Analysis
- max time kernel
45s - max time network
18s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
24/02/2024, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
numpad_1.7.1-setup.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
numpad_1.7.1-setup.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target numpad_1.7.1-setup.exe
- Size 4.1MB
- Sample240224-vn5csshb35
- SHA256 da21f1a96fc297680883914c89ae2a64bd152909c6ac1e89897dc53ed4505ce0
- MD5 1ab7287df42a6a6f07d52a6ea85fe4a4
- SHA1 2854749f7c4610eae55002566d5129e81eb191c1
- SHA512 1f9de3f4da507858b0f1d0f4026180dc0c1af264173eeff3a9a611105bddf12d37a4ec59756cc8463de1dfece1be53460ead0c54aac87970fb42869450b80f78
- SSDEEP 98304:r5s8lKiverhXw+2Y/mLiRRPiWz5HK0ZCsBg:7Kiverh5d/8cPp5q0ZC2g
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2272 numpad_1.7.1-setup.tmp 2472 Numpad_1.7.1.exe - Loads dropped DLL 9 IoCs
pid Process 3016 numpad_1.7.1-setup.exe 2272 numpad_1.7.1-setup.tmp 2272 numpad_1.7.1-setup.tmp 2272 numpad_1.7.1-setup.tmp 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Numpad_1.7.1 numpad_1.7.1-setup.tmp - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\Numpad_1.7.1\is-J8N2N.tmp numpad_1.7.1-setup.tmp File created C:\Program Files (x86)\Numpad_1.7.1\is-R2LMJ.tmp numpad_1.7.1-setup.tmp File opened for modification C:\Program Files (x86)\Numpad_1.7.1\KeyboardHook.dll numpad_1.7.1-setup.tmp File opened for modification C:\Program Files (x86)\Numpad_1.7.1\msvcp100.dll numpad_1.7.1-setup.tmp File opened for modification C:\Program Files (x86)\Numpad_1.7.1\QtCore4.dll numpad_1.7.1-setup.tmp File created C:\Program Files (x86)\Numpad_1.7.1\is-DQA9R.tmp numpad_1.7.1-setup.tmp File created C:\Program Files (x86)\Numpad_1.7.1\is-U8FJ3.tmp numpad_1.7.1-setup.tmp File created C:\Program Files (x86)\Numpad_1.7.1\is-GJQ2J.tmp numpad_1.7.1-setup.tmp File created C:\Program Files (x86)\Numpad_1.7.1\is-4TFNS.tmp numpad_1.7.1-setup.tmp File created C:\Program Files (x86)\Numpad_1.7.1\is-F0RLE.tmp numpad_1.7.1-setup.tmp File created C:\Program Files (x86)\Numpad_1.7.1\is-R772V.tmp numpad_1.7.1-setup.tmp File opened for modification C:\Program Files (x86)\Numpad_1.7.1\unins000.dat numpad_1.7.1-setup.tmp File opened for modification C:\Program Files (x86)\Numpad_1.7.1\msvcr100.dll numpad_1.7.1-setup.tmp File opened for modification C:\Program Files (x86)\Numpad_1.7.1\Numpad_1.7.1.exe numpad_1.7.1-setup.tmp File created C:\Program Files (x86)\Numpad_1.7.1\unins000.dat numpad_1.7.1-setup.tmp File opened for modification C:\Program Files (x86)\Numpad_1.7.1\QtGui4.dll numpad_1.7.1-setup.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2272 numpad_1.7.1-setup.tmp 2272 numpad_1.7.1-setup.tmp 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2628 taskmgr.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 2272 numpad_1.7.1-setup.tmp 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe - Suspicious use of SendNotifyMessage 49 IoCs
pid Process 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2472 Numpad_1.7.1.exe 2472 Numpad_1.7.1.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2272 3016 numpad_1.7.1-setup.exe 28 PID 3016 wrote to memory of 2272 3016 numpad_1.7.1-setup.exe 28 PID 3016 wrote to memory of 2272 3016 numpad_1.7.1-setup.exe 28 PID 3016 wrote to memory of 2272 3016 numpad_1.7.1-setup.exe 28 PID 3016 wrote to memory of 2272 3016 numpad_1.7.1-setup.exe 28 PID 3016 wrote to memory of 2272 3016 numpad_1.7.1-setup.exe 28 PID 3016 wrote to memory of 2272 3016 numpad_1.7.1-setup.exe 28 PID 2272 wrote to memory of 2472 2272 numpad_1.7.1-setup.tmp 30 PID 2272 wrote to memory of 2472 2272 numpad_1.7.1-setup.tmp 30 PID 2272 wrote to memory of 2472 2272 numpad_1.7.1-setup.tmp 30 PID 2272 wrote to memory of 2472 2272 numpad_1.7.1-setup.tmp 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\numpad_1.7.1-setup.exe"C:\Users\Admin\AppData\Local\Temp\numpad_1.7.1-setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\is-J7KID.tmp\numpad_1.7.1-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-J7KID.tmp\numpad_1.7.1-setup.tmp" /SL5="$7011E,3935978,107520,C:\Users\Admin\AppData\Local\Temp\numpad_1.7.1-setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Numpad_1.7.1\Numpad_1.7.1.exe"C:\Program Files (x86)\Numpad_1.7.1\Numpad_1.7.1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Numpad_1.7.1\QtCore4.dll
- Size 2.5MB
- SHA256 d8b7fd46a506c4a9c2000d49d8df7146a9253ff09081e4a5ccafa5011f93f679
- MD5 30a5ede7b3cef23de214998ddfdd88ba
- SHA1 75416f8f9f2174c0bd0f3d8167843aafe4fa4308
- SHA512 46c45e9153ad9803b6266bf0791c9ae716cd1459fd3f2eb21bf67ec9adfb4edeb6c543ea86850055b443b918644fa932e55bccf171530039d024882368ecf11d
- SSDEEP 49152:tNC2vacDroN/JJsv6tWKFdu9C9TtLyvL/6mShMZtmjNUVrciV5P+7QVg07Ku7qxv:7C2v0xJsv6tWKFdu9Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Numpad_1.7.1\QtGui4.dll
- Size 5.9MB
- SHA256 02f154d48ac73be62027f6a7258455319209c0d2f8f6583617e1d4b2a6e82391
- MD5 964ec38628d729bc9804cfdb62fb5f26
- SHA1 2df34280d7674bf2c3fd75931152dd35f0b8ca29
- SHA512 38b6e23f95bbd35ed73f8f4286563a60df0347f45fb8d8854265bf629b66c40cbc8691ec7eae769c4e9f83459b7c2fae7468a812ee80502b74b9aeaebdda6c22
- SSDEEP 98304:qx3VmZXDXJOULpBi3QYhaAHRGVK3JmfuPrLs:qxQZXDXLjiHhH1RQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Numpad\1.7.1\Buttons\Examples\Standard numpad\qt_temp.Ya2472
- Size 169B
- SHA256 73b6cd37a24dc730a16c2eb99b02f1bc7008dd7df34c4a704c475300aa23f852
- MD5 978c76c0545dc4cfc6f5176b8e3be352
- SHA1 df97bc8e92919b1aed27ebee2db29a52448dbdd2
- SHA512 9529392a8eb9aaef9f5285d0815adeb514b4b3e34f5b6b182c4d424cddb929d4f199da8410bee2ae799a7a40224fa5f00e38a7ee41d655f11d7f18587b5d72d1
- MD5 SHA1 SHA512
- Path \Program Files (x86)\Numpad_1.7.1\KeyboardHook.dll
- Size 6KB
- SHA256 67afb4a604dbb902bf1672759290958aadfb5d0abf97b8f496f2d29defdb230c
- MD5 50d6cdd5bb9dff9653886c710c4c2e03
- SHA1 09301115383b66bab4d9b9751786dd15c1acd949
- SHA512 0da4b9b0cebe7911c9c0e734e209360d9eff12b2e3632c322302b1fc01e2ad838f89d0dde8d0af418a128948a0550db4b9ebfa02f4bc2980613ba2e55f4948c2
- SSDEEP 96:AK97ikcWn8NZi5VCSwxWvB0qYyOI3XLPVAAD6OICtJon9:AK97Nn8NZW4W5Y9I3XLPVlD6mJ2
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Numpad_1.7.1\Numpad_1.7.1.exe
- Size 333KB
- SHA256 8d59c86d6963199fef6a72a2d08a365159e283af5417e5aaa19140fc177b77ae
- MD5 f208455846b5cec850bee0917415e553
- SHA1 1b24acb2bfa435315fb276964a99e86948d87f63
- SHA512 787f196c53550686c26c0be50fe617ec7cd0928f17231cc40ae0f801dc3042c214cf905a73af6091dbfefe2088be123a2d5a830f3ec74876434bdeb508dbde47
- SSDEEP 6144:Lm8ADmJO0koD3ubrYbdJCB1GR0YGL+aLco7h/7gPEwCyobk7zDCjODO/O18M8JO:LmTDxyDevYhJCRJO
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Numpad_1.7.1\QtGui4.dll
- Size 5.6MB
- SHA256 b62dc782f18b6c25bef21453431510edc0e4d64213cc051ee90c2e431683b173
- MD5 0f56cf69c81ba36bff4dde131e21a190
- SHA1 b0abe3255500da7dff54913d3bbcfb6d12083e68
- SHA512 8feba4b36c49bd8670afa286975137f1deedb5d22f59fb4641286f5d6d79f4404b0378246964392794f14952909a46c9828572f759400f71273be56d24edf331
- SSDEEP 98304:qx3VmZXDXJOULpBi3QYhaAHRGVK3JmfuPrL7:qxQZXDXLjiHhH1Rv
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Numpad_1.7.1\msvcp100.dll
- Size 411KB
- SHA256 d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
- MD5 e3c817f7fe44cc870ecdbcbc3ea36132
- SHA1 2ada702a0c143a7ae39b7de16a4b5cc994d2548b
- SHA512 4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
- SSDEEP 12288:zNb8zxr1aWPaHX7dGP57rhUgiW6QR7t5qv3Ooc8UHkC2ejGH:zNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eKH
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Numpad_1.7.1\msvcr100.dll
- Size 755KB
- SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
- MD5 bf38660a9125935658cfa3e53fdc7d65
- SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
- SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
- SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Numpad_1.7.1\unins000.exe
- Size 756KB
- SHA256 ce8cb3a59746fca25b5abe24ccdb26e3c353e832ca9f3e6f6c9e23f8fe053e19
- MD5 9c2ea0272f0a434bccbd98bbf1eea6a5
- SHA1 cbf7c7071c34616e5c4ab72d67c14aa451551926
- SHA512 b43d7d8c521c03a0153ce7b7a83628508c2b5047e4373314d2357c7d83aa0e65f1af31afe3165d037071575b49daa1dddf3249d318bacbbd448addf72f8dc7b2
- SSDEEP 12288:qsMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0Syx9+X:9McMoi3rPR37dzHRA6G7WbuSEmK50SyI
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\is-J7KID.tmp\numpad_1.7.1-setup.tmp
- Size 745KB
- SHA256 bb11026bae94b4caad02854836e964261d878ea9edb385052bb5e7eecd54f6e9
- MD5 188c82ab791d4358260a9e4e0d1aeb7c
- SHA1 94b6c46dd78d8e18ce04aaeff3ebcec2e9b921bf
- SHA512 6e13cb01be110817273db6fd34f39f865e6756a6077902d2f40ddcd202673be54cf1110896fd245ac215f00f9cd71dccc39476b0569da405bba7ff2fde7ddc75
- SSDEEP 12288:CsMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0Syx9+1:1McMoi3rPR37dzHRA6G7WbuSEmK50SyA
- MD5 SHA1 SHA512 SSDEEP