1.exe 48 PID 1892 wrote to memory of 772 1892 Netflix1.exe 48 PID 1892 wrote to memory of 772 1892 Netflix1.exe 48 PID 1892 wrote to memory of 1780 1892 Netflix1.exe 50 PID 1892 wrote to memory of 1780 1892 Netflix1.exe 50 PID 1892 wrote to memory of 1780 1892 Netflix1.exe 50 PID 1892 wrote to memory of 1412 1892 Netflix1.exe 52 PID 1892 wrote to memory of 1412 1892 Netflix1.exe 52 PID 1892 wrote to memory of 1412 1892 Netflix1.exe 52 PID 1892 wrote to memory of 704 1892 Netflix1.exe 54 PID 1892 wrote to memory of 704 1892 Netflix1.exe 54 PID 1892 wrote to memory of 704 1892 Netflix1.exe 54 PID 1892 wrote to memory of 2140 1892 Netflix1.exe 56 PID 1892 wrote to memory of 2140 1892 Netflix1.exe 56 PID 1892 wrote to memory of 2140 1892 Netflix1.exe 56 PID 1892 wrote to memory of 2540 1892 Netflix1.exe 58 PID 1892 wrote to memory of 2540 1892 Netflix1.exe 58 PID 1892 wrote to memory of 2540 1892 Netflix1.exe 58 PID 2540 wrote to memory of 1856 2540 cmd.exe 60 PID 2540 wrote to memory of 1856 2540 cmd.exe 60 PID 2540 wrote to memory of 1856 2540 cmd.exe 60 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 296 attrib.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Start Checker.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix.exeData\Modules\Netflix.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix.exeData\Modules\Netflix.exe3⤵
- Loads dropped DLL
PID:2680
-
-
-
C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exeData\Modules\Netflix1.exe2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe"3⤵
- Views/modifies file attributes
PID:296
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:772
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:1780
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:1412
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:704
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:2140
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Netflix Checker\Data\Modules\Netflix1.exe" && pause3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\system32\PING.EXEping localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1856
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD51c58526d681efe507deb8f1935c75487
SHA10e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA5128edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1
-
Filesize
21KB
MD5724223109e49cb01d61d63a8be926b8f
SHA1072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA2564e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
SHA51219b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c
-
Filesize
21KB
MD5517eb9e2cb671ae49f99173d7f7ce43f
SHA14ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA25657cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
SHA512492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be
-
Filesize
21KB
MD5d12403ee11359259ba2b0706e5e5111c
SHA103cc7827a30fd1dee38665c0cc993b4b533ac138
SHA256f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
SHA5129004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0
-
Filesize
5.8MB
MD5b9de917b925dd246b709bb4233777efd
SHA1775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA2560c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
SHA512f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD54b4d1205fd0922c0dba6776e4b908b1b
SHA147a6b32fe0070941accce15138da7f0140ecf186
SHA2564061c11cd491b89e143873df0f02d3b8e680c4ba604525b622ec3c4eb2e5b1c0
SHA5126b2906fc3b59e0a4d6784d4ba92bbc8a92ce4e9eadf40577a1976357653d9bbe3363d93ee2a4be813c546a4f607d6126c1ffe48398601bb0a473879673da7199
-
Filesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
Filesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd