Analysis
-
max time kernel
112s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 18:01
Static task
static1
Behavioral task
behavioral1
Sample
BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exe
Resource
win10v2004-20230221-en
General
-
Target
BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exe
-
Size
2.8MB
-
MD5
4025b57f8a01ba6aea3896f7825602d6
-
SHA1
cea9dfe2975297258f964dc1852faa1e2ae014e8
-
SHA256
bf81ccb4452131d4b14953bd9848937647f1259d7c8e7b9083db93de278c4b54
-
SHA512
85e2698b289c522111a7a8f141e0109a11005bc03b3fcf09162561bcb1221398eaa4800533529a91139877c111d0bfb2cfc3136e7525d28c243753c86cc23cca
-
SSDEEP
49152:vL3zTcI+5heQHcUrP4w1HK9mGWNw4FtIelqY/lt3JvU/BkQhKIAYYq:vXTB4eQHDrP4U7N3L/lt3JvvsAYY
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exe -
Drops startup file 1 IoCs
Processes:
BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorunings.ini.lnk BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exe -
Executes dropped EXE 1 IoCs
Processes:
client32.exepid process 1952 client32.exe -
Loads dropped DLL 5 IoCs
Processes:
client32.exepid process 1952 client32.exe 1952 client32.exe 1952 client32.exe 1952 client32.exe 1952 client32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
client32.exedescription pid process Token: SeSecurityPrivilege 1952 client32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
client32.exepid process 1952 client32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exedescription pid process target process PID 3824 wrote to memory of 1952 3824 BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exe client32.exe PID 3824 wrote to memory of 1952 3824 BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exe client32.exe PID 3824 wrote to memory of 1952 3824 BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exe client32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exe"C:\Users\Admin\AppData\Local\Temp\BF81CCB4452131D4B14953BD9848937647F1259D7C8E7.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Roaming\windows_update_318643\client32.exe"C:\Users\Admin\AppData\Roaming\windows_update_318643\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\HTCTL32.DLLFilesize
320KB
MD5c94005d2dcd2a54e40510344e0bb9435
SHA155b4a1620c5d0113811242c20bd9870a1e31d542
SHA2563c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA5122e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\HTCTL32.DLLFilesize
320KB
MD5c94005d2dcd2a54e40510344e0bb9435
SHA155b4a1620c5d0113811242c20bd9870a1e31d542
SHA2563c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA5122e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\MSVCR100.dllFilesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\NSM.LICFilesize
258B
MD5f9ee51cedb764fbcba21cc7300eb76b1
SHA16161714a57270e02155d3630be85371a2779ceb6
SHA256dccf82270fecb485bcea819761e45cb09dac1da846a86cdbb27513c3d6b2fca0
SHA512b81d7a3432fda25fa30a766bfb211d928ae21c3c77996d01527cfd60e438e6e88bcb64ff357fd0713d9116744262113bf9537583aa124bb43fd584c5df6fd344
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\PCICHEK.DLLFilesize
18KB
MD5104b30fef04433a2d2fd1d5f99f179fe
SHA1ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA5125efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\PCICL32.DLLFilesize
3.6MB
MD5d3d39180e85700f72aaae25e40c125ff
SHA1f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA25638684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\PCICL32.dllFilesize
3.6MB
MD5d3d39180e85700f72aaae25e40c125ff
SHA1f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA25638684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\client32.exeFilesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\client32.exeFilesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\client32.exeFilesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\client32.iniFilesize
918B
MD520b38e27ca9720d69b204b8ff46b03c4
SHA13ed5bcdbbb62740b78e01e1324019ea322a5645a
SHA25665e49fcdaf349d4237596cbf6c080fa4fa7eb8b1be1867556e6a6f37fcf1961c
SHA5121c128940eff25b84ee8d5089f103abf5d05ef1820947701d3ea1799bfa9f234f265fdbcc12aed94156195a8555f315d071eb6421a94d9b5670d75c1a61500177
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\msvcr100.dllFilesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\pcicapi.dllFilesize
32KB
MD534dfb87e4200d852d1fb45dc48f93cfc
SHA135b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA2562d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\pcicapi.dllFilesize
32KB
MD534dfb87e4200d852d1fb45dc48f93cfc
SHA135b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA2562d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
-
C:\Users\Admin\AppData\Roaming\windows_update_318643\pcichek.dllFilesize
18KB
MD5104b30fef04433a2d2fd1d5f99f179fe
SHA1ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA5125efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f