164442f00f7c9fa2e5b279d8d16fc3b29bf6dcda098d25f530573f4a3ff30169 | Triage

Submit
Reports

Overview

overview

Static

static

3

281024afqk0.appx

windows7-x64

281024afqk0.appx

windows10-2004-x64

PsfLauncher32.exe

windows7-x64

1

PsfLauncher32.exe

windows10-2004-x64

3

PsfLauncher64.exe

windows7-x64

1

PsfLauncher64.exe

windows10-2004-x64

1

PsfRunDll32.exe

windows7-x64

1

PsfRunDll32.exe

windows10-2004-x64

3

PsfRunDll64.exe

windows7-x64

1

PsfRunDll64.exe

windows10-2004-x64

1

PsfRuntime32.dll

windows7-x64

3

PsfRuntime32.dll

windows10-2004-x64

3

PsfRuntime64.dll

windows7-x64

1

PsfRuntime64.dll

windows10-2004-x64

1

StartingSc...er.ps1

windows7-x64

3

StartingSc...er.ps1

windows10-2004-x64

3

VFS/Progra...13.exe

windows7-x64

3

VFS/Progra...13.exe

windows10-2004-x64

3

VFS/Progra...za.dll

windows7-x64

3

VFS/Progra...za.dll

windows10-2004-x64

3

VFS/Progra...xa.dll

windows7-x64

3

VFS/Progra...xa.dll

windows10-2004-x64

3

VFS/Progra...ar.dll

windows7-x64

3

VFS/Progra...ar.dll

windows10-2004-x64

3

VFS/Progra...64.dll

windows7-x64

1

VFS/Progra...64.dll

windows10-2004-x64

1

VFS/Progra...ar.dll

windows7-x64

1

VFS/Progra...ar.dll

windows10-2004-x64

1

VFS/Progra...za.dll

windows7-x64

1

VFS/Progra...za.dll

windows10-2004-x64

1

VFS/Progra...za.exe

windows7-x64

VFS/Progra...za.exe

windows10-2004-x64

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 17:51

Sharing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

281024afqk0.appx

Resource

win7-20240708-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

281024afqk0.appx

Resource

win10v2004-20241007-en

netsupport discovery execution persistence privilege_escalation rat

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral3

Sample

PsfLauncher32.exe

Resource

win7-20241023-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

PsfLauncher32.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

PsfLauncher64.exe

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

PsfLauncher64.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

PsfRunDll32.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

PsfRunDll32.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

PsfRunDll64.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

PsfRunDll64.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

PsfRuntime32.dll

Resource

win7-20241010-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

PsfRuntime32.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

PsfRuntime64.dll

Resource

win7-20240708-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

PsfRuntime64.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

StartingScriptWrapper.ps1

Resource

win7-20241023-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

StartingScriptWrapper.ps1

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

VFS/ProgramFilesX64/13/13.exe

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

VFS/ProgramFilesX64/13/13.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

VFS/ProgramFilesX64/13/7za.dll

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

VFS/ProgramFilesX64/13/7za.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

VFS/ProgramFilesX64/13/7zxa.dll

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

VFS/ProgramFilesX64/13/7zxa.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

VFS/ProgramFilesX64/13/Far/7-ZipFar.dll

Resource

win7-20241010-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

VFS/ProgramFilesX64/13/Far/7-ZipFar.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral25

Sample

VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

VFS/ProgramFilesX64/13/arm64/7za.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

VFS/ProgramFilesX64/13/arm64/7za.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

VFS/ProgramFilesX64/13/arm64/7za.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

VFS/ProgramFilesX64/13/arm64/7za.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll
Size

458KB
MD5

f8c737ca365dbbae5e0010e75bd641b3
SHA1

997b00a5807ffff06298b11e6c5cd427dc8d2402
SHA256

05c932f7c7391ba29b3dec39a7e273a9b51f1c6bd75b0aa942c08e1fa91dced8
SHA512

5f632dc5f85eab78ba7030be0347e497e309c4ebf109fb765368171ad5e56361f797bc742b25b1296240a02ed55eb4c14b76be849149b3b6367a00792fcdc7be
SSDEEP

12288:SkQxAVquWibWM1ysXvTz4NaGVg/6k+VrKk:lqni6M1yovTz4NaGY6nRK

Score

1^/10

Malware Config

Signatures

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\13\Far\7-ZipFar64.dll,#1
1⤵
PID:4008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2024

Terms | Privacy