Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02/11/2024, 08:07 UTC
General
-
Target
client32.exe
-
Size
101KB
-
MD5
c4f1b50e3111d29774f7525039ff7086
-
SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6
-
SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
-
SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
SSDEEP
768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\client32.exe"C:\Users\Admin\AppData\Local\Temp\client32.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
-
DNSgeo.netsupportsoftware.comRemote address:8.8.8.8:53Requestgeo.netsupportsoftware.comIN AResponsegeo.netsupportsoftware.comIN A104.26.1.231geo.netsupportsoftware.comIN A104.26.0.231geo.netsupportsoftware.comIN A172.67.68.212 -
GEThttp://geo.netsupportsoftware.com/location/loca.aspRemote address:104.26.1.231:80RequestGET /location/loca.asp HTTP/1.1
Host: geo.netsupportsoftware.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 02 Nov 2024 08:07:15 GMT
Content-Type: text/html; Charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Ray: 8dc2a1440973419d-LHR
CF-Cache-Status: DYNAMIC
Access-Control-Allow-Origin: *
Cache-Control: private
Set-Cookie: ASPSESSIONIDSQDTABDQ=HMBIIGICBDMGEEFIGOPMGHIB; path=/
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
cf-apo-via: origin,host
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ixIQdgzQ%2Fd8qsoxMI0nki0GdP5lN1k3gZ4qBAy15jC27%2FQjSRIdWhMdiPtrKvHwWkjIKiXCkmY%2FQ9NxajLohgLXCS1sW5%2FDXgwIq8ugWaxQGRHnKwA7WmUmiXwOoMz%2B5qCTWZw2MBrclnBL2"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=21693&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
-
5.181.159.143:443http
-
104.26.1.231:80http://geo.netsupportsoftware.com/location/loca.asphttp
HTTP Request
GET http://geo.netsupportsoftware.com/location/loca.aspHTTP Response
200
-
8.8.8.8:53geo.netsupportsoftware.comdns
DNS Request
geo.netsupportsoftware.com
DNS Response
104.26.1.231104.26.0.231172.67.68.212