Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

NPC2.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    1677s
  • max time network
    1168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2023, 22:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NPC2.exe

  • Size

    11.8MB

  • MD5

    9b2793c8f63acfe523381818b0b85515

  • SHA1

    ebffbbf86868e6d4273e8e9b328f36ac0f107bb2

  • SHA256

    a75167fe4549d69e26f1e4632c73859e5992d7256723643b47f1e029057ce893

  • SHA512

    4f534cde6aa8ed7e404df74d80b12ea7ee8a3e6124109deb8b74618b3add40ba861f49a89d3626af0104584a0180d8fd5bca01e2d087d77dbd8bcab3356babdd

  • SSDEEP

    98304:s14bnz4wPFpAgxInF/Ob79oGsIEzyyQ6CRviTdT+tHX7PtDNlmc:A4V7KF/OPWGsIEzyLfRAdT+hLPtDbz

Score
1/10

Malware Config

Signatures

  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\NPC2.exe
    "C:\Users\Admin\AppData\Local\Temp\NPC2.exe"
    1⤵
      PID:4960
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1496
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\enc_me.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:632
      • C:\Users\Admin\AppData\Local\Temp\NPC2.exe
        "C:\Users\Admin\AppData\Local\Temp\NPC2.exe"
        1⤵
          PID:4752
        • C:\Users\Admin\AppData\Local\Temp\NPC2.exe
          "C:\Users\Admin\AppData\Local\Temp\NPC2.exe"
          1⤵
            PID:1320
          • C:\Users\Admin\AppData\Local\Temp\NPC2.exe
            "C:\Users\Admin\AppData\Local\Temp\NPC2.exe"
            1⤵
              PID:1888

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\enc_me.txt
              Filesize

              12B

              MD5

              e12599d68037b1dccda9085421f0581f

              SHA1

              cf0c0d931c8fa657a7a0aa573158c44847a8169b

              SHA256

              a4032f4be2fe0d6f49a8c361f01b8305819a51d5634b926635350341def5a886

              SHA512

              f254d57c46f8b527b9a585c9bd0a642e62d73cb106a59ccca0f32b1e188c06e95ac044bceddc14859345eb00811f7f722b634326c93b6217bcfdcb188efa87b8

              Download Submit