Overview

overview

10

Static

static

1

79040421b5...89.msi

windows7-x64

10

79040421b5...89.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-02-2025 03:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    79040421b5a48dcc6e611dfe187b2f3e355791ad8511adb84f5c0948aa1d6c89.msi

  • Size

    39.7MB

  • MD5

    87ef82757aba83e7eb63c7c35dbae97a

  • SHA1

    7418c4ddeecba68e253e89622ad9ca45597d9350

  • SHA256

    79040421b5a48dcc6e611dfe187b2f3e355791ad8511adb84f5c0948aa1d6c89

  • SHA512

    605495995a07d7dfaa5d8f09b9d5bde1e0281b5b6581923b9fbd7c103e5ca9f2bb8dcf8e1049c21bd90ac4d68759270d5453e0414c2f6e1eb3ef877eee1a5533

  • SSDEEP

    786432:5HqloPKB2RMErvURcUNnywXha1rc3fZ+L28IB1P77y059ze5aaSJJgV6UBXYKe:5HqGRME72cUNnywXg63fxB1P3y031aS1

Score
10/10
netsupportdiscoverypersistenceprivilege_escalationrat

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 9 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 32 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 29 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\79040421b5a48dcc6e611dfe187b2f3e355791ad8511adb84f5c0948aa1d6c89.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Windows\system32\cmd.exe
      cmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{CBB68368-7767-4CFF-B3E5-211488346702}\\nsm.lic"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3312
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{CBB68368-7767-4CFF-B3E5-211488346702}\\nsm.lic"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5052
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B043EF33D54F3AA7BC832EF9D87D01B8 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2216
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2280
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 4F438E292C2D45095EEB6E7BC27C8D08
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4232
      • C:\Windows\Installer\MSI54F7.tmp
        "C:\Windows\Installer\MSI54F7.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4980
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E215D8DA267475D4681B63C828620B19 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2416
      • C:\Windows\Installer\MSI59FF.tmp
        "C:\Windows\Installer\MSI59FF.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4856
      • C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe
        "C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1668
      • C:\Windows\Installer\MSI601C.tmp
        "C:\Windows\Installer\MSI601C.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EV"NetSupport School" /EF".\Log Files" /EF".\Bookmarks" /EF".\Tests" /EF".\Store" /EF".\inv" /EF".\Resources" /EF".\Help" /EF".\Image" /EF".\Sound" /EF".\Video" /EA /EX /EC /Q /V /Q /I *
        2⤵
        • Sets service image path in registry
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Program Files (x86)\NetSupport\NetSupport Manager\winst64.exe
          winst64.exe /q /q /ex /i
          3⤵
          • Drops file in Drivers directory
          • Drops file in System32 directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4872
      • C:\Windows\Installer\MSI65BC.tmp
        "C:\Windows\Installer\MSI65BC.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EI
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1692
      • C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe
        "C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe" /Q "C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32.ini"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:116
        • C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe
          "C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"
          3⤵
          • Executes dropped EXE
          PID:4860
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3396
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzc2NkE1QzMtMDZDOC00RDgwLUI0MjctQ0I5RDU2ODdFMzU5fSIgdXNlcmlkPSJ7QTdGMzE5OTQtQjc1MS00MUVDLUFBQjEtMzk1QjdBOTc3QjU3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTg5MTM2MzAtRjJDMS00MTU3LTlFRUUtN0ExMzgwRDU1MDdEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTMzOTkxOTQwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4152
    • C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
      "C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" /* *
      1⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
        "C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" * /VistaUI
        2⤵
        • Enumerates connected drives
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Windows\SysWOW64\cscript.exe
          "cscript.exe" C:\Windows\system32\Printing_Admin_Scripts\en-US\prnport.vbs -a -r NSM001 -h 127.0.0.1 -o raw -n 62598
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:3304
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
      • Modifies data under HKEY_USERS
      PID:808

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Event Triggered Execution

    2
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Installer Packages

    1
    T1546.016

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Event Triggered Execution

    2
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Installer Packages

    1
    T1546.016

    Defense Evasion

    Hide Artifacts

    1
    T1564

    Hidden Files and Directories

    1
    T1564.001

    Modify Registry

    2
    T1112

    System Binary Proxy Execution

    1
    T1218

    Msiexec

    1
    T1218.007

    Credential Access

    Discovery

    Peripheral Device Discovery

    2
    T1120

    Query Registry

    3
    T1012

    System Information Discovery

    4
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Internet Connection Discovery

    1
    T1016.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e584f16.rbs
      Filesize

      41KB

      MD5

      00291b0aff8fba86af3dc63f5ba86461

      SHA1

      780541907451902e3a1d80f4ee29aeae22d81c83

      SHA256

      48891098ada5a9aa0889da02a1eec8186716c7b032924631dce6afd63af597d3

      SHA512

      37dae3f1861724becb28d9884b0adab9583e61218fc13e3a9a5c0dcff9d2572acb8675f6f141946f7651a6c0e79a7bbf527633df857e075ee3d911fc2f215427

      Download Submit

    • C:\Program Files (x86)\NetSupport\NetSupport Manager\WINSTALL.EXE
      Filesize

      745KB

      MD5

      0fcf65c63e08e77732224b2d5d959f13

      SHA1

      5419b79fe14e21d1d5b51fe8187f7b86ec20de74

      SHA256

      f3e587f94a79c46a603b39286e93b17fabc895c6b71b26b0fc5d812cf155b7e5

      SHA512

      7c289aaf3ac1b998c8ca9593a58c8aa3a9aa9f41852c1ed4192b908e0ad51871400d585b4fe508d49368bdfc7378807d289971914870a7a47b0410a946e5e381

      Download Submit

    • C:\Program Files (x86)\NetSupport\NetSupport Manager\product.dat
      Filesize

      506B

      MD5

      ff7c0d2dbb9195083bbabaff482d5ed6

      SHA1

      5c2efbf855c376ce1b93e681c54a367a407495dc

      SHA256

      065d817596d710d5a06060241acc207b82b844530cc56ff842ff53d8ff92a075

      SHA512

      ea226b3a55fc59175136f104df497ebf5055624fb1c1c8073b249dfc5e1ed5818a6feee995aa82cf9ed050f1adc7a62994c90b1af03569dfe0d4551ee2bc70c9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DLL_{CBB68368-7767-4CFF-B3E5-211488346702}.ini
      Filesize

      7KB

      MD5

      262aafeac34714e63c8f915b15b05c44

      SHA1

      f0ed73a682c6ed91a970c0a2066dc4a96a3bafee

      SHA256

      6ff5e13ca68cbe167aec1b42b244d28832f9a2c3a6a1cec9b502768ef3065ae6

      SHA512

      ca4a15804641a5984bdb192e57ad7e7d5b7397b55366d7168a9474bdceba3764f8e9a5b392ed704105181e064e32a797ca45e50cbb8396bbb8a4ea76b87211d1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIBCE7.tmp
      Filesize

      169KB

      MD5

      0e6fda2b8425c9513c774cf29a1bc72d

      SHA1

      a79ffa24cb5956398ded44da24793a2067b85dd0

      SHA256

      e946b2fae0b36c43064463a8c16a2774adac30c4188c5af90e9338b903c501c9

      SHA512

      285bb7759a1214abed36162ac8be2d48df17a05278c4de97562448e20fd43b635563a6819f37e23d92a5f5ed0205a68bffe43dac0d3a67513bd0303b4e7f89aa

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIBD94.tmp
      Filesize

      511KB

      MD5

      d524b639a3a088155981b9b4efa55631

      SHA1

      39d8eea673c02c1522b110829b93d61310555b98

      SHA256

      03d91c8cd20b846625a092a3dae6a12369930c65d6216a455a00449ebb0dc289

      SHA512

      84f8ab54122f93a40da08fd83bca767ab49eb0f73c4ab274d9bda11dd09224134df011fa02e5a3abbafcc6fbef6a60673dd48feabdf829a1e22c85a2a759b7ac

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIBDD4.tmp
      Filesize

      153KB

      MD5

      a1b7850763af9593b66ee459a081bddf

      SHA1

      6e45955fae2b2494902a1b55a3873e542f0f5ce4

      SHA256

      41b8e92deba5206c78817236ed7f44df95636ca748d95fab05f032f5aec186af

      SHA512

      a87a302a9a0d19d7ce293b42f5e7bc09664b21307a5321f226157fcc57eb2df2b59c6651878cb23969a182c82b55e8671ff00f8462194b81a907974a49cb25b1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIC071.tmp
      Filesize

      487KB

      MD5

      3085d62326cc1ae4ab21489576973621

      SHA1

      e3c847dee0ecc7176c1168d6d1df9b9e98b19936

      SHA256

      d2dc425f47d8c80abd8cadbcd8aa53516e7754c371bd3bad3907294a6ca57c5c

      SHA512

      f993e4e04b348f7eb346d2f3d00fdaed2212f28ba885bbe50c1959737c5b6cab9cfbe17c4aba992521aa0ecdcf5216fa9e6c36a47746077307d32170223a9a97

      Download Submit

    • C:\Windows\Installer\MSI64D0.tmp
      Filesize

      244KB

      MD5

      c4ca339bc85aae8999e4b101556239dd

      SHA1

      d090fc385e0002e35db276960a360c67c4fc85cd

      SHA256

      4ab23609cdc64d10b97c9ccb285ed7100f55d54d983cd50762da25ecac4357f9

      SHA512

      9185ec32545fc838d7fef6c9e4dd222dd02114c661b0b344f16287d55e6571bfe7a4233a852acc579d07bcdbab18c5c034c465b1f4bb78535ed51c3499087fe0

      Download Submit

    • C:\Windows\Installer\e584f15.msi
      Filesize

      39.7MB

      MD5

      87ef82757aba83e7eb63c7c35dbae97a

      SHA1

      7418c4ddeecba68e253e89622ad9ca45597d9350

      SHA256

      79040421b5a48dcc6e611dfe187b2f3e355791ad8511adb84f5c0948aa1d6c89

      SHA512

      605495995a07d7dfaa5d8f09b9d5bde1e0281b5b6581923b9fbd7c103e5ca9f2bb8dcf8e1049c21bd90ac4d68759270d5453e0414c2f6e1eb3ef877eee1a5533

      Download Submit

    • memory/116-420-0x0000000002450000-0x00000000025F3000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/4496-432-0x0000000005940000-0x0000000005A64000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/4496-444-0x0000000004B20000-0x0000000004D9E000-memory.dmp

      Filesize

      2.5MB

      Download