c7faff5fb2e65b364befd2c2eeeb0fb30521b3f2600da24bcee3e8b8d17dbf1c

Analysis

max time kernel
46s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 20:37

Target

Nighty.pyc
Size

2.4MB
MD5

6bf475ec68cda6fe15458601e1e54cac
SHA1

94487d0e8acb99cb70e8a582c6b9a5112ebbfef7
SHA256

b99a622908a8fa8117e2bc8b15e168572befa29bb863c9c25a9e8fdf0e50ec35
SHA512

09a38dc7fab45a2a6171746941722e49e51cbf3dd483c1283ff3e020e9603bb2b5a7c7cc6d1644e2d150d39e7824fef139423dbdf1d5250e11196a362bd4adca
SSDEEP

49152:wPJLuY+oiMXC13NXFhnJtAfXJqTLVfUQW9dehdQzqqkDgUrqzOd2FXP:0uYyhFhnJtAfXJKYoQDa+f1P

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1424	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nighty.pyc
1⤵
- Modifies registry class
PID:4796

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact