Analysis
- max time kernel
299s - max time network
203s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/10/2026, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
A0-6A086A5-A4djfhhryy-45.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
A0-6A086A5-A4djfhhryy-45.ps1
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
12 signatures
300 seconds
Behavioral task
behavioral3
Sample
A0-6A086A5-A4djfhhryy-45.ps1
Resource
win11-20260911-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral4
Sample
A0-6A086A5-A4djfhhryy-45.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
300 seconds
General
- Target A0-6A086A5-A4djfhhryy-45.ps1
- Size 4.3MB
- Sample261007-ejlf5a1zdy
- SHA256 c57fa43fe729fc45ac725798a3f12d1eafcbe9b91c14046e98485033cb7e4fc9
- MD5 a2ae3848e94e1b993e92be023791103d
- SHA1 a490617c99c1a1f999b42d989d69afebd51bd7bf
- SHA512 db280edd1178008e78cf293a3482ab00e56a1082e83431d2e40d267d8a12e81ae17b47fb3659a06dde86823cd290272864db0287b091d6242f6a5b70459bcc73
- SSDEEP 24576:BNE7gjh9DA9d9Rj9ChcON6nGN09ZJ9896b959ACuJscq9m9KUr9FGE9HuPIxPzaT:C
- TLSH T1402682D97AC426F05929ABDC934774CD0794A13E6FBB280D02E1487D3D2AE1726E4CBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 51 2016 powershell.exe 53 2016 powershell.exe 55 2016 powershell.exe 57 2016 powershell.exe 62 2016 powershell.exe 64 2016 powershell.exe 68 2016 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 2704 complex.exe - Loads dropped DLL 5 IoCs
pid Process 2704 complex.exe 2704 complex.exe 2704 complex.exe 2704 complex.exe 2704 complex.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe -
pid Process 2016 powershell.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname complex.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain complex.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language complex.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2016 powershell.exe 2016 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2016 powershell.exe Token: SeSecurityPrivilege 2704 complex.exe Token: SeIncreaseQuotaPrivilege 2016 powershell.exe Token: SeSecurityPrivilege 2016 powershell.exe Token: SeTakeOwnershipPrivilege 2016 powershell.exe Token: SeLoadDriverPrivilege 2016 powershell.exe Token: SeSystemProfilePrivilege 2016 powershell.exe Token: SeSystemtimePrivilege 2016 powershell.exe Token: SeProfSingleProcessPrivilege 2016 powershell.exe Token: SeIncBasePriorityPrivilege 2016 powershell.exe Token: SeCreatePagefilePrivilege 2016 powershell.exe Token: SeBackupPrivilege 2016 powershell.exe Token: SeRestorePrivilege 2016 powershell.exe Token: SeShutdownPrivilege 2016 powershell.exe Token: SeDebugPrivilege 2016 powershell.exe Token: SeSystemEnvironmentPrivilege 2016 powershell.exe Token: SeRemoteShutdownPrivilege 2016 powershell.exe Token: SeUndockPrivilege 2016 powershell.exe Token: SeManageVolumePrivilege 2016 powershell.exe Token: 33 2016 powershell.exe Token: 34 2016 powershell.exe Token: 35 2016 powershell.exe Token: 36 2016 powershell.exe Token: SeIncreaseQuotaPrivilege 2016 powershell.exe Token: SeSecurityPrivilege 2016 powershell.exe Token: SeTakeOwnershipPrivilege 2016 powershell.exe Token: SeLoadDriverPrivilege 2016 powershell.exe Token: SeSystemProfilePrivilege 2016 powershell.exe Token: SeSystemtimePrivilege 2016 powershell.exe Token: SeProfSingleProcessPrivilege 2016 powershell.exe Token: SeIncBasePriorityPrivilege 2016 powershell.exe Token: SeCreatePagefilePrivilege 2016 powershell.exe Token: SeBackupPrivilege 2016 powershell.exe Token: SeRestorePrivilege 2016 powershell.exe Token: SeShutdownPrivilege 2016 powershell.exe Token: SeDebugPrivilege 2016 powershell.exe Token: SeSystemEnvironmentPrivilege 2016 powershell.exe Token: SeRemoteShutdownPrivilege 2016 powershell.exe Token: SeUndockPrivilege 2016 powershell.exe Token: SeManageVolumePrivilege 2016 powershell.exe Token: 33 2016 powershell.exe Token: 34 2016 powershell.exe Token: 35 2016 powershell.exe Token: 36 2016 powershell.exe Token: SeIncreaseQuotaPrivilege 2016 powershell.exe Token: SeSecurityPrivilege 2016 powershell.exe Token: SeTakeOwnershipPrivilege 2016 powershell.exe Token: SeLoadDriverPrivilege 2016 powershell.exe Token: SeSystemProfilePrivilege 2016 powershell.exe Token: SeSystemtimePrivilege 2016 powershell.exe Token: SeProfSingleProcessPrivilege 2016 powershell.exe Token: SeIncBasePriorityPrivilege 2016 powershell.exe Token: SeCreatePagefilePrivilege 2016 powershell.exe Token: SeBackupPrivilege 2016 powershell.exe Token: SeRestorePrivilege 2016 powershell.exe Token: SeShutdownPrivilege 2016 powershell.exe Token: SeDebugPrivilege 2016 powershell.exe Token: SeSystemEnvironmentPrivilege 2016 powershell.exe Token: SeRemoteShutdownPrivilege 2016 powershell.exe Token: SeUndockPrivilege 2016 powershell.exe Token: SeManageVolumePrivilege 2016 powershell.exe Token: 33 2016 powershell.exe Token: 34 2016 powershell.exe Token: 35 2016 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2704 complex.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2704 2016 powershell.exe 108
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\A0-6A086A5-A4djfhhryy-45.ps11⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\complex.exe"C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\complex.exe" "C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2704
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_guuawczc.ru4.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\HTCTL32.DLL
- Size 320KB
- SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
- MD5 2d3b207c8a48148296156e5725426c7f
- SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
- SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
- SSDEEP 6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
- TLSH T150646C21BD80C031F2966075C5BDDBBA0D6DB470376860DBBBD909B96F686D3663830B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\NSM.LIC
- Size 253B
- SHA256 83a6feb6304effcd258129e5d46f484e4c34c1cce1ea0c32a94a89283ccd24f9
- MD5 14ca8f4ee0dd828ecfd0c566dce00f06
- SHA1 cd7d6a571d58ff9bd6a411f98a205c43b9a34da2
- SHA512 2cd6d6e632cba37724a1db4f771d1ebb938dee44fa096dc4dd8d62322436d3d0ac216f8ddf79f20dd3e41ad1741e6c3dbfaf649ed09e36d91233b4a95a1faf02
- TLSH T190D02BC9A123902B43D141667BA184AE82D8909887242D44B5EC22266AA55205B8D05C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\PCICHEK.DLL
- Size 18KB
- SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
- MD5 a0b9388c5f18e27266a31f8c5765b263
- SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
- SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
- SSDEEP 192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
- TLSH T15D821BD21F696503EBE24E7161EADA165D36B6D0AB74C0EF307581452EC0BE03E6931F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\PCICL32.dll
- Size 3.5MB
- SHA256 bd53de502b1e42fb825e3098d90b94eac74dd4b310acf815890952a6912acdde
- MD5 f1f5be34b3fed664a40941bc70c0574e
- SHA1 e0bdf139dc3a5dd3513cb53451f65bfb70f09b53
- SHA512 7afd4e4ed162f3fba02506ca06b018a48fe998a8e3b0c20cb5d4cf2c44abf93de6ac9d8dc9f30d8531453c521e10a22aca39a929673ede2bc016bda7f78da25a
- SSDEEP 49152:NOHDe5Yr6tYA4S+DjdwfwBTNZaZbkc9SENTIg:NOHDe5YrvS+tBUtSap
- TLSH T10AF50770EA448C75E1930476ED6DAADC412A6E750F2906CF3A8CB5091AF63D131F8F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\client32.ini
- Size 1KB
- SHA256 0f88f9aa621684f5690e1a4a4bc27e826eede346fc2a38ebd09121db6ced9e17
- MD5 d19ce84e03519baf5445489d79ffbef0
- SHA1 4f535e85d54c8667b507940f4239ae0711e38103
- SHA512 3b450dd37366f18a54cbe6c4bad79623dd27bdd50a9f051314dad4237cbb3d1948c4ed452b3eebb033a87a1a4eede815ce5764cd95cd0d1d5fb17db183e7c044
- TLSH T12811F022724ABC2D1527E291717841902FD24485802D3A209F484DAFFF7A8AE85DFCD9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\complex.exe
- Size 117KB
- SHA256 8000ffd1f8b32b4b85be9c3e730874865d949f9359c9a91c4386f4ff32deb180
- MD5 5f35710f5128ddf6eb2c89e724b83d11
- SHA1 94e8d9a259ddff360e0ea5b03580f672c66712c4
- SHA512 768e384346b83372e4e04dd6030c3404258d40ee63ea50dacdfea7e4746d65a3316fc572febe1995619c128e3bd08441c4b58de8a25b388b6e003552d949af09
- SSDEEP 768:hEVZl6FhWr80/FK0r2bhuvtAKzCKZikGr2bhu2RPAKzCKZikZ:hG0hGNKU2huv+vv2huyYva
- TLSH T166C3C50F4699E173EA42E97DC8849B010C64BEC9B5F458FB105EF63E3E3178E2B6415A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Portmaster\SessionStorage\ntmon_x86\1d94949edd48b162\pcicapi.dll
- Size 32KB
- SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
- MD5 dcde2248d19c778a41aa165866dd52d0
- SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
- SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166
- SSDEEP 768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
- TLSH T14EE27EC59A88A493F9C94C7571EEEB375C3976F0675400D3B2A682B91AD83F2347821F
- MD5 SHA1 SHA512 SSDEEP TLSH