Analysis
-
max time kernel
30s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26-03-2023 08:41
Static task
static1
Behavioral task
behavioral1
Sample
359dc605a71b25b69d2e7673202c79c2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
359dc605a71b25b69d2e7673202c79c2.exe
Resource
win10v2004-20230221-en
General
-
Target
359dc605a71b25b69d2e7673202c79c2.exe
-
Size
2.1MB
-
MD5
359dc605a71b25b69d2e7673202c79c2
-
SHA1
e915fd1a5f8483991069cc41abf872489faa7a19
-
SHA256
12cda2b4c69e83ff66a7e583597e6182cc95211c305829b586301906e6351949
-
SHA512
679cdcbaefd73ed866e9e1c8650a8922544acc530c7db792d23bda086d040f35c9665736f1b8d4efbf4456213dec3468a330350bcfcd1acef8810ace0764f3a3
-
SSDEEP
49152:tt6iaPw71zyI2im0OoGZ3/uHOo8PWVjnJEZGVuuRkKsN/CrgjNQ:tt6iaPw71zP2ib7TaW7EZGUQvsAONQ
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Drops startup file 1 IoCs
Processes:
359dc605a71b25b69d2e7673202c79c2.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autoruns.ini.lnk 359dc605a71b25b69d2e7673202c79c2.exe -
Executes dropped EXE 1 IoCs
Processes:
client32.exepid process 1192 client32.exe -
Loads dropped DLL 7 IoCs
Processes:
359dc605a71b25b69d2e7673202c79c2.execlient32.exepid process 1476 359dc605a71b25b69d2e7673202c79c2.exe 1476 359dc605a71b25b69d2e7673202c79c2.exe 1192 client32.exe 1192 client32.exe 1192 client32.exe 1192 client32.exe 1192 client32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
client32.exedescription pid process Token: SeSecurityPrivilege 1192 client32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
client32.exepid process 1192 client32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
359dc605a71b25b69d2e7673202c79c2.exedescription pid process target process PID 1476 wrote to memory of 1192 1476 359dc605a71b25b69d2e7673202c79c2.exe client32.exe PID 1476 wrote to memory of 1192 1476 359dc605a71b25b69d2e7673202c79c2.exe client32.exe PID 1476 wrote to memory of 1192 1476 359dc605a71b25b69d2e7673202c79c2.exe client32.exe PID 1476 wrote to memory of 1192 1476 359dc605a71b25b69d2e7673202c79c2.exe client32.exe PID 1476 wrote to memory of 1192 1476 359dc605a71b25b69d2e7673202c79c2.exe client32.exe PID 1476 wrote to memory of 1192 1476 359dc605a71b25b69d2e7673202c79c2.exe client32.exe PID 1476 wrote to memory of 1192 1476 359dc605a71b25b69d2e7673202c79c2.exe client32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\359dc605a71b25b69d2e7673202c79c2.exe"C:\Users\Admin\AppData\Local\Temp\359dc605a71b25b69d2e7673202c79c2.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSUpdate\client32.exe"C:\Users\Admin\AppData\Roaming\WinSUpdate\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSUpdate\HTCTL32.DLLFilesize
320KB
MD5c94005d2dcd2a54e40510344e0bb9435
SHA155b4a1620c5d0113811242c20bd9870a1e31d542
SHA2563c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA5122e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
-
C:\Users\Admin\AppData\Roaming\WinSUpdate\MSVCR100.dllFilesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
C:\Users\Admin\AppData\Roaming\WinSUpdate\NSM.LICFilesize
258B
MD533e68d7e9c774aab1980f2dd2a39b6e4
SHA13c5d1022686b5e30e7f624024eb8e226b3be4526
SHA2561740227293516f314769787d3b3ea3984763f9359eba68c0c1e0a246c0f0a7c6
SHA512377f09d152c21f4afbeaa169e9f49a802b7c48da02371037a50157a582f0ddddd52212611ea0ccb1ca01165c4f7cd7e989e34316495257b37b3f6a2d60204b4f
-
C:\Users\Admin\AppData\Roaming\WinSUpdate\PCICL32.dllFilesize
3.6MB
MD5d3d39180e85700f72aaae25e40c125ff
SHA1f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA25638684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
-
C:\Users\Admin\AppData\Roaming\WinSUpdate\client32.exeFilesize
103KB
MD5c60ac6a6e6e582ab0ecb1fdbd607705b
SHA1ba9de479beb82fd97bbdfbc04ef22e08224724ba
SHA2564d24b359176389301c14a92607b5c26b8490c41e7e3a2abbc87510d1376f4a87
SHA512f91b964f8b9a0e7445fc260b8c75c831e7ce462701a64a39989304468c9c5ab5d1e8bfe376940484f824b399aef903bf51c679fcf45208426fff7e4e518482ca
-
C:\Users\Admin\AppData\Roaming\WinSUpdate\client32.exeFilesize
103KB
MD5c60ac6a6e6e582ab0ecb1fdbd607705b
SHA1ba9de479beb82fd97bbdfbc04ef22e08224724ba
SHA2564d24b359176389301c14a92607b5c26b8490c41e7e3a2abbc87510d1376f4a87
SHA512f91b964f8b9a0e7445fc260b8c75c831e7ce462701a64a39989304468c9c5ab5d1e8bfe376940484f824b399aef903bf51c679fcf45208426fff7e4e518482ca
-
C:\Users\Admin\AppData\Roaming\WinSUpdate\client32.iniFilesize
927B
MD5da9e054ffa1a0965b8df9b2c88fd7172
SHA17a0c9a9edd837d015656c394ecbb1bdd248583f2
SHA256aa330c62017798f73298697db704ca2fa0e07867ddfc6c947de53bf39642e307
SHA512646d18f0188b747e64db3968e4745aefddb5c4c54b03df7c640dc020b6e91daf668d2b650f7e4afa30d4659642fe3d12217884dac355f502efaefef5f7b61594
-
C:\Users\Admin\AppData\Roaming\WinSUpdate\pcicapi.dllFilesize
32KB
MD534dfb87e4200d852d1fb45dc48f93cfc
SHA135b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA2562d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
-
C:\Users\Admin\AppData\Roaming\WinSUpdate\pcichek.dllFilesize
18KB
MD5104b30fef04433a2d2fd1d5f99f179fe
SHA1ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA5125efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
-
\Users\Admin\AppData\Roaming\WinSUpdate\HTCTL32.DLLFilesize
320KB
MD5c94005d2dcd2a54e40510344e0bb9435
SHA155b4a1620c5d0113811242c20bd9870a1e31d542
SHA2563c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA5122e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
-
\Users\Admin\AppData\Roaming\WinSUpdate\PCICHEK.DLLFilesize
18KB
MD5104b30fef04433a2d2fd1d5f99f179fe
SHA1ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA5125efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
-
\Users\Admin\AppData\Roaming\WinSUpdate\PCICL32.DLLFilesize
3.6MB
MD5d3d39180e85700f72aaae25e40c125ff
SHA1f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA25638684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
-
\Users\Admin\AppData\Roaming\WinSUpdate\client32.exeFilesize
103KB
MD5c60ac6a6e6e582ab0ecb1fdbd607705b
SHA1ba9de479beb82fd97bbdfbc04ef22e08224724ba
SHA2564d24b359176389301c14a92607b5c26b8490c41e7e3a2abbc87510d1376f4a87
SHA512f91b964f8b9a0e7445fc260b8c75c831e7ce462701a64a39989304468c9c5ab5d1e8bfe376940484f824b399aef903bf51c679fcf45208426fff7e4e518482ca
-
\Users\Admin\AppData\Roaming\WinSUpdate\client32.exeFilesize
103KB
MD5c60ac6a6e6e582ab0ecb1fdbd607705b
SHA1ba9de479beb82fd97bbdfbc04ef22e08224724ba
SHA2564d24b359176389301c14a92607b5c26b8490c41e7e3a2abbc87510d1376f4a87
SHA512f91b964f8b9a0e7445fc260b8c75c831e7ce462701a64a39989304468c9c5ab5d1e8bfe376940484f824b399aef903bf51c679fcf45208426fff7e4e518482ca
-
\Users\Admin\AppData\Roaming\WinSUpdate\msvcr100.dllFilesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
\Users\Admin\AppData\Roaming\WinSUpdate\pcicapi.dllFilesize
32KB
MD534dfb87e4200d852d1fb45dc48f93cfc
SHA135b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA2562d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2