Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
02/07/2024, 01:15 UTC
General
-
Target
client32.exe
-
Size
101KB
-
MD5
c4f1b50e3111d29774f7525039ff7086
-
SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6
-
SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
-
SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
SSDEEP
768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\client32.exe"C:\Users\Admin\AppData\Local\Temp\client32.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
-
DNSgeo.netsupportsoftware.comRemote address:8.8.8.8:53Requestgeo.netsupportsoftware.comIN AResponsegeo.netsupportsoftware.comIN A172.67.68.212geo.netsupportsoftware.comIN A104.26.1.231geo.netsupportsoftware.comIN A104.26.0.231 -
GEThttp://geo.netsupportsoftware.com/location/loca.aspRemote address:172.67.68.212:80RequestGET /location/loca.asp HTTP/1.1
Host: geo.netsupportsoftware.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Tue, 02 Jul 2024 01:15:25 GMT
Content-Type: text/html; Charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Ray: 89cac8ddb85b942b-LHR
CF-Cache-Status: DYNAMIC
Access-Control-Allow-Origin: *
Cache-Control: private
Set-Cookie: ASPSESSIONIDQSSTATCD=GJPGHFOANFIJMELPFGBFFGAN; path=/
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
cf-apo-via: origin,host
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ED%2B0CLjq9occLZ4z8XEtyHqMhsHIj3QcRLTuAZrb3MryxUn%2BPH1NREMBof0E%2BHaSIjcc%2BvHsl5YOtChRwgs%2FyxyOWC%2B7JigZ8OFXGMVwIkxPa7OT5a4%2B7fBSwOaaSG3DRi2E83pVidWgUYj7"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
-
172.67.68.212:80http://geo.netsupportsoftware.com/location/loca.asphttp
HTTP Request
GET http://geo.netsupportsoftware.com/location/loca.aspHTTP Response
200 -
94.158.245.103:443http
-
8.8.8.8:53geo.netsupportsoftware.comdns
DNS Request
geo.netsupportsoftware.com
DNS Response
172.67.68.212104.26.1.231104.26.0.231