Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3NightyGo.rar
windows7-x64
3NightyGo.rar
windows10-2004-x64
3NightyGo/NightyGo.exe
windows7-x64
1NightyGo/NightyGo.exe
windows10-2004-x64
1NightyGo/config.json
windows7-x64
3NightyGo/config.json
windows10-2004-x64
3NightyGo/d...nd.mp3
windows7-x64
1NightyGo/d...nd.mp3
windows10-2004-x64
6Analysis
-
max time kernel
53s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
NightyGo.rar
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
NightyGo.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
NightyGo/NightyGo.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
NightyGo/NightyGo.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
NightyGo/config.json
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
NightyGo/config.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
NightyGo/data/nitrosound.mp3
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
NightyGo/data/nitrosound.mp3
Resource
win10v2004-20240508-en
General
-
Target
NightyGo.rar
-
Size
5.8MB
-
MD5
94b834ad8a680aef58980761c09e53ee
-
SHA1
2709a20f0083083546e33988b83bba4ccadd2380
-
SHA256
72d72607279e1add253c86dc2e664027dd1f495fbef456cb7415ef36dcf3901a
-
SHA512
f9cf3d2162c5b94ec0d539ddc6ffea7d99add0a06bfe5bb0d3a6ca0badedd3ffc0812db6ab696cc4c7158252240004cc26805e7d9ec245ae7cba149e5b91956f
-
SSDEEP
98304:gFYRNc1oTXDTO2ESe5DJ2VeaKYS+YM92H7BeqWnO8nixTK+CNJdZEkb9:NDc1QTT+pv2V2D+YE2H7MqW70TK++ZE4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4400 OpenWith.exe -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe 4400 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\NightyGo.rar1⤵
- Modifies registry class
PID:3984
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4400