Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3NightyGo.rar
windows7-x64
3NightyGo.rar
windows10-2004-x64
3NightyGo/NightyGo.exe
windows7-x64
1NightyGo/NightyGo.exe
windows10-2004-x64
1NightyGo/config.json
windows7-x64
3NightyGo/config.json
windows10-2004-x64
3NightyGo/d...nd.mp3
windows7-x64
1NightyGo/d...nd.mp3
windows10-2004-x64
6Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
NightyGo.rar
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
NightyGo.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
NightyGo/NightyGo.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
NightyGo/NightyGo.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
NightyGo/config.json
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
NightyGo/config.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
NightyGo/data/nitrosound.mp3
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
NightyGo/data/nitrosound.mp3
Resource
win10v2004-20240508-en
General
-
Target
NightyGo/config.json
-
Size
278B
-
MD5
32dd2cf69aa5e24eb3287fd13c38c195
-
SHA1
7c2682d984f4211c5a2a082c156cee84542a3696
-
SHA256
c4522b95034acac58f3a65b8688a87f301d5425c7e235573b57a6b822f637ad7
-
SHA512
076869080dc4c97ef90e96f05bd4b6ad9c49c876fd2853bfd002301e17dc7d13429060731349b62b1bfbb6f2d1ab45ba3c28a5ba5e8ad2fbf0b56251a7bb89d8
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.json rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2544 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2544 AcroRd32.exe 2544 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2556 1888 cmd.exe 29 PID 1888 wrote to memory of 2556 1888 cmd.exe 29 PID 1888 wrote to memory of 2556 1888 cmd.exe 29 PID 2556 wrote to memory of 2544 2556 rundll32.exe 30 PID 2556 wrote to memory of 2544 2556 rundll32.exe 30 PID 2556 wrote to memory of 2544 2556 rundll32.exe 30 PID 2556 wrote to memory of 2544 2556 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\NightyGo\config.json1⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\NightyGo\config.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NightyGo\config.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2544
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53c3313e671ea7fc44787af6121013bab
SHA1e89141e92fcb1a681dcfe352bc4d0e086caa88f1
SHA256072eba04993a50a3c83c286b926b34f19db4892cc18ae3f2d131330621f8d458
SHA51210a2d8b741be4de24d136a4fad5c6ee10ee74a224762f93eb79d813849480f99b25d390e20288ed34e427bbbfee9920a4f325bd22dec626be35305999df75112