f28156a96be558dfb83a3d935223a127816ad124b94f92c499400c38078ad842

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
masScan_1.6/masScan_1.6/winpcap-4.13.exe
Size 423KB
Sample260511-adn8lsbx9n
SHA256 f28156a96be558dfb83a3d935223a127816ad124b94f92c499400c38078ad842
MD5 ae26452c8b3d97ef2037521ac0dd3a8b
SHA1 3ad99ec2bf6cc4f947bb09be627c91f82a898aa8
SHA512 f5012a9600542b46eca137f41d58d6a6d3071aa36ca2b4c0f0119639cdf051c0a0e597c674583c4ec5753f8368ca121282acbf084930d2b1f30671f2032448d9
SSDEEP 6144:MsNaGdmkMIdQQkpxYLcP+k471Xr4bjMxiW+D/xqfF3o2KCzDunki8m/VlidXTj2G:AG4kDdc8L4bQA5qt3CxnkLwlQFPcOLJ
TLSH
T196942213BAC4C073E0AA1F72B1735356FB75A904026079437B64EF7B3D29622DE096E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\npf.sys	winpcap-4.13.exe

Loads dropped DLL 5 IoCs

pid	Process
4420	winpcap-4.13.exe
4420	winpcap-4.13.exe
4420	winpcap-4.13.exe
4420	winpcap-4.13.exe
4420	winpcap-4.13.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pthreadVC.dll	winpcap-4.13.exe
File created	C:\Windows\SysWOW64\wpcap.dll	winpcap-4.13.exe
File created	C:\Windows\SysWOW64\Packet.dll	winpcap-4.13.exe
File created	C:\Windows\system32\wpcap.dll	winpcap-4.13.exe
File created	C:\Windows\system32\Packet.dll	winpcap-4.13.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	winpcap-4.13.exe
File created	C:\Program Files\WinPcap\LICENSE	winpcap-4.13.exe
File created	C:\Program Files\WinPcap\uninstall.exe	winpcap-4.13.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winpcap-4.13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 5024	4420	winpcap-4.13.exe	85
PID 5024 wrote to memory of 3812	5024	net.exe	87

C:\Users\Admin\AppData\Local\Temp\masScan_1.6\masScan_1.6\winpcap-4.13.exe
"C:\Users\Admin\AppData\Local\Temp\masScan_1.6\masScan_1.6\winpcap-4.13.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\net.exe
  net stop npf
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nse367E.tmp\InstallOptions.dll
Size 14KB
SHA256 1edf8dc7b6ef67e7cf68f6b07f38be5b336b5e6b2d1d5500cdb3e121b8381394
MD5 79327201915b7cf3ba0c5d1a143aa925
SHA1 185b6f5520b1c39d3e7d9d91ed099698fac46d92
SHA512 c51086b7e039c83abb727a33b7f1ccac4fa999373b0423ac4b253e87195a5515d29e98ea2ed64f30406a14db4bf94422d34e6c9db8fc80be5c4e3fc77fd0207e
SSDEEP 192:QGs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijYK72dwF7dBEnbok:QGvdH4qMebzPY2VijY+BEnbo
TLSH
T178623B51638888F3DBD6013EB4533707AB595126B4925DE2CB271FCA6D3B18E3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse367E.tmp\System.dll
Size 10KB
SHA256 3198d832c222a9907d3d5822116c944fd1c6670a263b775212104a9ecf88beec
MD5 5c22bbf6730572e50eed4108af6081df
SHA1 8a13196f4d47ee7de2e35509058db954db10c72a
SHA512 264b194a50cb523f5758569d918b5f60cb2959c4d091ae6712efc95644700a7bc2bb440a22acdf2285b754691a9cc04633fcc7c5b354dae75c7260d6b27ebb18
SSDEEP 192:Vv+cJZE61KRWJQO6tFiUdK7ckD4k7l1XRBm0w+NiHi1xSJ:Vf6rtFRdbQ1W+fx8
TLSH
T1DB224B5893A0C1F3E6A0853C18573A77272A712445A18FE3CFA35841AE196D7BC7E337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nse367E.tmp\nsExec.dll
Size 6KB
SHA256 7994b5dbbd63253b8e11ee5d4aa34c61852d5f86a9c4a35ef421de2c26c80cd9
MD5 6d376db8c870c88759ab0fac0f91bde4
SHA1 c1df9264442c84858735550af99c1af55204dc31
SHA512 ed37d2b97e44c5f2e3bb63dcae3b7eafff0a00ea6d315b6764b322d4dd68ec5d3f9c8a5b8e23cf585612c8b6fdd5bd6eb03e13237c445f990eca86a59579fd23
SSDEEP 96:zW7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNG32E:MGgrwgcrEzylQBHkZwd0qJVgN5
TLSH
T12DD1F93D76C33DB3C54ACA753C65292F0FB8C8261B5402119B5716C279D5AE3FE28382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nse367E.tmp\options.ini
Size 319B
SHA256 baa85ccc5df2e9982559dcc63c048f5a8fe9a1efe589efa726cc612a3572d240
MD5 54d0d79fd0cfffe772f507ae52f3687a
SHA1 e8a4e2d202fdff81b73111c13f720ce36b0ec2fe
SHA512 57419e21007719e9087e4d5d34f6f8f67d4e8a6e0269a8b7b8ac1ce33b70cfea6de3fd99d626a1d7486ef78a8f04e19114b32d3134ffb7ae52f7820cab439b6a
TLSH
T109E0CD7D2451473A993520056D9DBFC37B80273513041570D1B52443DBDDDDE98FD6C5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4420-25-0x00000000008C0000-0x0000000000B41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads