Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1904s
  • max time network
    1875s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2023, 22:25

General

  • Target

    https://cdn.discordapp.com/attachments/1085728931841318992/1085735291060494426/Nightmare.exe

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1085728931841318992/1085735291060494426/Nightmare.exe
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7d089758,0x7ffe7d089768,0x7ffe7d089778
      2⤵
        PID:2528
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:2
        2⤵
          PID:3508
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:8
          2⤵
            PID:500
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:8
            2⤵
              PID:4592
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2832 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:1
              2⤵
                PID:2440
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2824 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:1
                2⤵
                  PID:4772
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5044 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:8
                  2⤵
                    PID:4748
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5020 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:8
                    2⤵
                      PID:2080
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:8
                      2⤵
                        PID:1152
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:8
                        2⤵
                          PID:4536
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:8
                          2⤵
                            PID:2628
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4908 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:8
                            2⤵
                              PID:4480
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3968 --field-trial-handle=1864,i,16396612143171917245,11422065020944247713,131072 /prefetch:8
                              2⤵
                                PID:2364
                              • C:\Users\Admin\Downloads\Nightmare.exe
                                "C:\Users\Admin\Downloads\Nightmare.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4540
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c mode con:cols=0000 lines=0000
                                  3⤵
                                    PID:3068
                                    • C:\Windows\SysWOW64\mode.com
                                      mode con:cols=0000 lines=0000
                                      4⤵
                                        PID:2812
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c title Window Title
                                      3⤵
                                        PID:4580
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\myfiles" mkdir "C:\Users\Admin\AppData\Local\Temp\myfiles"
                                        3⤵
                                          PID:2304
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wxy" mkdir "C:\Users\Admin\AppData\Local\Temp\wxy"
                                          3⤵
                                            PID:4272
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wxy
                                            3⤵
                                              PID:1768
                                              • C:\Windows\SysWOW64\attrib.exe
                                                attrib +h C:\Users\Admin\AppData\Local\Temp\wxy
                                                4⤵
                                                • Views/modifies file attributes
                                                PID:2372
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\is64.txt
                                              3⤵
                                                PID:2344
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\is64.bat
                                                3⤵
                                                  PID:4896
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c
                                                  3⤵
                                                    PID:2112
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c pause
                                                    3⤵
                                                      PID:1040
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c
                                                      3⤵
                                                        PID:2272
                                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                    1⤵
                                                      PID:5036
                                                    • C:\Windows\system32\OpenWith.exe
                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                      1⤵
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4184
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                      1⤵
                                                      • Drops desktop.ini file(s)
                                                      • Checks processor information in registry
                                                      • Modifies registry class
                                                      PID:2984

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      69fdb5b8abedce24453c78591b496c82

                                                      SHA1

                                                      6dffa2bee8a38b9a7643f9c325ede88c2c7e6ddd

                                                      SHA256

                                                      a90efce3fa3bd13ad2c77d748a44f1d0e9d98eaf2396df461b206738194c2dfe

                                                      SHA512

                                                      fcb863150b87f5e056d683fc88217a73dbd45df4f72137246f83bced1933f25bcc2fa8e395068c8bae17a3f31f6e1f2b2c474068883226b6735aefba3bf26d69

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      a3cc7850f71e6e4ffdb67213df003f34

                                                      SHA1

                                                      ce4251b5fbdb19d2c6933d0cf2183be8c870a58d

                                                      SHA256

                                                      fc3cebb956dfaa04eaaa16e4d7da0fa1c62611bb2e1c489cd0ef42ab5399cfec

                                                      SHA512

                                                      58b096cba4fddfb480189e0629d77bd353eb573301ff96585f1935ff72edbc38b904c1d8d5d0937d75d076aac30b4ce0b8b1a5ac985e925129e154eeb386efbe

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                      Filesize

                                                      97KB

                                                      MD5

                                                      8262f25280f4c3616b4b67979fab0d3c

                                                      SHA1

                                                      6f85b680fd49ed4e341011f225dec950d9967b47

                                                      SHA256

                                                      e5b8f77c8d739f4d0f11f80e04fea47aa35e0403397e009dfd45c8bc8e9fdfbc

                                                      SHA512

                                                      fde7dc29fb4ee0c4a0ed4d4fa02a067ab6e3106c5fe682395079e0180086b364edd749d564e28a55d712df6586e2af9372b0008808096b33c9f5b0393ebf70ad

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                      Filesize

                                                      97KB

                                                      MD5

                                                      956ca9e6fdd64a3f394a34fe2c676ab7

                                                      SHA1

                                                      3201663d1305fa734e1bb281d1a16d476efc33d6

                                                      SHA256

                                                      7fea244a6c869785182e926d9d4e2610aff8259bb92164c80d8e7081200dab2b

                                                      SHA512

                                                      618fd997d3853a8e2d757891aa095320eca370d455d6941b1fa85647e1a31581f015f49e0590aac09d7678d5e4427f44debb211fbcbfd9736df863e9d204e80c

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                      Filesize

                                                      264KB

                                                      MD5

                                                      1ee9c6038553f4009121d10906c4e352

                                                      SHA1

                                                      502d6e8f5ef3a249d5a270d13f236a7cff18f37b

                                                      SHA256

                                                      48970f041421d1e0712bad10a72ceff10eac89bfd3ca1c4d66e777ecfaf63b61

                                                      SHA512

                                                      c9a50876552eff554baf59ceef0a39d28f12bea629353978e5dc23c63cf8c08429a16f7f86e1b2656bc8e62924bb812eff842c26b3b2844b20706ea27f8d0fcb

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                      Filesize

                                                      2B

                                                      MD5

                                                      99914b932bd37a50b983c5e7c90ae93b

                                                      SHA1

                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                      SHA256

                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                      SHA512

                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                    • C:\Users\Admin\AppData\Local\Temp\is64.bat

                                                      Filesize

                                                      181B

                                                      MD5

                                                      225edee1d46e0a80610db26b275d72fb

                                                      SHA1

                                                      ce206abf11aaf19278b72f5021cc64b1b427b7e8

                                                      SHA256

                                                      e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559

                                                      SHA512

                                                      4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504

                                                    • C:\Users\Admin\AppData\Local\Temp\is64.txt

                                                      Filesize

                                                      3B

                                                      MD5

                                                      a5ea0ad9260b1550a14cc58d2c39b03d

                                                      SHA1

                                                      f0aedf295071ed34ab8c6a7692223d22b6a19841

                                                      SHA256

                                                      f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

                                                      SHA512

                                                      7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

                                                    • C:\Users\Admin\Downloads\Nightmare.exe

                                                      Filesize

                                                      80KB

                                                      MD5

                                                      294206df5f33d5c46170acab0a03e6ba

                                                      SHA1

                                                      940f0f25ff438b2cf277b97837e92700cfe1a972

                                                      SHA256

                                                      d7fb3a0afe1691f0a8c1240b28de66521805c076a31811cf3de1f5df4449bf9b

                                                      SHA512

                                                      fba944a1aab4b831a289409478befe801331721f665ec90aa201ecaafdac6baac1ab8bb890ce9cc28afbe203482dc29ee4b53510bbc0ff89300e3f895f720f23

                                                    • C:\Users\Admin\Downloads\Nightmare.exe

                                                      Filesize

                                                      80KB

                                                      MD5

                                                      294206df5f33d5c46170acab0a03e6ba

                                                      SHA1

                                                      940f0f25ff438b2cf277b97837e92700cfe1a972

                                                      SHA256

                                                      d7fb3a0afe1691f0a8c1240b28de66521805c076a31811cf3de1f5df4449bf9b

                                                      SHA512

                                                      fba944a1aab4b831a289409478befe801331721f665ec90aa201ecaafdac6baac1ab8bb890ce9cc28afbe203482dc29ee4b53510bbc0ff89300e3f895f720f23

                                                    • C:\Users\Admin\Downloads\Nightmare.exe

                                                      Filesize

                                                      80KB

                                                      MD5

                                                      294206df5f33d5c46170acab0a03e6ba

                                                      SHA1

                                                      940f0f25ff438b2cf277b97837e92700cfe1a972

                                                      SHA256

                                                      d7fb3a0afe1691f0a8c1240b28de66521805c076a31811cf3de1f5df4449bf9b

                                                      SHA512

                                                      fba944a1aab4b831a289409478befe801331721f665ec90aa201ecaafdac6baac1ab8bb890ce9cc28afbe203482dc29ee4b53510bbc0ff89300e3f895f720f23

                                                    • C:\Users\Admin\Videos\Captures\desktop.ini

                                                      Filesize

                                                      190B

                                                      MD5

                                                      b0d27eaec71f1cd73b015f5ceeb15f9d

                                                      SHA1

                                                      62264f8b5c2f5034a1e4143df6e8c787165fbc2f

                                                      SHA256

                                                      86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

                                                      SHA512

                                                      7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c