Analysis
-
max time kernel
194s -
max time network
203s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
-
submitted
17-07-2024 21:51
General
-
Target
readme.zip
-
Size
2.2MB
-
MD5
a6bbb79e2c1aceebd644e83ac7be57ff
-
SHA1
cb1b0f509cbed77f6c7d6ce35f469f01211bb667
-
SHA256
0929449c2299832fe787d7b24836ecffb925e17ce915da1a90b99c49e77b56d3
-
SHA512
6d36583e7dec8b366e544c51cdc69874e69a777c515ca2fae455d3227bf18de01a7d3e541d1dccecb9c32d18ac400e58564162d79ff8b3775354b210bb75952a
-
SSDEEP
49152:Z2wryYE54IgBWACd8NNnBW/wY+3w/WTQFqNdjcC7NbbZnN7JlVG5PWZ5FvcBc:0wryZ5hbARCw51TQFqNdQaZJbIP+Uc
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\readme.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\yeee\client32.exe"C:\Users\Admin\Desktop\yeee\client32.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\yeee\client32.exe"C:\Users\Admin\Desktop\yeee\client32.exe"1⤵
-
C:\Users\Admin\Desktop\yeee\client32.exe"C:\Users\Admin\Desktop\yeee\client32.exe"1⤵