analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://botannews.com/JX/NETFLIX_Checker_Account__By_X-KILLER_(2).7z

Full analysis: https://app.any.run/tasks/5afaa4bf-c195-430c-9d8d-5466f2a7315d
Verdict: Malicious activity
Analysis date: November 29, 2021, 04:48:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

9595FF63642B0942CBE48CD4A19505FD

SHA1:

42E7F4311F7BF24D8BD359216651C3775DD9305A

SHA256:

59585C64E35769394FED01BE2E1EFEA72F35FE2901E330C60BA217515397F1AF

SSDEEP:

3:N1Kcf/AlLGGlHcEKsQLRBGJ2Ls:CcwlUEjevG4Ls

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 2732)

    • Reads the computer name

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2216)

    • Executed via COM

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2216)

    • Checks supported languages

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2216)

    • Creates files in the user directory

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2216)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 2732)

    • Reads the computer name

      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 2732)

    • Changes internet zones settings

      • iexplore.exe (PID: 3276)

    • Application launched itself

      • iexplore.exe (PID: 3276)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 2732)

    • Reads internet explorer settings

      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 2732)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 2732)

    • Creates files in the user directory

      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 2732)
      • iexplore.exe (PID: 3276)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3276)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3276)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3276)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3276)

    • Reads CPU info

      • iexplore.exe (PID: 2732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3276"C:\Program Files\Internet Explorer\iexplore.exe" "http://botannews.com/JX/NETFLIX_Checker_Account__By_X-KILLER_(2).7z"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
572"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3276 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2732"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3276 CREDAT:2495751 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2216C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe� Flash� Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
Total events
47 403
Read events
47 049
Write events
350
Delete events
4

Modification events

(PID) Process:(3276) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3276) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3276) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30926044
(PID) Process:(3276) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3276) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30926044
(PID) Process:(3276) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3276) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3276) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3276) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3276) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
43
Text files
147
Unknown types
57

Dropped files

PID
Process
Filename
Type
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\NETFLIX_Checker_Account__By_X-KILLER_(2)[1].htmhtml
MD5:BAEC0DDD0532F1BC6B6D77C7A919BC3E
SHA256:78B30F4214275FFF0D5F12406566AB7C9DBEC645EB0A0E94F09A3E3AE3A7B2FB
572iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\KIFXNKAM.txttext
MD5:34CD832695E5102694890936E64601DE
SHA256:583C29064214BCF6477B506B71FB4F568606F4B0D630EA59E75E79932766A0D9
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\socialsider-v1.0[1].csstext
MD5:615432B34216CE48AA41B027C9B08F6A
SHA256:F5AF895F7BEB65666327D0629ED30CEBE00DDDEBABBE9D25BE29106234E827A5
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\custom[1].csstext
MD5:76ABA44FECBC5383ABD385540997E4D7
SHA256:AEE1473684074D8D262B2240921B5450F5D528948EE36741FEB42D63D6DD727D
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\settings[1].csstext
MD5:BC105D9115ACC4F705A4F1C29BFDE6DC
SHA256:7FF5C077DF3ECC1BDA2076B20FE146FD3E1130ED39F4B2EC0E49FCEC3DB683E7
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\All-stylesheets[1].csstext
MD5:0317F0C3C8EF4BFDA620908A7C05988B
SHA256:35E93B818DFF2F3AC20CE42E50D2A6EB9E7412605421DECAA95CA9BF604A9DBC
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\flow[1].csstext
MD5:169AFD815E1838D7D572F7514AC3A297
SHA256:CF69BE4C880936352B9E7CDE48459749A82D8A4B0BFE9BE2EB9E74E199181E26
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery-1.11.0.min[1].jstext
MD5:8FC25E27D42774AEAE6EDBC0A18B72AA
SHA256:B294E973896F8F874E90A8EB1A8908AC790980D034C4C4BDF0FC3D37B8ABF682
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\file-upload[1].csstext
MD5:CB955FDB824B31E9B744B6AEF1F99DFE
SHA256:B6264C4C05C786E5215A5FA9FEB5A99A81C924BC26B3E962EEFF230750A2D134
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\responsive[1].csstext
MD5:7F090C009C854FDA38795874DD7CFCF3
SHA256:244C04A213BDB0E13F0D9FA71AF6760886AD9D533F80C1F60E21F632096F5E33
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
105
TCP/UDP connections
131
DNS requests
56
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
572
iexplore.exe
GET
200
172.67.200.29:80
http://botannews.com/JX/NETFLIX_Checker_Account__By_X-KILLER_(2).7z
US
html
24.7 Kb
malicious
572
iexplore.exe
GET
200
172.67.200.29:80
http://botannews.com/themes/flow/frontend_assets/css/All-stylesheets.css
US
text
180 b
malicious
572
iexplore.exe
GET
200
172.67.200.29:80
http://botannews.com/themes/flow/frontend_assets/socialsider-v1.0/_css/socialsider-v1.0.css
US
text
4.00 Kb
malicious
572
iexplore.exe
GET
200
172.67.200.29:80
http://botannews.com/themes/flow/frontend_assets/css/isotope/isotope-style.css
US
text
850 b
malicious
572
iexplore.exe
GET
200
172.67.200.29:80
http://botannews.com/themes/flow/js/jquery.tmpl.min.js
US
text
561 b
malicious
572
iexplore.exe
GET
200
172.67.200.29:80
http://botannews.com/themes/flow/js/jquery-ui.js
US
text
104 Kb
malicious
572
iexplore.exe
GET
200
172.67.200.29:80
http://botannews.com/themes/flow/frontend_assets/fonts/font-awesome/css/font-awesome.css
US
text
4.08 Kb
malicious
572
iexplore.exe
GET
200
172.67.200.29:80
http://botannews.com/themes/flow/frontend_assets/css/stylesheet.css
US
text
4.12 Kb
malicious
572
iexplore.exe
GET
200
172.67.200.29:80
http://botannews.com/themes/flow/frontend_assets/css/custom.css
US
text
3.22 Kb
malicious
572
iexplore.exe
GET
200
172.67.200.29:80
http://botannews.com/themes/flow/frontend_assets/css/bootstrap/bootstrap.min.css
US
text
17.4 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
572
iexplore.exe
104.19.131.80:443
jsc.adskeeper.co.uk
Cloudflare Inc
US
unknown
572
iexplore.exe
104.21.68.54:443
cdn.popmyads.com
Cloudflare Inc
US
unknown
572
iexplore.exe
95.100.146.72:80
ctldl.windowsupdate.com
Akamai Technologies, Inc.
—
suspicious
572
iexplore.exe
142.250.185.168:443
www.googletagmanager.com
Google Inc.
US
suspicious
572
iexplore.exe
172.67.200.29:80
botannews.com
—
US
unknown
572
iexplore.exe
104.20.229.67:443
www.statcounter.com
Cloudflare Inc
US
unknown
572
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
572
iexplore.exe
172.67.187.188:443
cdn.popmyads.com
—
US
unknown
572
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
572
iexplore.exe
142.250.185.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
botannews.com
  • 172.67.200.29
  • 104.21.92.237
malicious
cdn.popmyads.com
  • 104.21.68.54
  • 172.67.187.188
malicious
jsc.adskeeper.co.uk
  • 104.19.131.80
  • 104.19.130.80
  • 104.19.134.80
  • 104.19.132.80
  • 104.19.133.80
whitelisted
www.statcounter.com
  • 104.20.229.67
  • 104.20.228.67
whitelisted
www.googletagmanager.com
  • 142.250.185.168
whitelisted
ctldl.windowsupdate.com
  • 95.100.146.72
  • 95.100.146.43
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.pki.goog
  • 142.250.185.99
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
popmyads.com
  • 172.67.187.188
  • 104.21.68.54
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://botannews.com/JX/NETFLIX_Checker_Account__By_X-KILLER_(2).7z