Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
388s -
max time network
336s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
19/04/2024, 06:46
General
-
Target
npp.8.6.5.Installer.x64.exe
-
Size
4.6MB
-
MD5
7c4ec7186e0f2a854518bf3cb4f99254
-
SHA1
a0bf3fb15015bc1fbcb819d9a9c61f4762f4a10f
-
SHA256
eedf45e0803ce36c4b745e54fc7a7136d9b364c2a795e646548a4350cf88a366
-
SHA512
12c9eee9f1bb68e689cb58a2e4d90f75443fa0d444c15b487f3d61dbfdddb7abc805b77e1c1ebe8e4f1a8b573f6dd9aa99103f4a85df1f460a273097a2d38109
-
SSDEEP
98304:jtvxutyXqO0CybZB+vbE+JRQ0BNh3JBqbw60AKfpCON5inBF1K:jt5gUE+vbLJRBhJoeAKRCYQBFk
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 26 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 29 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\npp.8.6.5.Installer.x64.exe"C:\Users\Admin\AppData\Local\Temp\npp.8.6.5.Installer.x64.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Notepad++\updater\gup.exe"C:\Program Files\Notepad++\updater\gup.exe" -v8.65 -px642⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Notepad++\updater\gup.exe"C:\Program Files\Notepad++\updater\gup.exe" -unzipTo "C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\plugins" "ComparePlus https://github.com/pnedev/comparePlus/releases/download/cp_1.2.0/ComparePlus_cp_1.2.0_x64.zip ff4a7c9b32c8cbbda4144f82e0f30d567fb12f8fd3401b4005f7a170a198ac23"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Program Files\Notepad++\notepad++.exe3⤵
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
375KB
MD585c77d1248055e4601fab752eb3e91fd
SHA18dd40dfd40cd20c0f37ece13342fe6935b678733
SHA256710fc1698f023cc9eb35e55755c8208f81e89c52b625d00c166f83e6dd1fb20a
SHA512dd41d6ac250ae5dfbda4f90881c285e30d519602c1bb6e3bd97221afd853fe4064c9410c1ff048a3fff316cbaf7e7cb27c5b6bd13c3ec83d84642dc5596a001d
-
Filesize
451KB
MD5399402b2e3df3af5285bc91f5af2178b
SHA1ab297a9b946aed96dff276eec9a24d7c3eece2c6
SHA256321be8c6023eb897e9ff2bc7487830d0740c17db900fcc243256c79e07835275
SHA512405c01737754980cb6b7fe432ec71b7eb9370ceccf33ff5446bd15de231c50232258bdf54519dad370ee7d7db99584aa3068bbb6c926b830213ce9af0fae01e1
-
Filesize
6.9MB
MD5408f8c0474d0fc0b6f6ddf3e45fc2350
SHA14a490be6c9a768efe10e7a5da2509b711b0908c5
SHA256a41ecbdc16f1e893c5f40bae38174e14e3d969408b219f3f87fec2460d9fea40
SHA5128a58fd0e8bbe6fb2b83c9ffc8aa223a412f0ff022db77eb0ab81d48b152ef57f5fb46ceff2dae8f58b3c6d1657b978bfe81a33b5bd112e7ec3c4dbc759eac13d
-
Filesize
632KB
MD59a2f71a343a9e0b894b342ebcd4191cc
SHA1a262d2a2c1c05d486a757c6d16971057a752dafb
SHA2563d37cb219dde488c87250758acb114ed71dd615a46d8228336c74e1eb17ae848
SHA5120ef6cd1953ccbb502fef8636fd081fe5aba83be366b9c0989a53a447e25001dc6a3dab106ebdab761ac2bd7cdacbbfd2b7d01a877fab1bf1749b460daf31312f
-
Filesize
1.3MB
MD51e1a8f25970c23d06384048c99133ac8
SHA11f2eab15708e82974ead5ce01f1f13d1cbf991eb
SHA2562259679aba1be830e3420a01cb3b97d8f1baa00270f7106bc60b6cb2b94178c0
SHA51276abd2fd65f9c9c4f366021d4f542396839a0801851565cd917a6ef5979298a6c86601ca358312ced7b8fbcfd76f0b2348e8985cda52cc309196711983bc7756
-
Filesize
208KB
MD5ba89568a2eb296659405503ef470fefb
SHA1ec030b4919c1ba1a84eca732433e8c891bca353a
SHA2560d48413e605aa2773b0795729cfd2585c085578570b57ad60eb1cd0ecbf077b9
SHA512be6f3e36fb16d7cafb6313de2fe9e88ba7a84c9460941d3ef11bbbd2892f1fd7f61ad9b98509305e50810dd6335e3e607ab2193dd970feae3bfeeeb22e7156de
-
Filesize
198KB
MD5c98af1cd13ca8f3ab42bf8771a25feb0
SHA1c0b224b6b3cf9991941d9d5da14bd02133082bfd
SHA25662a28ac30acefa3e197c8c87ff6efbd19a879678286510cf39f8d69c36469292
SHA5124307c779647ed8518289583bbe5b9efb143a903ff64933a737354484fcc311ac59d2031bf7f47622ae5be05bb9481ebd5dd954193e9c35edc91445d0ddc35262
-
Filesize
153KB
MD575cc64b1fffb7ab95ce2a73eb050d72b
SHA11e8ef609079714b9b7f31976ee0a85c5c8cfb135
SHA25659cdf2564ea4b1e7b8f2758828c16f0f8f19e15bedf31b293268b39df6a5e6ec
SHA512d5f505c1e78e60e105428c62417dca9c32cc801b5a7fd3d8fb8b3fd60d2ed92eb6bd3e13ff2235673421d07d93d04ceb856370928734186ca107f4d8a49ffacc
-
Filesize
145KB
MD5e2723a2c3f046975bc8f0f46934998f8
SHA1a1af6486d5c088c80b8cf9f06227f7dcad4943b8
SHA25601215cbc07d7750f95e55db9c44d885ae377741de75c519c8b4050393933deb0
SHA5123f3d2bd6694215e916926c01d248c37b9f0b3ad7f52507205b0f43d2f4e8a01d002001c65ae734636bd3548eb41db589ca730af9644be3a03cff9f65b1640e25
-
Filesize
3KB
MD5fb573784b83033dd4361f52006d02cb8
SHA10a2923a44ec1bd5e7e8bc7cace15857ae03bf63c
SHA25637a24662cd55b627807bc2bb7cbba5bbf2abaf6da4dd7bbb949bfaa7903eae9c
SHA512753b44b5e8bea858cf5cc5ddfdc38098a2f3f921949cf98706ead95bdfa1de7ab0c115e9d69237623a03c422969480204c69d3ba277141527458c68230d0c67c
-
Filesize
182KB
MD5fcaa4458825cfef7e7b4566063dc823a
SHA19193f2c465d9d93f0fed2d969ba2cb582eea65eb
SHA2568c9f6f2016aee39c9a7208f4122c4d011ccfbf49b6e931db1d80f225bcb37448
SHA5129f396b40d975ee91628a4f558396b7dfec40c2fa6e728d9106f40647d9661203f4563e215d30b8d919be2811affe9290dd5069ed21384b1ed9a312bae1a88504
-
Filesize
789KB
MD58915ca8f839096861bb282714f46d39f
SHA13a04b524456b99946d5b7666a96f119f07987fff
SHA256901da2980ed18d66fee971dbc5b2886f03abf4dbed212e8882e4beb9d12f456d
SHA5128d2aff003d9b0130acee93fd3ab6bf18ac3419742a1f618783ca196d809518aaee4458cf60f349f8b89ac25ace0680ba48f510a8a20e6a0c753b8fdd73680463
-
Filesize
4KB
MD5abde55a0b1cb4a904e622c02f559dcd1
SHA11662f8445a000bbf7c61c40e39266658f169bf13
SHA25692717951aae89e960b142cef3d273f104051896a3d527a78ca4a88c22b5216a5
SHA5128fe75fb468f87be1153a6a0d70c0583a355f355bfe988027c88d154b500e97f2c5241d9557ebb981067205e2f23ad07b6a49c669cd3e94eaa728201173b235a0
-
Filesize
732KB
MD5d553035a7905706e174743d199d27874
SHA11523ebcfc787fef70efbc32cc1004ef7124c4b9f
SHA25668896042ba79fcab99d665599cfaf68ff800e631d4d65a5ede0340fc77a8162d
SHA51265565d259fff60999036a26b44f92a119c63c38cb267287ab53103431b915c29cddd31ef6376b0f3e68bd3c9a74d47a36faae1dbbf759311adca4163b013d347
-
Filesize
130KB
MD54550bd860351f6a78c739db8a37384dc
SHA1b09e179b906d8477beee211724921e05d0126b41
SHA256fb40c912b218a71bd7bc1aeef5530165df60d0b4f896929f989b8ff37a98d459
SHA51229729d0244192370d6fb6d8b7243e4610cbdcea52ff69805b16f019b9e0b570ea71a0f1773bcc0b13ba39252cb201f2a12b473c2c1fe17b16f475261b723e032
-
Filesize
15KB
MD5d095b082b7c5ba4665d40d9c5042af6d
SHA12220277304af105ca6c56219f56f04e894b28d27
SHA256b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c
SHA51261fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9
-
Filesize
5KB
MD550016010fb0d8db2bc4cd258ceb43be5
SHA144ba95ee12e69da72478cf358c93533a9c7a01dc
SHA25632230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
SHA512ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
-
Filesize
12KB
MD54add245d4ba34b04f213409bfe504c07
SHA1ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA2569111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA5121bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
-
Filesize
4KB
MD5d458b8251443536e4a334147e0170e95
SHA1ba8d4d580f1bc0bb2eaa8b9b02ee9e91b8b50fc3
SHA2564913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7
SHA5126ff523a74c3670b8b5cd92f62dcc6ea50b65a5d0d6e67ee1079bdb8a623b27dd10b9036a41aa8ec928200c85323c1a1f3b5c0948b59c0671de183617b65a96b1
-
Filesize
1KB
MD52865f7249a299427280e494b3eeb1d92
SHA19363c7e1f4ea5222e8c81d213ff9759484bc263c
SHA2560627819fa59b1ca6fb19d4dc7a4b3a272f46209fe01ec66a944691e38c501da3
SHA512e08397e013422bf2f25e1e2612c6a1b51847945f6edf599ee87912fbc070d219d777df202655fc4009e924cbcc5a0043d006bb7d76402623f2f2d53fa648df92
-
Filesize
1KB
MD59682a69b319e5b352545626911480843
SHA13add24dfe21fc6db118d2770eac877c9a3fa160e
SHA2568839327c41865683800f6a508c709019cfe7ca19252b62cca6b6588693feccec
SHA512e50e6c00582a458e1f4e2a94812ca6ec3a442bb65ac98096008020e03d0006d8c446600143088f1a70e75850c46a9c16a0eac54d677e99d4fd56d21db915bf26
-
Filesize
1KB
MD5083a33d104ddbbe1232005b4424d2d31
SHA1e9bb77f5e4664a1965e7f52d5b61872d407201e4
SHA25698ed72436106facbbb7fa83a04fe11002c366434e694cb74223b13fe5f13bd8d
SHA5126efae7d7d42591ea1091e67e4dd7d81f20a9dcbad458541cb13b9f5a5729b4ae7114ee780522dcf6cd824753573e4cbe1d015d21418d8ea243af41fa0438ac34
-
Filesize
1KB
MD5d7511c8ab1af72ba436bbcff62cd9c0a
SHA10449531aaf8f02ec69b8bd8b7b90ad4f2e78baeb
SHA2568d271c241908c70ac2272be7b95138b6c2c1129535ce479f8b53d9757ee7a8c5
SHA5123830014db61d58acd0c9ed95640a4154dba4d23f3cee0f4e5779460837fc137fa07120aa79df256e3a5bca3e7d8b60f36ec1e255d83ec6b43331b287748c294d
-
Filesize
9KB
MD51d8f01a83ddd259bc339902c1d33c8f1
SHA19f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA2564b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
SHA51228bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
-
Filesize
7KB
MD51e3ef6fb82409b74dc176393f725bb86
SHA102750f20c5b9290971a2ee29b4f1919e9170f415
SHA25653209d14dadc4a6d349f7941066555d1a405801a4440cf07262e8d9fa5ea2484
SHA5126dced4796ceedcbd32ee632b385409b44fc6e83860074c4b66d9e100209ec594c4a9611496affcc5c4b777215f3fddc245ed0a5f4d635abe16f8e4a5466847d7
-
Filesize
4KB
MD5fde4cc09d1c18c6cd7c1a4878e89d27e
SHA122fba21b254fed1a60da5de2b8af3cf6e132b647
SHA25643ac0b7ba9b1f91fd8d4841b8119344e6212b307a1decccf61658f31d38bb425
SHA512fcc87b93cb4dd0949e82edb7d2788d7abd317f9f4c5f046ceba1cd85a64b12b29c6baba3e8646265db02a48a2dc20c3b5e893a1334d9b1e91d26692b4e9c2d29
-
Filesize
646B
MD5f07150054a6afff4d8e9d58899167722
SHA1e092cd960ab728667d91b37d64a02d7f6821518b
SHA2565b0a08439e8e93817772f84e1098f14152d9da36c2601a0600ddaae6f61359d0
SHA5128c86aa4c058a8ab5fd26f21cacc8ddaffa8ce6012bb329d3c5b817da00b4b43018a575c768d1921c6eeab7537f172c7cb3de658b014365ea52fb3c87547182b9
-
Filesize
193B
MD55d261612f9233dc1754c83fee2c5a854
SHA116f3543dcc6ed0bb3f111e6bca845fe1cd1a20ec
SHA25652226d6d91ffe76d8aa3ce42982da9bb4881f04eb0d8d4ebb34a6e3204845901
SHA512875bbffd4772964ada70a4cf3aab6e9f6193757dc653d2cf58642156b4b15d6a806b86b6252f6bfec503065d3f7384b248b669064327fe74a948d9c273084bba
-
Filesize
864B
MD548794b5b7aa4f9d401dd2fd4e8923a5b
SHA12449825f9a30ffc68b01589bfb1f2767a3a846a9
SHA25604750e3aae4a9d6674d15edd1157f647a92940a3d5978d73c8325a9c418b1cdb
SHA512bbbc37af9a537a9a0ba458a9813f53c6e65528295b4aaa88c36eb779b83f6a44812ddf0ea3f286eda41f8ba964d74fd174934aa811a4ef4b1cada996557f9954
-
Filesize
1KB
MD5f087326e37a0bffdf31f8d588612a488
SHA18179db99440203ff3d8660b60f8e1ecde87cf4f2
SHA25601f64d33afa7660dc24b7b5e0a5796ae25e25e1b8b92440f15f5867f22dfeaab
SHA512c39def2e667ec1ebcbf239e802112f507de525250ec0cfbce9411cd08220a6746d70350a881b92e8f2a122f5ce0e23ca2b283b7075f0b4b84b33afad11cc5385
-
Filesize
2KB
MD5bc4b775a277672fc7edf956120576ecb
SHA1fe7c2db5b4d4c5a3f5603cf56c4d71cc9ee2d71d
SHA2564ec98de37193f41242c1a47507bcc4c1af555e71154f7354272bc3e664e19877
SHA512f87dc3ce52831ee308fbfa2b1b94c07e2811e7028360f046e012f8ea5a8f0ebcd362de7a663dee810c3da0791474c1485b1a2626c7867e76236156b125ff39b2
-
Filesize
6KB
MD5672e6d5f89887666ec94711e442644e0
SHA18d069ae93347316eff0dcf7aff4d22da18a62af2
SHA256b34fe6811dacfe49d77d434123867e866daf6e0e27387a0446887dabe8943f04
SHA5128fc5e9bbe027826304fa6f329fb16e4c9e4e7a597d87e9c691ed6a9f505b7bc1967339b43c6426105432a030260b0654468ab8fcbb4312b2fb6ed6c6aa537edc
-
Filesize
6KB
MD53690cef1865e32fe6be1b2ec7656539a
SHA1bc043bec63c310a60d9e242810036460c467945d
SHA256e45e49f0895249d951df2c07e0f06ca1242e05c961dd921e5aa2781ae2e7ff25
SHA512c2be869d96baec2018e13dcf5934dd9cf74146541e852cc2eedb4d83a8af23e2577cde7a0158fefaa11056416ff039df3a7725e320620193e9bfe72c8067c051
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff