Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

870663b078...e0b.js

windows7-x64

10

870663b078...e0b.js

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2025, 16:45 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    870663b0782a4b7a05e84d4dd8154711c41bb26299365bdc2373f470d81b5e0b.js

  • Size

    3.8MB

  • MD5

    aef27e82cd86ed5003b277fb319beb27

  • SHA1

    52eecb59d4a8a5404f6dc347cd46fbd4ee964995

  • SHA256

    870663b0782a4b7a05e84d4dd8154711c41bb26299365bdc2373f470d81b5e0b

  • SHA512

    16a61f280f5cf3fd04d9e4f9d956fabbc2855f5d0b1c890e614baf5b4f6fd3441b41c8c7de5a768f443128e715eb933d6c09a2855e52cc405b9eb042baa46efb

  • SSDEEP

    49152:Nsz6FvpOiHY7sz6FvpOiHY1+we6AC9L7lARB3QJhut7C6:N0WQ0WZ

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\870663b0782a4b7a05e84d4dd8154711c41bb26299365bdc2373f470d81b5e0b.js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Deletes itself
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\ProgramData\b3jh01v1\client32.exe
      "C:\ProgramData\b3jh01v1\client32.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:264

Network

  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.153.16.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.153.16.2.in-addr.arpa
    IN PTR
    Response
    8.153.16.2.in-addr.arpa
    IN PTR
    a2-16-153-8deploystaticakamaitechnologiescom
  • flag-us
    DNS
    67.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    167.173.78.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    167.173.78.104.in-addr.arpa
    IN PTR
    Response
    167.173.78.104.in-addr.arpa
    IN PTR
    a104-78-173-167deploystaticakamaitechnologiescom
  • flag-ch
    GET
    http://147.45.44.200/z.zip?mt=6006
    wscript.exe
    Remote address:
    147.45.44.200:80
    Request
    GET /z.zip?mt=6006 HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
    Host: 147.45.44.200
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.24.0 (Ubuntu)
    Date: Mon, 20 Jan 2025 16:45:49 GMT
    Content-Type: application/zip
    Content-Length: 6752053
    Connection: keep-alive
    Last-Modified: Sun, 19 Jan 2025 15:27:48 GMT
    ETag: "670735-62c10c949dfdf"
    Accept-Ranges: bytes
  • flag-us
    DNS
    200.44.45.147.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.44.45.147.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    geo.netsupportsoftware.com
    client32.exe
    Remote address:
    8.8.8.8:53
    Request
    geo.netsupportsoftware.com
    IN A
    Response
    geo.netsupportsoftware.com
    IN A
    172.67.68.212
    geo.netsupportsoftware.com
    IN A
    104.26.0.231
    geo.netsupportsoftware.com
    IN A
    104.26.1.231
  • flag-us
    GET
    http://geo.netsupportsoftware.com/location/loca.asp
    client32.exe
    Remote address:
    172.67.68.212:80
    Request
    GET /location/loca.asp HTTP/1.1
    Host: geo.netsupportsoftware.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Mon, 20 Jan 2025 16:45:53 GMT
    Content-Type: text/html; charset=us-ascii
    Transfer-Encoding: chunked
    Connection: keep-alive
    CF-Ray: 9050899bca0a9490-LHR
    CF-Cache-Status: DYNAMIC
    cf-apo-via: origin,host
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EedNdU2HHdGW9YdAilX5mJbA8vgbXj67ON4fwSbCsGLqRtuaSxUASqKwoUi6f6NJkpEz3xVeUOHSBwLBjzUqdaxgut26sUFv17Pm5JrkSes2ZEbp5Mro4yufK%2BYSLyiunxuE7bh43F3o0NQE"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    server-timing: cfL4;desc="?proto=TCP&rtt=47110&min_rtt=47110&rtt_var=23555&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    GET
    http://geo.netsupportsoftware.com/location/loca.asp
    client32.exe
    Remote address:
    172.67.68.212:80
    Request
    GET /location/loca.asp HTTP/1.1
    Host: geo.netsupportsoftware.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Mon, 20 Jan 2025 16:45:54 GMT
    Content-Type: text/html; charset=us-ascii
    Transfer-Encoding: chunked
    Connection: keep-alive
    CF-Ray: 9050899ceb2163e3-LHR
    CF-Cache-Status: DYNAMIC
    cf-apo-via: origin,host
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uE03g0reEmvyqGQQuBDPyo3FbMQ62l4Vmyn%2FwABzXirNBSYuUl8XxXgtp2ODlI4Dr5AOzQqm5WOkjgpQMO%2BT2oHhDEiiiqCap9iL161mJfUOYNmtk%2BiHBB556WMqOIQoftEr4mVIX0RsIM3J"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    server-timing: cfL4;desc="?proto=TCP&rtt=47019&min_rtt=47019&rtt_var=23509&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    GET
    http://geo.netsupportsoftware.com/location/loca.asp
    client32.exe
    Remote address:
    172.67.68.212:80
    Request
    GET /location/loca.asp HTTP/1.1
    Host: geo.netsupportsoftware.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Mon, 20 Jan 2025 16:45:54 GMT
    Content-Type: text/html; charset=us-ascii
    Transfer-Encoding: chunked
    Connection: keep-alive
    CF-Ray: 9050899e2b2ef668-LHR
    CF-Cache-Status: DYNAMIC
    cf-apo-via: origin,host
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nPGEkXImvqO1JIWCrQzLy9n058bMh1K5CKahzsKfZtSvzMvH05gvDI26kZ7uzph9GVNZ357WVbS26u3AAPsI9PehGF9ehiBZXK8m9miFehiJg3SYMqAE%2BlrCDv8ODp6TkDoz64q2GUCgOEK5"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    server-timing: cfL4;desc="?proto=TCP&rtt=48104&min_rtt=48104&rtt_var=24052&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    DNS
    212.68.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.68.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    182.129.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    182.129.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • 147.45.44.200:80
    http://147.45.44.200/z.zip?mt=6006
    http
    wscript.exe
    256.4kB
     7.0MB
     4987
    4979

    HTTP Request

    GET http://147.45.44.200/z.zip?mt=6006

    HTTP Response

    200
  • 147.45.44.255:443
    client32.exe
    260 B
     5
  • 172.67.68.212:80
    http://geo.netsupportsoftware.com/location/loca.asp
    http
    client32.exe
    440 B
     1.3kB
     7
    4

    HTTP Request

    GET http://geo.netsupportsoftware.com/location/loca.asp

    HTTP Response

    404
  • 172.67.68.212:80
    http://geo.netsupportsoftware.com/location/loca.asp
    http
    client32.exe
    440 B
     1.3kB
     7
    4

    HTTP Request

    GET http://geo.netsupportsoftware.com/location/loca.asp

    HTTP Response

    404
  • 172.67.68.212:80
    http://geo.netsupportsoftware.com/location/loca.asp
    http
    client32.exe
    440 B
     1.3kB
     7
    4

    HTTP Request

    GET http://geo.netsupportsoftware.com/location/loca.asp

    HTTP Response

    404
  • 147.45.44.255:443
    client32.exe
    260 B
     5
  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    8.153.16.2.in-addr.arpa
    dns
    69 B
     131 B
     1
    1

    DNS Request

    8.153.16.2.in-addr.arpa

  • 8.8.8.8:53
    67.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    67.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    167.173.78.104.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    167.173.78.104.in-addr.arpa

  • 8.8.8.8:53
    200.44.45.147.in-addr.arpa
    dns
    72 B
     127 B
     1
    1

    DNS Request

    200.44.45.147.in-addr.arpa

  • 8.8.8.8:53
    geo.netsupportsoftware.com
    dns
    client32.exe
    72 B
     120 B
     1
    1

    DNS Request

    geo.netsupportsoftware.com

    DNS Response

    172.67.68.212
    104.26.0.231
    104.26.1.231

  • 8.8.8.8:53
    212.68.67.172.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    212.68.67.172.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    182.129.81.91.in-addr.arpa
    dns
    72 B
     147 B
     1
    1

    DNS Request

    182.129.81.91.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\b3jh01v1.zip
    Filesize

    6.4MB

    MD5

    18605ec1a9b44bd056dfbeef79a27f89

    SHA1

    a67fccff3666f82dc3b517a0bb9a76604c33c9f2

    SHA256

    5d5e67fb50030d44113ab3fff345319a7fc366957c7f9368e94264416de2dbf1

    SHA512

    e839b984a8c06924ef0507050ee406005eb166b8e8edf2c87dc79fecca5750b85d0ef5947183cc8360a3e67c83c33e663f771874b3d643e0150971a9ee056a22

    Download Submit

  • C:\ProgramData\b3jh01v1\HTCTL32.DLL
    Filesize

    320KB

    MD5

    c94005d2dcd2a54e40510344e0bb9435

    SHA1

    55b4a1620c5d0113811242c20bd9870a1e31d542

    SHA256

    3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

    SHA512

    2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

    Download Submit

  • C:\ProgramData\b3jh01v1\MSVCR100.dll
    Filesize

    755KB

    MD5

    0e37fbfa79d349d672456923ec5fbbe3

    SHA1

    4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    SHA256

    8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    SHA512

    2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

    Download Submit

  • C:\ProgramData\b3jh01v1\NSM.LIC
    Filesize

    195B

    MD5

    e9609072de9c29dc1963be208948ba44

    SHA1

    03bbe27d0d1ba651ff43363587d3d6d2e170060f

    SHA256

    dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747

    SHA512

    f0e26aa63b0c7f1b31074b9d6eef88d0cfbc467f86b12205cb539a45b0352e77ce2f99f29baeab58960a197714e72289744143ba17975699d058fe75d978dfd0

    Download Submit

  • C:\ProgramData\b3jh01v1\PCICHEK.DLL
    Filesize

    18KB

    MD5

    104b30fef04433a2d2fd1d5f99f179fe

    SHA1

    ecb08e224a2f2772d1e53675bedc4b2c50485a41

    SHA256

    956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

    SHA512

    5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

    Download Submit

  • C:\ProgramData\b3jh01v1\PCICL32.DLL
    Filesize

    3.6MB

    MD5

    d3d39180e85700f72aaae25e40c125ff

    SHA1

    f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15

    SHA256

    38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5

    SHA512

    471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

    Download Submit

  • C:\ProgramData\b3jh01v1\client32.exe
    Filesize

    101KB

    MD5

    c4f1b50e3111d29774f7525039ff7086

    SHA1

    57539c95cba0986ec8df0fcdea433e7c71b724c6

    SHA256

    18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

    SHA512

    005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

    Download Submit

  • C:\ProgramData\b3jh01v1\client32.ini
    Filesize

    675B

    MD5

    c2f1650f30a58d315d63afcb41477e2c

    SHA1

    07e4bc45bee544addb3adede9707eabdec07e59f

    SHA256

    42c08ee408c75ed058844294e303143012063e6d0689d3b5ad7d8932be159803

    SHA512

    a5acef1bfe7bdb81cb5361654c869a41fd14436e3de0aeffb1388dad1ee3b0bfb02cdeafe61c48395c696e4dcc2eea298bca38527144c35ee1180126b95b1137

    Download Submit

  • C:\ProgramData\b3jh01v1\pcicapi.dll
    Filesize

    32KB

    MD5

    34dfb87e4200d852d1fb45dc48f93cfc

    SHA1

    35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641

    SHA256

    2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703

    SHA512

    f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

    Download Submit

  • C:\ProgramData\b3jh01v1\settings\apprun.dll
    Filesize

    740KB

    MD5

    975ea37829f057463e66b3c237f1c27a

    SHA1

    972cb78912f7e975383a8137a2e982b25333e633

    SHA256

    8b496688cf2d963eca198f0291d1448b0f357fbd764e22db7dcc7b252bd71562

    SHA512

    8463210ed0238785848a65b0d51fbe6b0f67e01a1659a0db5ee9493a1ef3ea9fcd504246e3fde5898ad60692d106319845ebedf6bd9dc159e6b2bfe307ff3d8a

    Download Submit

  • C:\ProgramData\b3jh01v1\settings\avcodec-53.dll
    Filesize

    1.0MB

    MD5

    bba1fe328cea501fcce1e5df16276439

    SHA1

    ed4ad3a8d6f0e3dd86abb19bc18127f960ea2131

    SHA256

    f5522d2c936de8d53f97a6ec439d8f8391cb50a0bc6008a399f9454c00929d35

    SHA512

    8f585d57baa39d3e5e6b62efea53b6b3797319ae86c0c4373774d08e284a49c0bd005e200ae4fabc789470b3f100f98c8ce503fd4702f79dcbf4be4aabc58a9e

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.