Analysis
-
max time kernel
127s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-06-2023 08:52
Static task
static1
Behavioral task
behavioral1
Sample
npp.8.1.4.Installer.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
npp.8.1.4.Installer.exe
Resource
win10v2004-20230221-en
General
-
Target
npp.8.1.4.Installer.exe
-
Size
3.9MB
-
MD5
fe4f6dee19b89d2ac0f93aaa31dac028
-
SHA1
093921c8dbf15164b7ff5a132bffc89a121cbe82
-
SHA256
eadefd67e95bef200b2506caf8b3c82e0ea6c3cf895936614ba442989a08db4e
-
SHA512
6e5ad31999bc752fea28a56375d34f8112fbc299a4162d3af7350652128c908f2a1b5404587208db382913a52ef2005371af7f7526ffa452461162aab3300165
-
SSDEEP
98304:UvIcasb3kdMpt3jgZzULj0hPz5jnMcjc3Dx3:UwcDbUdEj10hPBMcjg3
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
Processes:
npp.8.1.4.Installer.exepid process 1200 npp.8.1.4.Installer.exe 1200 npp.8.1.4.Installer.exe 1200 npp.8.1.4.Installer.exe 1200 npp.8.1.4.Installer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
npp.8.1.4.Installer.exepid process 1200 npp.8.1.4.Installer.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsd9D3.tmp\InstallOptions.dllFilesize
15KB
MD505bf02da51e717f79f6b5cbea7bc0710
SHA107471a64ef4dba9dc19ce68ae6cce683af7df86d
SHA256ca092ba7f275b0c9000098cdd1a9876fe8dc050fcb40a0e8a1ab8335236e9dc5
SHA512c09e475babd5eb675cdf903b2b754b8b68450a731cb520f3dcbf9abe0ed03d19256f009429977d3a51decb3a2a938be0b28dbafeb407409fa85e54da6dbaaad6
-
C:\Users\Admin\AppData\Local\Temp\nsd9D3.tmp\ioSpecial.iniFilesize
1KB
MD59d54f4ad6e3c97f6c9175e5290a5929e
SHA135816cdaa978de39f422e90f689dd0dc0d396594
SHA2561169777ce05693c5292a57556ecfebd0a052c9659f786f8dd2cd7bd40274cff5
SHA512c4569019ee04acfc8427cd53bdbafb6a1acaf5388c53decde9596aaebba6d90e4cfb7b427d7cb361236606e0ddc8ecf37c61704360531e878a5d98a1aa3f95ad
-
\Users\Admin\AppData\Local\Temp\nsd9D3.tmp\InstallOptions.dllFilesize
15KB
MD505bf02da51e717f79f6b5cbea7bc0710
SHA107471a64ef4dba9dc19ce68ae6cce683af7df86d
SHA256ca092ba7f275b0c9000098cdd1a9876fe8dc050fcb40a0e8a1ab8335236e9dc5
SHA512c09e475babd5eb675cdf903b2b754b8b68450a731cb520f3dcbf9abe0ed03d19256f009429977d3a51decb3a2a938be0b28dbafeb407409fa85e54da6dbaaad6
-
\Users\Admin\AppData\Local\Temp\nsd9D3.tmp\InstallOptions.dllFilesize
15KB
MD505bf02da51e717f79f6b5cbea7bc0710
SHA107471a64ef4dba9dc19ce68ae6cce683af7df86d
SHA256ca092ba7f275b0c9000098cdd1a9876fe8dc050fcb40a0e8a1ab8335236e9dc5
SHA512c09e475babd5eb675cdf903b2b754b8b68450a731cb520f3dcbf9abe0ed03d19256f009429977d3a51decb3a2a938be0b28dbafeb407409fa85e54da6dbaaad6
-
\Users\Admin\AppData\Local\Temp\nsd9D3.tmp\LangDLL.dllFilesize
5KB
MD5ab1db56369412fe8476fefffd11e4cc0
SHA1daad036a83b2ee2fa86d840a34a341100552e723
SHA2566f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b
SHA5128d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d
-
\Users\Admin\AppData\Local\Temp\nsd9D3.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9