Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
Advanced_IP_Scanner_2.5.4594.1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
Advanced_IP_Scanner_2.5.4594.1.exe
Resource
win11-20240802-en
General
-
Target
Advanced_IP_Scanner_2.5.4594.1.exe
-
Size
19.4MB
-
MD5
992f8e84f2e21ae93c54f4cac8ee971a
-
SHA1
5538d123c15fda1dbb1ae5b83b125a8e968ed52c
-
SHA256
8868c187d09c7474f200c8ffef6141ae9dd7e482641e62c923a43f085cf99117
-
SHA512
98dd1954c03d68659fef7910f87994984580a8b6d9a7583122697af76ee8dbb49584de00e720d9febdbc249901c41b140a41c9b374985e439bfaba7d3ad18813
-
SSDEEP
393216:xjU8zx7KRxNGGNIQl9sFH1vEZRN/AGuQZ9TLDay9uFaU6TQTA:xjU8MRiGNIQlufvuNoZQZ5DSDTA
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Advanced_IP_Scanner_2.5.4594.1.tmp -
Executes dropped EXE 2 IoCs
pid Process 5092 Advanced_IP_Scanner_2.5.4594.1.tmp 5064 client32.exe -
Loads dropped DLL 6 IoCs
pid Process 5064 client32.exe 5064 client32.exe 5064 client32.exe 5064 client32.exe 5064 client32.exe 5064 client32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MyAppClient = "\"C:\\Users\\Admin\\AppData\\Roaming\\windowsprint\\client32.exe\"" Advanced_IP_Scanner_2.5.4594.1.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
pid Process 3616 powershell.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Advanced IP Scanner\is-5OP1E.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\advanced_ip_scanner.exe Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-19725.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-855S3.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-Q3B1L.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-EH9N9.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-debug-l1-1-0.dll Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-crt-time-l1-1-0.dll Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-FSDGQ.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-USIJA.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-2UIOK.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-ORCKJ.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-file-l1-2-0.dll Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-processthreads-l1-1-0.dll Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-processthreads-l1-1-1.dll Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-CD6FG.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-PUM9U.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-console-l1-1-0.dll Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-D75Q8.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-A72UB.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-crt-utility-l1-1-0.dll Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-V4V9N.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-45SIO.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-OPUHI.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\Qt5PrintSupport.dll Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\pcre.dll Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-9SPJ7.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-US642.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-HHC9S.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\unins000.dat Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-KAE1K.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-IU3EO.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-OJINI.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-rtlsupport-l1-1-0.dll Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\vcruntime140.dll Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\ucrtbase.dll Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-RBCUN.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-SUC1S.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-crt-stdio-l1-1-0.dll Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-1UPEF.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-crt-heap-l1-1-0.dll Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-M94AR.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-EAHDK.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-770JG.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-8SS9E.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-7EJ7N.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-QT4BA.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-synch-l1-1-0.dll Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\advanced_ip_scanner_console.exe Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-9UVTM.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-BF07Q.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File opened for modification C:\Program Files (x86)\Advanced IP Scanner\printsupport\windowsprintersupport.dll Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-CGJLK.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-69MVJ.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-QLGFF.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-1DT2I.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-2Q95J.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-5R4NN.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-6LF6M.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-GJJHE.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-G16EJ.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-UQTC0.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-LA4VM.tmp Advanced_IP_Scanner_2.5.4594.1.tmp File created C:\Program Files (x86)\Advanced IP Scanner\is-1DD1Q.tmp Advanced_IP_Scanner_2.5.4594.1.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Advanced_IP_Scanner_2.5.4594.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Advanced_IP_Scanner_2.5.4594.1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 5092 Advanced_IP_Scanner_2.5.4594.1.tmp 5092 Advanced_IP_Scanner_2.5.4594.1.tmp 3616 powershell.exe 3616 powershell.exe 3616 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3616 powershell.exe Token: SeSecurityPrivilege 5064 client32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5092 Advanced_IP_Scanner_2.5.4594.1.tmp 5064 client32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 400 wrote to memory of 5092 400 Advanced_IP_Scanner_2.5.4594.1.exe 87 PID 400 wrote to memory of 5092 400 Advanced_IP_Scanner_2.5.4594.1.exe 87 PID 400 wrote to memory of 5092 400 Advanced_IP_Scanner_2.5.4594.1.exe 87 PID 5092 wrote to memory of 3616 5092 Advanced_IP_Scanner_2.5.4594.1.tmp 98 PID 5092 wrote to memory of 3616 5092 Advanced_IP_Scanner_2.5.4594.1.tmp 98 PID 5092 wrote to memory of 3616 5092 Advanced_IP_Scanner_2.5.4594.1.tmp 98 PID 3616 wrote to memory of 5064 3616 powershell.exe 100 PID 3616 wrote to memory of 5064 3616 powershell.exe 100 PID 3616 wrote to memory of 5064 3616 powershell.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\Advanced_IP_Scanner_2.5.4594.1.exe"C:\Users\Admin\AppData\Local\Temp\Advanced_IP_Scanner_2.5.4594.1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\is-KKLQN.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp"C:\Users\Admin\AppData\Local\Temp\is-KKLQN.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp" /SL5="$5027C,19517298,785920,C:\Users\Admin\AppData\Local\Temp\Advanced_IP_Scanner_2.5.4594.1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process 'C:\Users\Admin\AppData\Roaming\windowsprint\client32.exe' -WindowStyle Normal}"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Roaming\windowsprint\client32.exe"C:\Users\Admin\AppData\Roaming\windowsprint\client32.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5064
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5b3411927cc7cd05e02ba64b2a789bbde
SHA1b26cfde4ca74d5d5377889bba5b60b5fc72dda75
SHA2564b036cc9930bb42454172f888b8fde1087797fc0c9d31ab546748bd2496bd3e5
SHA512732c750fa31d31bf4c5143938096feb37df5e18751398babd05c01d0b4e5350238b0de02d0cdfd5ba6d1b942cb305be091aac9fe0aad9fc7ba7e54a4dbc708fd
-
Filesize
1KB
MD588b009ccacf0eb1b4a141470d3f160c4
SHA1ee0d1a44562ccdedbcde92d232fa541f53826b4b
SHA256d2254ed99166a12ce00f93379142acfcbf9a49af3fb8789e8215b0c1cccb4587
SHA512d07c7b90a12e7e48a90bf450a57e4479ae5bb130efe9950a316d9a7ab9063d94af0f35942925aca41a7c2c149a0f31a075c38dd0b34821f88bd81588660d0be1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.0MB
MD53d0211a3fdd3ec3a608fe3faad1751da
SHA113427773b5447f98a2e2d72d1b17abe7ab33e717
SHA256b3125d7334dfda9e0f55ed1e5a1f525f93ee0e6d5654c7051ff9cf6109fb6871
SHA5125795d9febd2d3f5451ca7df77a7d675be53285216c6cfd06175925dc620ee924ecfe8ae5f1ba277bf6143a2c80cb4a2d63da65e66c9798fb6f30810aa368f62d
-
Filesize
320KB
MD52d3b207c8a48148296156e5725426c7f
SHA1ad464eb7cf5c19c8a443ab5b590440b32dbc618f
SHA256edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
SHA51255c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
259B
MD5866c96ba2823ac5fe70130dfaaa08531
SHA1892a656da1ea264c73082da8c6e5f5728abcb861
SHA2566a7c99e4bd767433c25d6df8df81baa99c05dd24fa064e45c306ff4d954e1921
SHA5120dafc66222bbfcb1558d9845ee4ddeb7a687561b08b86a07b66b120c22952a8082e041d9234d9c69c8ade5d4dae894d3f10afd7ba6dd3f057a08fb5d57c42112
-
Filesize
18KB
MD5a0b9388c5f18e27266a31f8c5765b263
SHA1906f7e94f841d464d4da144f7c858fa2160e36db
SHA256313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
SHA5126051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
-
Filesize
3.5MB
MD5214a714ef11c2c91162a9344bf8f2e50
SHA1b87886b6b1e48e5e54e3033be9a73b67b5a5c282
SHA25674dfcd891813058b29b0a70ec0a95f31cd5356f175ad3a492daecbc52542e76f
SHA512a785d390c7e066628c9894302ca10ac21ba79d9988523d5abcb960870a39112d01984a86cde0bcd3862d46d82696e35ba760d96a389c96553ecb1db9c3a0d97d
-
Filesize
118KB
MD54f2d0f4a5ba798fa9e85379c7c4bd36e
SHA1e533f2318d232ef3e1b22bdd1d6b61c081c6d6eb
SHA256aaa12a1ad8c748fbfd4c8f2e5023ec3481b18cb088b28737fc7e665163cff41d
SHA5124c338e4f87f5ac9e9339e663739b021f06d8ee48f7a5981ccdf85029888964e3c416331c7ec791933a6b3d56ec44bb3719a38039f625a25b86ba0264e3d2d609
-
Filesize
645B
MD55c6b0a287deb8eaf840ef373cfcf8976
SHA15b9243694c1f7906199ab4788478143809ec4b2e
SHA2562676dc37a1451913055367d8a3766ad910dd6c3ad0af29e48b48456996d0f9d0
SHA5127e47066305ea7557615102625904e4b6e11dd400f87bd18ce306b094acd9bebeb6f61b55c0b397ca2d90ff94f8b7ef9e2b642d5d5542c4f0492f575601e65b68
-
Filesize
32KB
MD5dcde2248d19c778a41aa165866dd52d0
SHA17ec84be84fe23f0b0093b647538737e1f19ebb03
SHA2569074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
SHA512c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166