c7faff5fb2e65b364befd2c2eeeb0fb30521b3f2600da24bcee3e8b8d17dbf1c

Analysis

max time kernel
34s
max time network
15s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nighty.pyc
Size

2.4MB
MD5

6bf475ec68cda6fe15458601e1e54cac
SHA1

94487d0e8acb99cb70e8a582c6b9a5112ebbfef7
SHA256

b99a622908a8fa8117e2bc8b15e168572befa29bb863c9c25a9e8fdf0e50ec35
SHA512

09a38dc7fab45a2a6171746941722e49e51cbf3dd483c1283ff3e020e9603bb2b5a7c7cc6d1644e2d150d39e7824fef139423dbdf1d5250e11196a362bd4adca
SSDEEP

49152:wPJLuY+oiMXC13NXFhnJtAfXJqTLVfUQW9dehdQzqqkDgUrqzOd2FXP:0uYyhFhnJtAfXJKYoQDa+f1P

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2368	AcroRd32.exe
2368	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2512	2648	cmd.exe	29
PID 2648 wrote to memory of 2512	2648	cmd.exe	29
PID 2648 wrote to memory of 2512	2648	cmd.exe	29
PID 2512 wrote to memory of 2368	2512	rundll32.exe	30
PID 2512 wrote to memory of 2368	2512	rundll32.exe	30
PID 2512 wrote to memory of 2368	2512	rundll32.exe	30
PID 2512 wrote to memory of 2368	2512	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nighty.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Nighty.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Nighty.pyc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
305840fc7b6dd1cede1f16c8a5cd8b4c

SHA1
910ab5f4c644376c5b37e6cbd9b312ce7abd74f8

SHA256
f7a834df1fc0ad86c136d1a5c6b01f9b289fc34e9a54c0ea68d36df0703f833e

SHA512
984e2be888f7744b2a299d4c7376de3c8663957a2b33d1288c05e052ad85e2ec2727cb068eae3993e8ea44fe366c5ba675eaeaa49073a98f40a6e4e7370d5664

Download Submit