Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2024, 11:57 UTC

General

  • Target

    44.exe

  • Size

    2.1MB

  • MD5

    e2c83f35496dbfd0845642ac76224637

  • SHA1

    95ad744cced02c494dfd1ca54933a733e06c0237

  • SHA256

    c45a28d77289e247d95395e4cbcb1d3f7f7133cc6237fc40495064889bb230ff

  • SHA512

    0f3428684aea35e4fcc4d2402168b7a8ee93afaa3d2e25157bfdf7cde4401e599490fe73a3cddc3cc3d32c3b14cb9275e193af4f04d89a86ce04f45b9f36a411

  • SSDEEP

    49152:KB6jq6Rm0EkHbG+Vw6NbHHBp7k5hhelN6YawnqXKwgVRM:s6ufCwYt5ShAiYawJwN

Score
10/10

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44.exe
    "C:\Users\Admin\AppData\Local\Temp\44.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Users\Admin\AppData\Roaming\Suppy2222\star.exe
      "C:\Users\Admin\AppData\Roaming\Suppy2222\star.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2604

Network

  • flag-us
    DNS
    geo.netsupportsoftware.com
    star.exe
    Remote address:
    8.8.8.8:53
    Request
    geo.netsupportsoftware.com
    IN A
    Response
    geo.netsupportsoftware.com
    IN A
    104.26.1.231
    geo.netsupportsoftware.com
    IN A
    104.26.0.231
    geo.netsupportsoftware.com
    IN A
    172.67.68.212
  • flag-us
    GET
    http://geo.netsupportsoftware.com/location/loca.asp
    star.exe
    Remote address:
    104.26.1.231:80
    Request
    GET /location/loca.asp HTTP/1.1
    Host: geo.netsupportsoftware.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Mon, 06 May 2024 11:57:47 GMT
    Content-Type: text/html; charset=us-ascii
    Transfer-Encoding: chunked
    Connection: keep-alive
    CF-Ray: 87f8cb71597823cc-LHR
    CF-Cache-Status: DYNAMIC
    cf-apo-via: origin,host
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6jJ2W1zVvY%2B5DXwWp9B799B7wgPrTZ0cBFfSkdY6igftxeKUjhSNhYx5mDEVMPgVTjk7ZbuiJzI4a8nd2nKJn5%2FLBCcZwa2sG5YqoYhC2UVpQoQ7desCyyA1x9xeYEdGSSRJHiYgC3%2BeL6fa"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
  • flag-us
    GET
    http://geo.netsupportsoftware.com/location/loca.asp
    star.exe
    Remote address:
    104.26.1.231:80
    Request
    GET /location/loca.asp HTTP/1.1
    Host: geo.netsupportsoftware.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Mon, 06 May 2024 11:57:47 GMT
    Content-Type: text/html; Charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    CF-Ray: 87f8cb726d2106e9-LHR
    CF-Cache-Status: DYNAMIC
    Access-Control-Allow-Origin: *
    Cache-Control: private
    Set-Cookie: ASPSESSIONIDSSSRCACB=ONCMDBAAIPGBPBBDFBOELOPJ; path=/
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Accept-Encoding
    cf-apo-via: origin,host
    Referrer-Policy: strict-origin-when-cross-origin
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KYgUpvm5rfnm2W3WRDKY2399UItcszuc%2BxvWTo0behZ%2FnPIMrK5Br5tSoOaB1k3Hmjx1ZiU8ZNur7LHw4zXM5eVPI5r11GjJGRxhde6d0VuSM8Xg3r0kAnKN%2F8oCjBMbyP%2B57GNlS1y%2FeRYV"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
  • 104.26.1.231:80
    http://geo.netsupportsoftware.com/location/loca.asp
    http
    star.exe
    394 B
    1.1kB
    6
    4

    HTTP Request

    GET http://geo.netsupportsoftware.com/location/loca.asp

    HTTP Response

    404
  • 51.195.53.204:5531
    http
    star.exe
    2.0kB
    814 B
    8
    7
  • 104.26.1.231:80
    http://geo.netsupportsoftware.com/location/loca.asp
    http
    star.exe
    394 B
    1.1kB
    6
    5

    HTTP Request

    GET http://geo.netsupportsoftware.com/location/loca.asp

    HTTP Response

    200
  • 8.8.8.8:53
    geo.netsupportsoftware.com
    dns
    star.exe
    72 B
    120 B
    1
    1

    DNS Request

    geo.netsupportsoftware.com

    DNS Response

    104.26.1.231
    104.26.0.231
    172.67.68.212

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Suppy2222\NSM.LIC

    Filesize

    258B

    MD5

    113ffa5964cfed7f6ff134323154689b

    SHA1

    417c62ef8c4a8408476d91e6f2cad540d948bff9

    SHA256

    432e7638a9d18866a6bac6968ef5aef0da3719cb44dd39b741bfecd5dc9ed7ff

    SHA512

    a686e789ef8ae4372353eae5a2ecaf2b7da27f815678c9148536ced1029bb0ae5da7267d01c62ce5c0145574b35a8dd31477cee1c20106be4bd51eafce96c6b9

  • C:\Users\Admin\AppData\Roaming\Suppy2222\PCICL32.dll

    Filesize

    3.6MB

    MD5

    00587238d16012152c2e951a087f2cc9

    SHA1

    c4e27a43075ce993ff6bb033360af386b2fc58ff

    SHA256

    63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

    SHA512

    637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

  • C:\Users\Admin\AppData\Roaming\Suppy2222\client32.ini

    Filesize

    916B

    MD5

    27e8e58f883bde5b8545285378f3b1e4

    SHA1

    fb878dd6a17850f57487222e11b1d4c80cf15ea2

    SHA256

    bfe89b49f3edd46a452da26039d45618316ef61d24a5b18308616e1a0dedfe98

    SHA512

    26c57aac8a12c34360b79037c46b76cfc1d64dc6697d097275c1513126f8ee45bbf904763f91cfebc66196e61b579ccad9a47772cc9ae738431472c308586d66

  • C:\Users\Admin\AppData\Roaming\Suppy2222\pcichek.dll

    Filesize

    18KB

    MD5

    a0b9388c5f18e27266a31f8c5765b263

    SHA1

    906f7e94f841d464d4da144f7c858fa2160e36db

    SHA256

    313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

    SHA512

    6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

  • \Users\Admin\AppData\Roaming\Suppy2222\HTCTL32.DLL

    Filesize

    320KB

    MD5

    2d3b207c8a48148296156e5725426c7f

    SHA1

    ad464eb7cf5c19c8a443ab5b590440b32dbc618f

    SHA256

    edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

    SHA512

    55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

  • \Users\Admin\AppData\Roaming\Suppy2222\msvcr100.dll

    Filesize

    755KB

    MD5

    0e37fbfa79d349d672456923ec5fbbe3

    SHA1

    4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    SHA256

    8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    SHA512

    2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

  • \Users\Admin\AppData\Roaming\Suppy2222\pcicapi.dll

    Filesize

    32KB

    MD5

    dcde2248d19c778a41aa165866dd52d0

    SHA1

    7ec84be84fe23f0b0093b647538737e1f19ebb03

    SHA256

    9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

    SHA512

    c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

  • \Users\Admin\AppData\Roaming\Suppy2222\star.exe

    Filesize

    103KB

    MD5

    8d9709ff7d9c83bd376e01912c734f0a

    SHA1

    e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

    SHA256

    49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

    SHA512

    042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.