Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30/01/2023, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
dc137d47c0de9a27ba75ddc156fad172.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dc137d47c0de9a27ba75ddc156fad172.exe
Resource
win10v2004-20221111-en
General
-
Target
dc137d47c0de9a27ba75ddc156fad172.exe
-
Size
2.3MB
-
MD5
dc137d47c0de9a27ba75ddc156fad172
-
SHA1
5accf290472b61f4a835b8aec0845fc94e99f034
-
SHA256
d88b08d7811ea62dcedcbd7f6e881c8a002ec1f30979d5a99d6d7b549fe8d2b4
-
SHA512
4869905d68f2fc5530ce9d44486b6bb325637ff836339e7c7b994f896537d0c9bd8441065606bfb26f5b41385826f356da3a32153db1367a4e00dace9be263d4
-
SSDEEP
49152:py9rkEf91MJKI3aTP6p3xkGAGoCIcVKddqmtJ7xzxWLZ4H:pyhkkPEKIQUXAEI9qmtnx7
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Executes dropped EXE 1 IoCs
pid Process 4392 client32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation dc137d47c0de9a27ba75ddc156fad172.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorunnow2023.ini.lnk dc137d47c0de9a27ba75ddc156fad172.exe -
Loads dropped DLL 5 IoCs
pid Process 4392 client32.exe 4392 client32.exe 4392 client32.exe 4392 client32.exe 4392 client32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 4392 client32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4392 client32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2484 wrote to memory of 4392 2484 dc137d47c0de9a27ba75ddc156fad172.exe 82 PID 2484 wrote to memory of 4392 2484 dc137d47c0de9a27ba75ddc156fad172.exe 82 PID 2484 wrote to memory of 4392 2484 dc137d47c0de9a27ba75ddc156fad172.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc137d47c0de9a27ba75ddc156fad172.exe"C:\Users\Admin\AppData\Local\Temp\dc137d47c0de9a27ba75ddc156fad172.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\client32.exe"C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4392
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
299KB
MD5369388ac78ca4ca8a64219cf9aafad4c
SHA1dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d
SHA256c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30
SHA5127d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5
-
Filesize
299KB
MD5369388ac78ca4ca8a64219cf9aafad4c
SHA1dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d
SHA256c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30
SHA5127d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
258B
MD5113ffa5964cfed7f6ff134323154689b
SHA1417c62ef8c4a8408476d91e6f2cad540d948bff9
SHA256432e7638a9d18866a6bac6968ef5aef0da3719cb44dd39b741bfecd5dc9ed7ff
SHA512a686e789ef8ae4372353eae5a2ecaf2b7da27f815678c9148536ced1029bb0ae5da7267d01c62ce5c0145574b35a8dd31477cee1c20106be4bd51eafce96c6b9
-
Filesize
100KB
MD5f0d7d2a77eee2b3146405d3ad0d56230
SHA137c323faf58584606ee5847cb9a25346c588f78f
SHA256f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131
SHA512861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade
-
Filesize
8KB
MD507b474ab5c503f35873b94cd48d01592
SHA1e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc
SHA256c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4
SHA512a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8
-
Filesize
3.3MB
MD51274cca13cc5e37ca94d35e5b0673e89
SHA1a8754c94f88273c304bc45a5afd61a383bb52117
SHA256cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd
SHA51252eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c
-
Filesize
3.3MB
MD51274cca13cc5e37ca94d35e5b0673e89
SHA1a8754c94f88273c304bc45a5afd61a383bb52117
SHA256cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd
SHA51252eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
944B
MD5b82558a55c408a97fdda8d3e8499ab7b
SHA157c4f260987d9094d29291d43d9111cd07eab816
SHA2565d1c2c1c7856bac7dc0fd54cf269a1813117984d9a73bcd0b277a4593cb0746b
SHA512bf4a4ba1b954f19da330eb090e8f5245206d55ac1ab4f70d5126cb05436fee04b11fd0c969818e51f9f55fb1037c39df592642d646f4aad4a6b1841992b0082a
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
100KB
MD5f0d7d2a77eee2b3146405d3ad0d56230
SHA137c323faf58584606ee5847cb9a25346c588f78f
SHA256f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131
SHA512861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade
-
Filesize
8KB
MD507b474ab5c503f35873b94cd48d01592
SHA1e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc
SHA256c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4
SHA512a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8