1d380b50b9b00e7b2983aee797c4ef4e9b6909c962166bd0086b62d1aacf5b5f

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/npcap_free_download.ps1
Size 1KB
Sample261006-pg3bzagt4w
SHA256 1d380b50b9b00e7b2983aee797c4ef4e9b6909c962166bd0086b62d1aacf5b5f
MD5 91fab722571a825998371911ddec5807
SHA1 044e12210d5549837e2dc16663d17fc842976fbd
SHA512 37064733d3af4e0c57b80cb0cace4a176250a90d4d494fa4772942d2d7822b4001b45f9eb7b0c19d032d24a72d6965bb2065da793c7a0e96b794e725f7db7b84
TLSH
T19311D00F6166563094C742B6594E21D2BB8A819F00C98C40B43E854FFF9512ACADA7EB
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4108	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	4108	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2228	npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe

Loads dropped DLL 4 IoCs

pid	Process
2228	npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe
2228	npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe
2228	npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe
2228	npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Npcap\install.log	npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4108	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4108	powershell.exe
4108	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 2228	4108	powershell.exe	94

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\npcap_free_download.ps1
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe
  "C:\Users\Admin\AppData\Local\Temp\npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_opcom3mu.mmx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_opcom3mu.mmx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe

Path C:\Users\Admin\AppData\Local\Temp\npcap-1.89-d653b56f98974c97aef52613a0f7b477.exe
Size 1.3MB
SHA256 8aed85e900d783d1308506e919587d3e540451947af8a82f2d04f819e44305cc
MD5 f666c654d041e6083d5d88f38ed38bdf
SHA1 2f8a6bfa437e23cd0e4b3069ed4d7d15c4527b5f
SHA512 bceeb1c50df97eba8839d48ad44d6b574b7143cd12809e528c50b3fc87ebc791faca83ad3afa146af312649dcef9b9aaba7d1bd109bcbb7f5e5a31e17e36b740
SSDEEP 24576:4VyR1fgHzgvR6zfls5Gh60WJxQeFhMXFB/iJJEByKxUSZ41rMUE:rR1fgHUvR6zR60WcaUB/gJ3KdKE
TLSH
T106553341A8CFDF06F5F399B13CBE17212BE772052890E9828359CAA6FF21917D4193D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrC7E1.tmp\InstallOptions.dll
Size 25KB
SHA256 04f9432186b2aaffe44cf9610ef3d148eff881880ceda6efa59b3cba1405b892
MD5 5f840911e4fc9015ce7a2fcb54dcaf5e
SHA1 589d1ad1c0e7c9a5454c2a5afab283e98b90f061
SHA512 53b62c5545e4378110d45355d4bf493caa40dc63167f86955752e43d93b96e4b9465578797a4a9b6fe107f76ed1816cf076a0be3e97d9f943c1c63ddf8142a37
SSDEEP 384:EKNt+4t7uJalUnGesY7Lt8nC3/YosaiIYi/kn/hy8RbmL4nNygB:EH4t7uJnGeXLtUJ+Yi/S5ALO
TLSH
T18CC27D527BD05C72E5A72E3479E0A227DFB1F6226881C987E2365E069B413813EBD361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrC7E1.tmp\System.dll
Size 22KB
SHA256 3ceadba8f202e3f7f605dcad341255e596810fc94d623de2b2c9169ff7bc4592
MD5 cd6a36dd894b5a4d5a09b14f8b4141c6
SHA1 e65bad79ac9c676f65a988afd779f72cc699430f
SHA512 ac1443f441e9e37604d7c13a4601debd06fc335aaa43a147d914c6940cffedd2d2075463f82b815861849c3f28c240d33b948442d981287958deb3174e212de0
SSDEEP 384:b/Qlt7wiij/lMRv/9V4brrzIYi/knoQy8RbmL4nNyj1+M:baeiijipo8Yi/k5AL/R
TLSH
T18DA28E138BA04CF1F9165D3034D4BA36AFBB79991AD081D377E6C191AB503C329BD297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsrC7E1.tmp\options.ini
Size 2KB
SHA256 eba087a62a6e707b12b2cc4626d9608de0d0e23cbe366718d3d6dbb2180e9145
MD5 daf247967d328f652a238fcfb1db69ac
SHA1 5567802e9cad0177563e6435079981d8bc1ca413
SHA512 d57f6c69336a30d6f9bb61c0636d4b2906ee1521bfbef58ca78543cfe2d2d52d71842836dd7acff8e513dc9a83a71eeca4c48f3b66f8c2583168ef0a7ede6483
TLSH
T119515F133AF95428E0AAB54DEBF5843597383545542DC90FD1D10A0F4DE6E814A27FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsrC7E1.tmp\options.ini
Size 2KB
SHA256 e3707c82f4117deedf70550146bbd320e41b3dc8db8041c1a04c777553e8f12f
MD5 57d3dca6d3259a16f02fd88e23dcd15f
SHA1 2d82e59379d9722882804b2bd93a6b9345f8f578
SHA512 2045e8296e41ac2f8307a26c39b99c81505182eb27719b30bf2c47e1f1883a9260dcc1db3861f44f686cd1601db90f2cf8e0f8237bed2ab7307563c084e92a3a
TLSH
T1CB414A133AF96024F0AAA64CEBF6843597383485192EC94FD1D14A0F4DE5A818627FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsrC7E1.tmp\options.ini
Size 2KB
SHA256 93fc81eb96efab8bea3189c10ced7f1b51ff1d1755d5b6e9702e743b875f85ba
MD5 a7e70015a583ae6360f817eb20a3cb30
SHA1 2f72ae336b7ec2594eb3c4d8ff61ba40c30874ce
SHA512 e6b6e698ab83a8549e80280fa4bf212b571e3e11b5e9d6d51cecdb5ec8249b444ec993dd2d7fcdf1de1e0e8e97c7948a2ac5bbe0ea1ac6e5be4fa78076d2639c
TLSH
T182413A133AF96024F0AAA64CEBF6843597383585192EC94FD1D14A0F4DE5A818627FEF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4108-1-0x000002385EC20000-0x000002385EC30000-memory.dmp

Download

memory/4108-0-0x000002385EC20000-0x000002385EC30000-memory.dmp

Download

memory/4108-9-0x0000023860CD0000-0x0000023860CF2000-memory.dmp

Download

memory/4108-203-0x000002385EC20000-0x000002385EC30000-memory.dmp

Download

memory/4108-202-0x000002385EC20000-0x000002385EC30000-memory.dmp

Download