Analysis
-
max time kernel
80s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2023 08:52
Static task
static1
Behavioral task
behavioral1
Sample
npp.8.1.4.Installer.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
npp.8.1.4.Installer.exe
Resource
win10v2004-20230221-en
General
-
Target
npp.8.1.4.Installer.exe
-
Size
3.9MB
-
MD5
fe4f6dee19b89d2ac0f93aaa31dac028
-
SHA1
093921c8dbf15164b7ff5a132bffc89a121cbe82
-
SHA256
eadefd67e95bef200b2506caf8b3c82e0ea6c3cf895936614ba442989a08db4e
-
SHA512
6e5ad31999bc752fea28a56375d34f8112fbc299a4162d3af7350652128c908f2a1b5404587208db382913a52ef2005371af7f7526ffa452461162aab3300165
-
SSDEEP
98304:UvIcasb3kdMpt3jgZzULj0hPz5jnMcjc3Dx3:UwcDbUdEj10hPBMcjg3
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
Processes:
npp.8.1.4.Installer.exepid process 4124 npp.8.1.4.Installer.exe 4124 npp.8.1.4.Installer.exe 4124 npp.8.1.4.Installer.exe 4124 npp.8.1.4.Installer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nss69DC.tmp\InstallOptions.dllFilesize
15KB
MD505bf02da51e717f79f6b5cbea7bc0710
SHA107471a64ef4dba9dc19ce68ae6cce683af7df86d
SHA256ca092ba7f275b0c9000098cdd1a9876fe8dc050fcb40a0e8a1ab8335236e9dc5
SHA512c09e475babd5eb675cdf903b2b754b8b68450a731cb520f3dcbf9abe0ed03d19256f009429977d3a51decb3a2a938be0b28dbafeb407409fa85e54da6dbaaad6
-
C:\Users\Admin\AppData\Local\Temp\nss69DC.tmp\InstallOptions.dllFilesize
15KB
MD505bf02da51e717f79f6b5cbea7bc0710
SHA107471a64ef4dba9dc19ce68ae6cce683af7df86d
SHA256ca092ba7f275b0c9000098cdd1a9876fe8dc050fcb40a0e8a1ab8335236e9dc5
SHA512c09e475babd5eb675cdf903b2b754b8b68450a731cb520f3dcbf9abe0ed03d19256f009429977d3a51decb3a2a938be0b28dbafeb407409fa85e54da6dbaaad6
-
C:\Users\Admin\AppData\Local\Temp\nss69DC.tmp\InstallOptions.dllFilesize
15KB
MD505bf02da51e717f79f6b5cbea7bc0710
SHA107471a64ef4dba9dc19ce68ae6cce683af7df86d
SHA256ca092ba7f275b0c9000098cdd1a9876fe8dc050fcb40a0e8a1ab8335236e9dc5
SHA512c09e475babd5eb675cdf903b2b754b8b68450a731cb520f3dcbf9abe0ed03d19256f009429977d3a51decb3a2a938be0b28dbafeb407409fa85e54da6dbaaad6
-
C:\Users\Admin\AppData\Local\Temp\nss69DC.tmp\LangDLL.dllFilesize
5KB
MD5ab1db56369412fe8476fefffd11e4cc0
SHA1daad036a83b2ee2fa86d840a34a341100552e723
SHA2566f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b
SHA5128d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d
-
C:\Users\Admin\AppData\Local\Temp\nss69DC.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
C:\Users\Admin\AppData\Local\Temp\nss69DC.tmp\ioSpecial.iniFilesize
1KB
MD53a398938939a6769e004b8805e719c3e
SHA155ec8e2a7440dbdeb35f8d33fdbfdc9726184495
SHA25680f3148a913e381381da4cf12113b22a7cd65b4dae310113affb736819a6123f
SHA5122260e0352564cd7912e158e3a58b6b992c8d82e996d1f914c6b0bbb677f93ff876a4a54713e63981ae5d30d9041540a5671142d80cfc68e8b8bec1c38756db0f