c7faff5fb2e65b364befd2c2eeeb0fb30521b3f2600da24bcee3e8b8d17dbf1c

Analysis

max time kernel
82s
max time network
16s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nighty.pyc
Size

2.4MB
MD5

6bf475ec68cda6fe15458601e1e54cac
SHA1

94487d0e8acb99cb70e8a582c6b9a5112ebbfef7
SHA256

b99a622908a8fa8117e2bc8b15e168572befa29bb863c9c25a9e8fdf0e50ec35
SHA512

09a38dc7fab45a2a6171746941722e49e51cbf3dd483c1283ff3e020e9603bb2b5a7c7cc6d1644e2d150d39e7824fef139423dbdf1d5250e11196a362bd4adca
SSDEEP

49152:wPJLuY+oiMXC13NXFhnJtAfXJqTLVfUQW9dehdQzqqkDgUrqzOd2FXP:0uYyhFhnJtAfXJKYoQDa+f1P

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	AcroRd32.exe
2656	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1876	3032	cmd.exe	29
PID 3032 wrote to memory of 1876	3032	cmd.exe	29
PID 3032 wrote to memory of 1876	3032	cmd.exe	29
PID 1876 wrote to memory of 2656	1876	rundll32.exe	30
PID 1876 wrote to memory of 2656	1876	rundll32.exe	30
PID 1876 wrote to memory of 2656	1876	rundll32.exe	30
PID 1876 wrote to memory of 2656	1876	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nighty.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Nighty.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Nighty.pyc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
254a536149dbd28f8f7b22edbe420ae3

SHA1
0df59e5fab77f74402cb66e314a461221f27d2be

SHA256
60bf7643901f1068c7e5be40008a8433b1bfbf562e2e96deb942bdc55d4cf7f4

SHA512
c6125058bb1efc4687598974c917e634907819534c417e4ce51ecc5fbec3258ddf2697f7c35c59990c978a8efd82bd3a46d62797952f8ff360d459a744ddea62

Download Submit