Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

npp.8.6.7....64.exe

windows7-x64

5

npp.8.6.7....64.exe

windows10-2004-x64

4

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...al.ini

windows7-x64

1

$PLUGINSDI...al.ini

windows10-2004-x64

1

$PLUGINSDI...er.bmp

windows7-x64

3

$PLUGINSDI...er.bmp

windows10-2004-x64

7

$PLUGINSDI...rd.bmp

windows7-x64

3

$PLUGINSDI...rd.bmp

windows10-2004-x64

7

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    npp.8.6.7.Installer.x64.exe

  • Size

    4.6MB

  • Sample

    240802-27rz5sygmd

  • MD5

    d401161afb56b8647202e031cec1ae78

  • SHA1

    6eb7ed61ccdb0bd5018271a3ec24b63b913fc281

  • SHA256

    81470eb5917705fa0df03181b8112422671842bdcec5252a7894975b38058c91

  • SHA512

    01df1134b9f4d6bb44a8f23a9ba8191dbfb20ed1eb5f249331000955f6b340b1e3e3a6c0e237456a39a712f77d90fe85fc4b946832c88fe4617e45daea9c966b

  • SSDEEP

    98304:YtvLd2AV2+xDkRCH60uSzAUc8/hx2y5ho31X9pf86Mxxik5WVzZpZvO:YtBTZFET0Jcq2Kho31Xf06MzvAF/ZG

Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target

      npp.8.6.7.Installer.x64.exe

    • Size

      4.6MB

    • MD5

      d401161afb56b8647202e031cec1ae78

    • SHA1

      6eb7ed61ccdb0bd5018271a3ec24b63b913fc281

    • SHA256

      81470eb5917705fa0df03181b8112422671842bdcec5252a7894975b38058c91

    • SHA512

      01df1134b9f4d6bb44a8f23a9ba8191dbfb20ed1eb5f249331000955f6b340b1e3e3a6c0e237456a39a712f77d90fe85fc4b946832c88fe4617e45daea9c966b

    • SSDEEP

      98304:YtvLd2AV2+xDkRCH60uSzAUc8/hx2y5ho31X9pf86Mxxik5WVzZpZvO:YtBTZFET0Jcq2Kho31Xf06MzvAF/ZG

    Score
    5/10
    discoverypersistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      15KB

    • MD5

      d095b082b7c5ba4665d40d9c5042af6d

    • SHA1

      2220277304af105ca6c56219f56f04e894b28d27

    • SHA256

      b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

    • SHA512

      61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

    • SSDEEP

      192:EyGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTr11929WtshLAzgSrX8:EyNt+4t7uJalUnGesY7Lt8nCr/Yosa

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/ioSpecial.ini

    • Size

      211B

    • MD5

      e2d5070bc28db1ac745613689ff86067

    • SHA1

      282e080b4cf847174c5c11e4f9157b8c338ecb19

    • SHA256

      d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0

    • SHA512

      a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de

    Score
    1/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/modern-header.bmp

    • Size

      25KB

    • MD5

      a70c3979ab1716c84969eb73618ca7d7

    • SHA1

      f0b4c8c1b8c59aa0382ae4f65263a389a3cc3996

    • SHA256

      e6c5be8aba1f657fe77e8c9bbfac3536a69530aa5c1411cc3d6c235373203a46

    • SHA512

      3d0eba870b91f08a6e7b380d0137f6415d1184a77643521e7b2a01774272971853774b72517921a788ae7c606e3940c39fd36f03a7da76c972d1ef1adbc0e409

    • SSDEEP

      384:1oacST1ci4MZzWc5bgoUK+RQ0s6SLARs2v/C7zAkAFTqI+4TFWAWGQg5s:CaciEMZzPcoUK+a0sD52HCYkCTTmABw

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral10behavioral9

    • Target

      $PLUGINSDIR/modern-wizard.bmp

    • Size

      150KB

    • MD5

      c2cf6928a3ab574a5548b4dc1c38b6c0

    • SHA1

      8860ff529f60b38a93912f88f234d46eebcf664f

    • SHA256

      2125550c12fa512782f2016e802d70bc51f4a06017cfbd4176b4a994eb2542f0

    • SHA512

      fb6b28f2677b1418f8ebf621dd1e201b127b53b998c02300caa66a9f374f681961f5b9a7f843d6082821890df9e3d91a3403b4f83d70d155e9c841893e1f80e4

    • SSDEEP

      3072:NKrK243U6RNfWAKVZ17e28FTfWDG7wFlF9:NKW3UMfWTpe2eODG7UF9

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    discovery
    behavioral13behavioral14

MITRE ATT&CK Enterprise v15

Tasks