Analysis
-
max time kernel
104s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
26/03/2025, 12:09
General
-
Target
tzz1/client32.exe
-
Size
118KB
-
MD5
a559b180e2eaa92da8a8ccd9ed42ae14
-
SHA1
1cf9e47d1459143c2990cccbb97a989cfbb87fea
-
SHA256
adc1763d5e1904244067bcf8e4d8a5b81ff1ec54b170c46ce770929f2058a140
-
SHA512
ea58143f0a80c2ebcbc02cf804f7f18e7440711a66ae47fa5b930c26d4eca3138ae70ae39e2f6104f64cef6b899459b0e3c4b0bde09c4abe36d6cca7637f8b3a
-
SSDEEP
768:X8j0+RvW6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDJeJ:MpvWiLniepfxP91/bQxT4F
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tzz1\client32.exe"C:\Users\Admin\AppData\Local\Temp\tzz1\client32.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow