ccbb921fcaa1d70e00c2d73de1b9762370da2ab96d7245a039b26bd3d773e1df

General

Target

nightlight_desktop_setup-1.2.0.exe
Size

6.8MB
Sample

240605-v7s4waeb25
MD5

4fb5fbb1727f25e5654a5b3fdc9dae19
SHA1

b343402e3af4751de999e6372e4b8e126c3afacb
SHA256

ccbb921fcaa1d70e00c2d73de1b9762370da2ab96d7245a039b26bd3d773e1df
SHA512

e4dd1b61c28bfb56fa028c7a100af35f2e255ba45967d7715bfde3a220162d423c2b9b6585355e5b744045fae5e26ce6c5582d085bfa9581d2f92fb8c26ed152
SSDEEP

196608:RC70yAyMGJpCIh0zoE5oWESVmooWnSZ4LSQ8f2lWjo:RRO3C7UErHBnSOBvWjo

Score

8^/10

Malware Config

Targets

- Target
  
  nightlight_desktop_setup-1.2.0.exe
- Size
  
  6.8MB
- MD5
  
  4fb5fbb1727f25e5654a5b3fdc9dae19
- SHA1
  
  b343402e3af4751de999e6372e4b8e126c3afacb
- SHA256
  
  ccbb921fcaa1d70e00c2d73de1b9762370da2ab96d7245a039b26bd3d773e1df
- SHA512
  
  e4dd1b61c28bfb56fa028c7a100af35f2e255ba45967d7715bfde3a220162d423c2b9b6585355e5b744045fae5e26ce6c5582d085bfa9581d2f92fb8c26ed152
- SSDEEP
  
  196608:RC70yAyMGJpCIh0zoE5oWESVmooWnSZ4LSQ8f2lWjo:RRO3C7UErHBnSOBvWjo
Score

6^/10

discovery persistence
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  15KB
- MD5
  
  d095b082b7c5ba4665d40d9c5042af6d
- SHA1
  
  2220277304af105ca6c56219f56f04e894b28d27
- SHA256
  
  b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c
- SHA512
  
  61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9
- SSDEEP
  
  192:EyGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTr11929WtshLAzgSrX8:EyNt+4t7uJalUnGesY7Lt8nCr/Yosa
Score

3^/10
behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  4add245d4ba34b04f213409bfe504c07
- SHA1
  
  ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA256
  
  9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- SHA512
  
  1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP
  
  192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
Score

3^/10
behavioral3
- Target
  
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size
  
  1.7MB
- MD5
  
  60366cbf515774ffde2b49297c3d2e9b
- SHA1
  
  0158273f35fb5069ae6ad2950045d3656e86b444
- SHA256
  
  7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- SHA512
  
  b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP
  
  49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
Score

8^/10

discovery persistence
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral4
- Target
  
  NightLight Desktop.exe
- Size
  
  12.1MB
- MD5
  
  7cb0c686be62a6a5118d3441b4792609
- SHA1
  
  f51fcce8020f5b0cb0d6d3e8ce7aad259f2365a1
- SHA256
  
  8254514e476344d58f9f2aad6b6ba5b5f7853e82efdde08124910b4fc139e356
- SHA512
  
  2af1228786b90fc5287c1bbd56f05a7a8ce72d5162d75718e429c3a90e1812459ba4a7e9e24a903137428ec51ce82eb7946d96fd6de98a1611cced8bcad9818f
- SSDEEP
  
  98304:Gs37s+saQ5zLeSTdYfOU7baBzjYz0ILiVUEp2rbvfMWXtEN:qfaQ5zLiflatpknAN
Score

6^/10

discovery evasion persistence trojan
- Checks whether UAC is enabled
  evasion trojan
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5