Resubmissions
11-03-2024 15:52
240311-ta6s2aeg21 311-03-2024 15:51
240311-tak7bsag28 311-03-2024 15:43
240311-s5yv8sae92 1011-03-2024 15:38
240311-s3gtyaed71 711-03-2024 15:35
240311-s1j7aaed21 1011-03-2024 15:25
240311-stsj3sab93 10Analysis
-
max time kernel
55s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2024 15:52
Behavioral task
behavioral1
Sample
Nitr0-G3n3rat0r.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
Nitr0-G3n3rat0r.exe
-
Size
23.8MB
-
MD5
f04a56628a19894bd9c0403757656f79
-
SHA1
1c4d8f4c61297d9128c5922b097c9a1619dea695
-
SHA256
5698d21c2b45070e70349fd8c7358afcab0d36fdd5bac0a1f8174a1dd6d311b2
-
SHA512
8f03e5b400d54a7569eaa6fffb408692cd35bdb498ce0b735cd4b49d6abcebed90e61c9246987abafbd30124b417db54f2f8fd93ed1b602b5ffb14944a824685
-
SSDEEP
393216:WuLrpBgQTSBfFZNRwSo6oDfDg4c6AHZgOGF3hi:r5BgQeBfFXR66ob03pZr63
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3432 taskmgr.exe Token: SeSystemProfilePrivilege 3432 taskmgr.exe Token: SeCreateGlobalPrivilege 3432 taskmgr.exe Token: 33 3432 taskmgr.exe Token: SeIncBasePriorityPrivilege 3432 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe 3432 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nitr0-G3n3rat0r.exe"C:\Users\Admin\AppData\Local\Temp\Nitr0-G3n3rat0r.exe"1⤵PID:348
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3432