183160e943a1e0b38a07dc0d6fd775a32180bdee16cc5b5df90330276e95bd44

Analysis

max time kernel
359s
max time network
367s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nyx.exe.config
Size

1KB
MD5

8507e631bfee97b5d9de90fee17ff6e0
SHA1

73edc1cd059c48f12ae7b89bc5a2da2df2cbb450
SHA256

255c27a6508adc3971b8000cfd7cdc1acad601f7be943694774dbbd291ee0115
SHA512

88c8e6b5b2c42ffcb46421fe8e0231fbbbebe0dcd0467f248b2007c101b2319517b41d3e3938087c8dc71a026b84f8217e5fdbdaa64540d25624bdc220fa6be9

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 2652	264	cmd.exe	32
PID 264 wrote to memory of 2652	264	cmd.exe	32
PID 264 wrote to memory of 2652	264	cmd.exe	32
PID 264 wrote to memory of 2652	264	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nyx.exe.config
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:264
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Nyx.exe.config"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c3eee3566b06dd174b7a2439354003ee

SHA1
45ac399bd2757a1b17965714bac334b4c6c0ce45

SHA256
3ca2fd47c58b0353337357eb68e1a70c112238b64bcd319b3fdd88ef697def7a

SHA512
e27134869010abfb962aa20aa4c5d25dd0f04b28f4049ac1c4c40a69e18ee9172545288e5b82ec130672aa07143151807a629dcf88607575e88943aba8555227

Download Submit