Analysis
-
max time kernel
122s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
02-11-2023 09:25
General
-
Target
IRomvWG3/presentationhost.exe
-
Size
109KB
-
MD5
b2b27ccaded1db8ee341d5bd2c373044
-
SHA1
1d0f9ca17c0961eeabffc2ba54e16854a13c8a9d
-
SHA256
e4985a9739637aad4a409c95da33a1304dc17fd6ef9046159b27c0b137a57911
-
SHA512
0987b11aa110ea6b6f4fe4361e587aff010508251644bdfb681a578fa4726fb56af039d55e0b74682fd7031414f665a98656186b220264c122a47d23751dcee1
-
SSDEEP
768:O5VZl6FhWr80/0fVtVriR9ri8fbktVtiriXiR3i:O90hG8fVPriPW8jkPsWXio
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IRomvWG3\presentationhost.exe"C:\Users\Admin\AppData\Local\Temp\IRomvWG3\presentationhost.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow