325420b49220c37a246835f3696672b280de383baf49a7d790c2bbfeae6a3923 | Triage™

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nightlight-v.1.6/modules/modulefix.bat
Size 376B
Sample241110-behynawejd
SHA256 485e1615d563d6d6abdc7b619a2da7f93a721827820cf3eae444f646d7d84a16
MD5 0ff16789940e42898ccaf049525be407
SHA1 d2cac0298cdfb1cc4c64bca6278a1d908115ffc2
SHA512 81dfb7c55e9cb1093b91935d95a6c04486626e21cb292faf497a8f769ba438a5ed41c4ce197caa260b1a4e14ef6cdc1bd70fd25d5dd4a7c75a46dd7ef0cd724a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Runs .reg file with regedit 1 IoCs

pid	Process
4920	regedit.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 4920	1132	cmd.exe	85
PID 1132 wrote to memory of 4920	1132	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Nightlight-v.1.6\modules\modulefix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\regedit.exe
  regedit /s increase_paging_file.reg
  2⤵
  - Runs .reg file with regedit
  PID:4920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

increase_paging_file.reg

Path C:\Users\Admin\AppData\Local\Temp\Nightlight-v.1.6\modules\increase_paging_file.reg
Size 178B
SHA256 5066f545173c09bcc6053945cb9ea798258ac1df7ba6a123a68fa2fac1333567
MD5 7e742956000ad1b4ebcef02ae69bb375
SHA1 a00c0d1ab7e9e667330db34a01c53af505b46fcf
SHA512 e34591b5f4efbf676e9b9a1191d441e4324d5c58902b6f31b3840971c4e36a3f686b15f3b7f9bf35a91e5a7ae718afd337f255b4178a59efb84449566564ec3e
MD5 SHA1 SHA512

Submit Download