Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    61s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/01/2023, 12:45

General

  • Target

    dc137d47c0de9a27ba75ddc156fad172.exe

  • Size

    2.3MB

  • MD5

    dc137d47c0de9a27ba75ddc156fad172

  • SHA1

    5accf290472b61f4a835b8aec0845fc94e99f034

  • SHA256

    d88b08d7811ea62dcedcbd7f6e881c8a002ec1f30979d5a99d6d7b549fe8d2b4

  • SHA512

    4869905d68f2fc5530ce9d44486b6bb325637ff836339e7c7b994f896537d0c9bd8441065606bfb26f5b41385826f356da3a32153db1367a4e00dace9be263d4

  • SSDEEP

    49152:py9rkEf91MJKI3aTP6p3xkGAGoCIcVKddqmtJ7xzxWLZ4H:pyhkkPEKIQUXAEI9qmtnx7

Score
10/10

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc137d47c0de9a27ba75ddc156fad172.exe
    "C:\Users\Admin\AppData\Local\Temp\dc137d47c0de9a27ba75ddc156fad172.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\client32.exe
      "C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\client32.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4392

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\HTCTL32.DLL

    Filesize

    299KB

    MD5

    369388ac78ca4ca8a64219cf9aafad4c

    SHA1

    dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d

    SHA256

    c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30

    SHA512

    7d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\HTCTL32.DLL

    Filesize

    299KB

    MD5

    369388ac78ca4ca8a64219cf9aafad4c

    SHA1

    dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d

    SHA256

    c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30

    SHA512

    7d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\MSVCR100.dll

    Filesize

    755KB

    MD5

    0e37fbfa79d349d672456923ec5fbbe3

    SHA1

    4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    SHA256

    8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    SHA512

    2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\NSM.LIC

    Filesize

    258B

    MD5

    113ffa5964cfed7f6ff134323154689b

    SHA1

    417c62ef8c4a8408476d91e6f2cad540d948bff9

    SHA256

    432e7638a9d18866a6bac6968ef5aef0da3719cb44dd39b741bfecd5dc9ed7ff

    SHA512

    a686e789ef8ae4372353eae5a2ecaf2b7da27f815678c9148536ced1029bb0ae5da7267d01c62ce5c0145574b35a8dd31477cee1c20106be4bd51eafce96c6b9

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\PCICAPI.dll

    Filesize

    100KB

    MD5

    f0d7d2a77eee2b3146405d3ad0d56230

    SHA1

    37c323faf58584606ee5847cb9a25346c588f78f

    SHA256

    f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131

    SHA512

    861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\PCICHEK.DLL

    Filesize

    8KB

    MD5

    07b474ab5c503f35873b94cd48d01592

    SHA1

    e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc

    SHA256

    c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4

    SHA512

    a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\PCICL32.DLL

    Filesize

    3.3MB

    MD5

    1274cca13cc5e37ca94d35e5b0673e89

    SHA1

    a8754c94f88273c304bc45a5afd61a383bb52117

    SHA256

    cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd

    SHA512

    52eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\PCICL32.dll

    Filesize

    3.3MB

    MD5

    1274cca13cc5e37ca94d35e5b0673e89

    SHA1

    a8754c94f88273c304bc45a5afd61a383bb52117

    SHA256

    cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd

    SHA512

    52eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\client32.exe

    Filesize

    101KB

    MD5

    c4f1b50e3111d29774f7525039ff7086

    SHA1

    57539c95cba0986ec8df0fcdea433e7c71b724c6

    SHA256

    18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

    SHA512

    005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\client32.exe

    Filesize

    101KB

    MD5

    c4f1b50e3111d29774f7525039ff7086

    SHA1

    57539c95cba0986ec8df0fcdea433e7c71b724c6

    SHA256

    18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

    SHA512

    005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\client32.ini

    Filesize

    944B

    MD5

    b82558a55c408a97fdda8d3e8499ab7b

    SHA1

    57c4f260987d9094d29291d43d9111cd07eab816

    SHA256

    5d1c2c1c7856bac7dc0fd54cf269a1813117984d9a73bcd0b277a4593cb0746b

    SHA512

    bf4a4ba1b954f19da330eb090e8f5245206d55ac1ab4f70d5126cb05436fee04b11fd0c969818e51f9f55fb1037c39df592642d646f4aad4a6b1841992b0082a

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\msvcr100.dll

    Filesize

    755KB

    MD5

    0e37fbfa79d349d672456923ec5fbbe3

    SHA1

    4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    SHA256

    8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    SHA512

    2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\pcicapi.dll

    Filesize

    100KB

    MD5

    f0d7d2a77eee2b3146405d3ad0d56230

    SHA1

    37c323faf58584606ee5847cb9a25346c588f78f

    SHA256

    f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131

    SHA512

    861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade

  • C:\Users\Admin\AppData\Roaming\SupWinUpdate_2023\pcichek.dll

    Filesize

    8KB

    MD5

    07b474ab5c503f35873b94cd48d01592

    SHA1

    e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc

    SHA256

    c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4

    SHA512

    a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8