Analysis
-
max time kernel
111s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/04/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
SupportAssistInstaller.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
SupportAssistInstaller.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
SupportAssistInstaller.exe
-
Size
942KB
-
MD5
df2204b4aa34e8dfd3f5dfd86c1547f6
-
SHA1
d658db83f0e67ff029cdfdec01c951cdfbbea9dc
-
SHA256
048acdd9134baa9c66b4948f567bc5ec42df5e8c296dc027870df2b68be2cf6b
-
SHA512
d681c9f6c7e2d0d5509173b50a13c00ab271450c6f3f6a965046dbc60e4481b88c598817ff1bf31e28dbc4ce43bcf20c985d8a6fa975c6b335eac995b80392cb
-
SSDEEP
12288:yWxR+nKqQl67KhCZLbbL11FWoKnrThtEMQv+LjUCqrfICr7WXqW6Wpqz31mfbWEb:yWxMnKXma
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 296 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 296 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe 296 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2988 2928 SupportAssistInstaller.exe 28 PID 2928 wrote to memory of 2988 2928 SupportAssistInstaller.exe 28 PID 2928 wrote to memory of 2988 2928 SupportAssistInstaller.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\SupportAssistInstaller.exe"C:\Users\Admin\AppData\Local\Temp\SupportAssistInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2928 -s 6402⤵PID:2988
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:296