Analysis
- max time kernel
299s - max time network
257s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
04/07/2026, 04:30
Static task
static1
Behavioral task
behavioral1
Sample
d586a839-c071-set-4012-95c4-ab-3474f21afc61.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
d586a839-c071-set-4012-95c4-ab-3474f21afc61.ps1
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
300 seconds
Behavioral task
behavioral3
Sample
d586a839-c071-set-4012-95c4-ab-3474f21afc61.ps1
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
300 seconds
Behavioral task
behavioral4
Sample
d586a839-c071-set-4012-95c4-ab-3474f21afc61.ps1
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
20 signatures
300 seconds
General
- Target d586a839-c071-set-4012-95c4-ab-3474f21afc61.ps1
- Size 4.8MB
- Sample260704-e469bsa17y
- SHA256 363b8670d3f063e41a1d47786653b355ab48a451001db54d6e3227ec252b6b3d
- MD5 8cced03b5304c2f2f9731c60fda3fde9
- SHA1 c674ea0eef45ab85925dc74eda25b95eb224e057
- SHA512 6c8464315dbd79da57e4a3ad774876441e4f5f01abe2a5b7251f7a1dd3b7360ef33fd5fd7e0c77af7d4e33c70784c50c37efb585544ed7435baf1ae7d2789856
- SSDEEP 12288:eNFAk0rzFrDUCb9uCWrB5zy363vhNzLUzanqYZQ7zrQv5G38ycIlbIzWZwbZkcKD:edY19OTAOXejl7FUUEXVDNgEnPnDQdE0
- TLSH T1163693C97AC457F09929ABEC824774DD0794613E6FBB184C02E148BE3D1AE1766E0CBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Badlisted process makes network request 27 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 29 1028 powershell.exe 30 1028 powershell.exe 31 1028 powershell.exe 36 1028 powershell.exe 38 1028 powershell.exe 39 1028 powershell.exe 41 1028 powershell.exe 43 1028 powershell.exe 44 1028 powershell.exe 45 1028 powershell.exe 47 1028 powershell.exe 49 1028 powershell.exe 50 1028 powershell.exe 51 1028 powershell.exe 53 1028 powershell.exe 54 1028 powershell.exe 55 1028 powershell.exe 56 1028 powershell.exe 57 1028 powershell.exe 59 1028 powershell.exe 60 1028 powershell.exe 61 1028 powershell.exe 63 1028 powershell.exe 65 1028 powershell.exe 66 1028 powershell.exe 67 1028 powershell.exe 69 1028 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 5540 angel.exe - Loads dropped DLL 6 IoCs
pid Process 5540 angel.exe 5540 angel.exe 5540 angel.exe 5540 angel.exe 5540 angel.exe 5540 angel.exe -
pid Process 1028 powershell.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language angel.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1028 powershell.exe 1028 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1028 powershell.exe Token: SeSecurityPrivilege 5540 angel.exe Token: SeIncreaseQuotaPrivilege 1028 powershell.exe Token: SeSecurityPrivilege 1028 powershell.exe Token: SeTakeOwnershipPrivilege 1028 powershell.exe Token: SeLoadDriverPrivilege 1028 powershell.exe Token: SeSystemProfilePrivilege 1028 powershell.exe Token: SeSystemtimePrivilege 1028 powershell.exe Token: SeProfSingleProcessPrivilege 1028 powershell.exe Token: SeIncBasePriorityPrivilege 1028 powershell.exe Token: SeCreatePagefilePrivilege 1028 powershell.exe Token: SeBackupPrivilege 1028 powershell.exe Token: SeRestorePrivilege 1028 powershell.exe Token: SeShutdownPrivilege 1028 powershell.exe Token: SeDebugPrivilege 1028 powershell.exe Token: SeSystemEnvironmentPrivilege 1028 powershell.exe Token: SeRemoteShutdownPrivilege 1028 powershell.exe Token: SeUndockPrivilege 1028 powershell.exe Token: SeManageVolumePrivilege 1028 powershell.exe Token: 33 1028 powershell.exe Token: 34 1028 powershell.exe Token: 35 1028 powershell.exe Token: 36 1028 powershell.exe Token: SeIncreaseQuotaPrivilege 1028 powershell.exe Token: SeSecurityPrivilege 1028 powershell.exe Token: SeTakeOwnershipPrivilege 1028 powershell.exe Token: SeLoadDriverPrivilege 1028 powershell.exe Token: SeSystemProfilePrivilege 1028 powershell.exe Token: SeSystemtimePrivilege 1028 powershell.exe Token: SeProfSingleProcessPrivilege 1028 powershell.exe Token: SeIncBasePriorityPrivilege 1028 powershell.exe Token: SeCreatePagefilePrivilege 1028 powershell.exe Token: SeBackupPrivilege 1028 powershell.exe Token: SeRestorePrivilege 1028 powershell.exe Token: SeShutdownPrivilege 1028 powershell.exe Token: SeDebugPrivilege 1028 powershell.exe Token: SeSystemEnvironmentPrivilege 1028 powershell.exe Token: SeRemoteShutdownPrivilege 1028 powershell.exe Token: SeUndockPrivilege 1028 powershell.exe Token: SeManageVolumePrivilege 1028 powershell.exe Token: 33 1028 powershell.exe Token: 34 1028 powershell.exe Token: 35 1028 powershell.exe Token: 36 1028 powershell.exe Token: SeIncreaseQuotaPrivilege 1028 powershell.exe Token: SeSecurityPrivilege 1028 powershell.exe Token: SeTakeOwnershipPrivilege 1028 powershell.exe Token: SeLoadDriverPrivilege 1028 powershell.exe Token: SeSystemProfilePrivilege 1028 powershell.exe Token: SeSystemtimePrivilege 1028 powershell.exe Token: SeProfSingleProcessPrivilege 1028 powershell.exe Token: SeIncBasePriorityPrivilege 1028 powershell.exe Token: SeCreatePagefilePrivilege 1028 powershell.exe Token: SeBackupPrivilege 1028 powershell.exe Token: SeRestorePrivilege 1028 powershell.exe Token: SeShutdownPrivilege 1028 powershell.exe Token: SeDebugPrivilege 1028 powershell.exe Token: SeSystemEnvironmentPrivilege 1028 powershell.exe Token: SeRemoteShutdownPrivilege 1028 powershell.exe Token: SeUndockPrivilege 1028 powershell.exe Token: SeManageVolumePrivilege 1028 powershell.exe Token: 33 1028 powershell.exe Token: 34 1028 powershell.exe Token: 35 1028 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5540 angel.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1028 wrote to memory of 5540 1028 powershell.exe 92
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d586a839-c071-set-4012-95c4-ab-3474f21afc61.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\angel.exe"C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\angel.exe" "C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5540
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uxoaxtnh.xbg.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\HTCTL32.DLL
- Size 320KB
- SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
- MD5 2d3b207c8a48148296156e5725426c7f
- SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
- SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
- SSDEEP 6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
- TLSH T150646C21BD80C031F2966075C5BDDBBA0D6DB470376860DBBBD909B96F686D3663830B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\NSM.LIC
- Size 253B
- SHA256 83a6feb6304effcd258129e5d46f484e4c34c1cce1ea0c32a94a89283ccd24f9
- MD5 14ca8f4ee0dd828ecfd0c566dce00f06
- SHA1 cd7d6a571d58ff9bd6a411f98a205c43b9a34da2
- SHA512 2cd6d6e632cba37724a1db4f771d1ebb938dee44fa096dc4dd8d62322436d3d0ac216f8ddf79f20dd3e41ad1741e6c3dbfaf649ed09e36d91233b4a95a1faf02
- TLSH T190D02BC9A123902B43D141667BA184AE82D8909887242D44B5EC22266AA55205B8D05C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\PCICHEK.DLL
- Size 18KB
- SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
- MD5 a0b9388c5f18e27266a31f8c5765b263
- SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
- SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
- SSDEEP 192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
- TLSH T15D821BD21F696503EBE24E7161EADA165D36B6D0AB74C0EF307581452EC0BE03E6931F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\PCICL32.dll
- Size 3.5MB
- SHA256 bd53de502b1e42fb825e3098d90b94eac74dd4b310acf815890952a6912acdde
- MD5 f1f5be34b3fed664a40941bc70c0574e
- SHA1 e0bdf139dc3a5dd3513cb53451f65bfb70f09b53
- SHA512 7afd4e4ed162f3fba02506ca06b018a48fe998a8e3b0c20cb5d4cf2c44abf93de6ac9d8dc9f30d8531453c521e10a22aca39a929673ede2bc016bda7f78da25a
- SSDEEP 49152:NOHDe5Yr6tYA4S+DjdwfwBTNZaZbkc9SENTIg:NOHDe5YrvS+tBUtSap
- TLSH T10AF50770EA448C75E1930476ED6DAADC412A6E750F2906CF3A8CB5091AF63D131F8F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\angel.exe
- Size 117KB
- SHA256 8000ffd1f8b32b4b85be9c3e730874865d949f9359c9a91c4386f4ff32deb180
- MD5 5f35710f5128ddf6eb2c89e724b83d11
- SHA1 94e8d9a259ddff360e0ea5b03580f672c66712c4
- SHA512 768e384346b83372e4e04dd6030c3404258d40ee63ea50dacdfea7e4746d65a3316fc572febe1995619c128e3bd08441c4b58de8a25b388b6e003552d949af09
- SSDEEP 768:hEVZl6FhWr80/FK0r2bhuvtAKzCKZikGr2bhu2RPAKzCKZikZ:hG0hGNKU2huv+vv2huyYva
- TLSH T166C3C50F4699E173EA42E97DC8849B010C64BEC9B5F458FB105EF63E3E3178E2B6415A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\client32.ini
- Size 1KB
- SHA256 9f4730605c4457e387856bf2272a71ae7f8178ebb07ba40d05c4451adfc7cd0d
- MD5 dd8e993085259d0a7ebb31ac84324ef9
- SHA1 c8050b7a810f2b75f0a0fb743f49b7093105a3b4
- SHA512 c028ef1c0d3d16af07a6e801015e405dd9870af921c562c83b2332778ac78a53c2ace87abbdf67bdb9b6b3bc6d97ccd6ed5fde41d6f70d4debd509d01b4d87af
- TLSH T1F7111222664EBD1D1937E291727841903FD60489E01D39209B584D6FFF3A8BE85EFCD9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Google\Telemetry\DiagTrack\c7b196bb16cae85e\pcicapi.dll
- Size 32KB
- SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
- MD5 dcde2248d19c778a41aa165866dd52d0
- SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
- SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166
- SSDEEP 768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
- TLSH T14EE27EC59A88A493F9C94C7571EEEB375C3976F0675400D3B2A682B91AD83F2347821F
- MD5 SHA1 SHA512 SSDEEP TLSH