Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3NightyGo.rar
windows7-x64
3NightyGo.rar
windows10-2004-x64
3NightyGo/NightyGo.exe
windows7-x64
1NightyGo/NightyGo.exe
windows10-2004-x64
1NightyGo/config.json
windows7-x64
3NightyGo/config.json
windows10-2004-x64
3NightyGo/d...nd.mp3
windows7-x64
1NightyGo/d...nd.mp3
windows10-2004-x64
6Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
NightyGo.rar
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
NightyGo.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
NightyGo/NightyGo.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
NightyGo/NightyGo.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
NightyGo/config.json
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
NightyGo/config.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
NightyGo/data/nitrosound.mp3
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
NightyGo/data/nitrosound.mp3
Resource
win10v2004-20240508-en
General
-
Target
NightyGo/data/nitrosound.mp3
-
Size
8KB
-
MD5
812c7504df40d796245774dce0e6c85c
-
SHA1
6c1c3bb3ce138b29a2681af9e6b6dbaab80e1e47
-
SHA256
3b8d47c95911247ffcdbb44fe1111852d447cfef21ed9dd52e72577671e531f3
-
SHA512
e8cb13c6e81c9df4052af65357574ddf8f71f6c4400b3eea95f617471375be2f91ac1706da6edf12fcce9d7ea09deda83747fef56b4ed93b6ff95920c3fa5ddc
-
SSDEEP
192:QCsw5oFc5mypvMcYkYP9Y6fFqztAeQSXrPs7ZApBh3:5srFSpvMDr9TwtAeQWPs783
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2972 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2972 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2972 vlc.exe Token: SeIncBasePriorityPrivilege 2972 vlc.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe 2972 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2972 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\NightyGo\data\nitrosound.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2972
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100B
MD585703f7fb923fc555097b7b4a7aa1c4d
SHA1eead7c79861e5eeebec274e48256175e8089b260
SHA2567d5c04b477dffaf08c4a826fd6bc17fe3c72561da8302a3537027a22027796f6
SHA5127fcc497a95981b99707e268c9df3330bc504f7b06e534d9c230f4a6af2bd55fea7d2942dd38e700020bb571d4a6489de51121bc0bd39a320928898f0fec5b3a8
-
Filesize
18B
MD527b9625d4b77d1e5cf3b2d965169121e
SHA14c5f620babc5c8e466815822f4503adf42bc3ea1
SHA2568ad1bda60a772a7368702b6b975df3d8b6fae16b20b965c4ec47d09a8264e033
SHA51225df79f5623d555000158146dfbb4d35f226b9319aa7f5fda257fd6436c8df9f8c276c49d2800da231c1d9f3921d964640a9226082fe03230426e9c1f90b674d