hxxp://files[.]msg[.]cx/Nighty2[.]2[.]zip

Resubmissions

18/08/2024, 00:02

240818-abtejsthne 7

18/08/2024, 00:00

240818-aarvbsthlh 1

17/08/2024, 23:49

240817-3vedystgka 8

17/08/2024, 23:44

240817-3rmwxswhjk 7

Analysis

max time kernel
27s
max time network
30s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
18/08/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://files.msg.cx/Nighty2.2.zip

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Nighty2.2.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 4876 wrote to memory of 5024	4876	firefox.exe	81
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 3600	5024	firefox.exe	82
PID 5024 wrote to memory of 4896	5024	firefox.exe	83
PID 5024 wrote to memory of 4896	5024	firefox.exe	83
PID 5024 wrote to memory of 4896	5024	firefox.exe	83
PID 5024 wrote to memory of 4896	5024	firefox.exe	83
PID 5024 wrote to memory of 4896	5024	firefox.exe	83
PID 5024 wrote to memory of 4896	5024	firefox.exe	83
PID 5024 wrote to memory of 4896	5024	firefox.exe	83
PID 5024 wrote to memory of 4896	5024	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://files.msg.cx/Nighty2.2.zip"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://files.msg.cx/Nighty2.2.zip
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1892 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {41c489a3-ed56-4943-ba81-e21682a0696c} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" gpu
    3⤵
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2308 -prefMapHandle 2304 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49cb27fe-32ea-44da-8080-f435af9197c1} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" socket
    3⤵
    PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2976 -childID 1 -isForBrowser -prefsHandle 3264 -prefMapHandle 3128 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1000 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1b5f9e7-98ca-48cd-82d0-da0cb46c5d91} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" tab
    3⤵
    PID:1400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3552 -childID 2 -isForBrowser -prefsHandle 3692 -prefMapHandle 3572 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1000 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {deb87775-3777-40fb-bd6c-780000a839f0} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" tab
    3⤵
    PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4688 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4680 -prefMapHandle 4676 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df971271-070d-4363-8be3-e1e1c1aa63f8} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" utility
    3⤵
    - Checks processor information in registry
    PID:3060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 3 -isForBrowser -prefsHandle 5464 -prefMapHandle 5460 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1000 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {490ffea7-bb0d-43ae-ba58-6ba632dc7728} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" tab
    3⤵
    PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5440 -childID 4 -isForBrowser -prefsHandle 5604 -prefMapHandle 5608 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1000 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42a00d1d-f8d6-42df-8499-64c610478ea1} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" tab
    3⤵
    PID:1948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5804 -childID 5 -isForBrowser -prefsHandle 5816 -prefMapHandle 5760 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1000 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ed2234a-787d-4062-8249-49e9b204b17b} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" tab
    3⤵
    PID:224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\activity-stream.discovery_stream.json

Filesize
30KB

MD5
2867aafcbb007be043107177f2b6e226

SHA1
cd5860b891ef7822d7d92de16673d3df05b85222

SHA256
fce3e563ff75f032b7a3cb97ba6603baa3e12792dbd8442250a41e8db28e41c7

SHA512
0f06383e85b7212c7dbb102ca34fddf66136b95f0ddd43f2ebc0210271e60af7e52de72efd7ad17be29c6fc375ac2bc0b8afb4ed798b0c99aaa306295f660177

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

Filesize
7KB

MD5
421c0d86a4a22c536ab6f66dbfc062ed

SHA1
7ea2c4b7777367efde411b36fd73f6f12bd9b5b5

SHA256
94dee17e0fbedd788fe2a52ba3cd61d84271c09bc76a3e88581dc6fd4b4a346e

SHA512
37802faa01acb5cf5e1ebd2019cde032a2c639d164fb16ed05eb88e0a9962f8016c72e23566fffae4eed9d767288945f64958268a735186a8616d667f52af123

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
d723f9d587dec9413cad70fcc54c5195

SHA1
df86d266fecdc99c0f5eae0594c765c57de99724

SHA256
bd1cd6b25b1f3d72a9f3bcf51d15ff6043fdd8f2862cebd59fbcf7054b893133

SHA512
a59f7e5df24f26ccf9cd59c69ca42a6a428a99fd6f040832b0a440e9a6717a37440bffbd3c149ac4ad1679fdc66e9cfe6f315a9b168de4924a267d9c91b84ef7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
40b62cfe426338fb3b72faeaf9c83219

SHA1
7d9547255f8aec809f351abdeaf47f55d354438d

SHA256
b15c4e8223541a0852192b2ae10ecc224e7b13b7ea68767aa8810dd07977c9d6

SHA512
654b3874a824c45b4c63106e3be42fe6479c0ae5206d4599bf11bc6b037018514be6a5115eab9070fb26ccbbdf633bdfd672f99a19f4c1df2b6abe00392a5602

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\a14b8900-9d17-4b7c-868d-b8a6b22e4987

Filesize
982B

MD5
210857eda354f90104af053910e5af68

SHA1
6973570d02f4632cb3a3b207af3c4d6648025904

SHA256
fa9a744721db6b02dee054e0ece766feefd2fb04b1ea7edf4e994c46d4584e44

SHA512
ab27e9907884a2f42780d30b83dea7f831ff865e216116b10ca66c5372d6425bbf6451d0882f9045cbadcec01560d926f114921dc57e9f3b4549fcbde13fa72b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\b537cda6-a53f-4d58-a4af-b0a37273c847

Filesize
659B

MD5
f2586db33bd1935cbd42081fb9362ff9

SHA1
ede547972efe219bae07952feef004ab10e7c3e6

SHA256
b1b8912eb7085e665e877022b4699912615233dfdd16335a05974ea947400cc3

SHA512
2575159213448b6348f605aca6768b1ab8d55c885e40ac6142c6e37b124a8006ddfc88749f514735cb33a7677c10267cc919c5393daf059a646df91e96488f8f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs.js

Filesize
11KB

MD5
42879555f6acf9cefc40640a1eadd447

SHA1
85338ad73bfaaced71986e7e56bd231f992742d8

SHA256
c717e224913d3823ebf3826cf24769fa17ac28ac7c215eb71a9be65a76dda206

SHA512
37d65f5536be55a65e2a14e12ee3e795785bf8f3ac2d0030cf1d66016c9197f9da1955baa9cb62d4878368876c541c294b33bf9ae491991a4cd7de72b29d2790

Download Submit