Analysis
-
max time kernel
121s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
16/07/2023, 01:28
General
-
Target
tempy/client32.exe
-
Size
99KB
-
MD5
f70b67c2b3204b7ddd8b755799cccff0
-
SHA1
a42e55e328d62d11e687c167bb7049d46f0f9b26
-
SHA256
213af995d4142854b81af3cf73dee7ffe9d8ad6e84fda6386029101dbf3df897
-
SHA512
54fcba8a063bfbaae4c3a39624bf3407db6af5699ab8686f936ab03c5864df7a44d089066fa2d4aedf5ad50d6b04624966a5111bf57bec1dda74a571f1dd7c63
-
SSDEEP
384:qUjV5+6j6Qa86Fkv2Wr120hZIq6nYPL7NheMxnB1:qgVZl6FhWr80/h6EN/
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tempy\client32.exe"C:\Users\Admin\AppData\Local\Temp\tempy\client32.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow