Analysis
-
max time kernel
118s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
20/06/2024, 18:53
General
-
Target
sus.zip
-
Size
3.0MB
-
MD5
f2a03711d2c641a611574fa7e0850d71
-
SHA1
b4a66f287a51a1531ea732dda54c7c673d8d1a75
-
SHA256
d8f8ef643d68039ea91a48532f004dcf4aa05146fd1894b298cab4c7f0477f1b
-
SHA512
c16116df56adca253bb8c055706e34c56045806439959be914b4024f77a280be35e923584722e7836b14bef39d47822cc57eb427de907f0610493bcc30d9524c
-
SSDEEP
98304:D1JFXa/hRFY89YYc9jh23redpmQRbU6nJsjfD:RJSxYoY59V0redpmQRbdnJGD
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\sus.zip1⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Users\Admin\Desktop\client32.exe"C:\Users\Admin\Desktop\client32.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow