Overview
overview
8Static
static
3Nitro Gene...FE.dll
windows10-2004-x64
1Nitro Gene...en.exe
windows7-x64
8Nitro Gene...en.exe
windows10-2004-x64
8Nitro Gene...FE.dll
windows10-2004-x64
1Nitro Gene...ip.dll
windows7-x64
1Nitro Gene...ip.dll
windows10-2004-x64
1Nitro Gene...nt.exe
windows7-x64
7Nitro Gene...nt.exe
windows10-2004-x64
7Nitro Gene...er.exe
windows7-x64
8Nitro Gene...er.exe
windows10-2004-x64
8Nitro Gene...ll.dll
windows10-2004-x64
1Nitro Gene...ll.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 12:37
Behavioral task
behavioral1
Sample
Nitro Generator with Checker/BFE.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nitro Generator with Checker/NitroGen.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
Nitro Generator with Checker/NitroGen.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
Nitro Generator with Checker/WebDriver/BFE.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Nitro Generator with Checker/WebDriver/Ionic.Zip.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Nitro Generator with Checker/WebDriver/Ionic.Zip.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Nitro Generator with Checker/WebDriver/Jint.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
Nitro Generator with Checker/WebDriver/Jint.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
Nitro Generator with Checker/WebDriver/Launcher.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
Nitro Generator with Checker/WebDriver/Launcher.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral11
Sample
Nitro Generator with Checker/WebDriver/vertdll.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Nitro Generator with Checker/vertdll.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
Nitro Generator with Checker/NitroGen.exe
-
Size
181KB
-
MD5
4e365e8ccd70afbd3bb87ff051cc04cc
-
SHA1
019d2786471cd7e9d860b2d2f35beae8f70f5e0f
-
SHA256
a5460367bad0aa216b9d13f150ac125eb0c32aff9f70c1d081fb579e36b2ec99
-
SHA512
ac90d76d2f7883c49f8b3a0f322e0c37d93840a5bdf8f8f37d81c9d7572deb1e82be5b3ecd585b6596d77b6ef9f2cc9e5e6797ec008cb6b2ab4f148266490ecb
-
SSDEEP
768:Eec4lj/TePn4d3TNDI+eFdNwPfeivrm/J/aKr9n8RA3LfzIh:s4l3ePiO+eF3wPfeivrEFBfUh
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2820 powershell.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk Launcher.exe -
Executes dropped EXE 25 IoCs
pid Process 1112 Windows Services.exe 924 Secure System Shell.exe 2632 Runtime Explorer.exe 2324 Runtime Explorer.exe 1272 Runtime Explorer.exe 2280 Runtime Explorer.exe 2016 Runtime Explorer.exe 2432 Runtime Explorer.exe 2352 Runtime Explorer.exe 1448 Runtime Explorer.exe 1636 Runtime Explorer.exe 2424 Runtime Explorer.exe 928 Runtime Explorer.exe 2004 Runtime Explorer.exe 1200 Runtime Explorer.exe 2756 Runtime Explorer.exe 2936 Runtime Explorer.exe 2656 Runtime Explorer.exe 2592 Runtime Explorer.exe 2888 Runtime Explorer.exe 3032 Runtime Explorer.exe 2456 Runtime Explorer.exe 3060 Runtime Explorer.exe 1460 Runtime Explorer.exe 2812 Runtime Explorer.exe -
Loads dropped DLL 50 IoCs
pid Process 2600 Jint.exe 2692 Launcher.exe 2692 Launcher.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "C:\\Windows\\IMF\\\\Windows Services.exe" Launcher.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\IMF\Windows Services.exe Launcher.exe File opened for modification C:\Windows\IMF\Secure System Shell.exe Launcher.exe File created C:\Windows\IMF\LICENCE.zip Launcher.exe File opened for modification C:\Windows\IMF\LICENCE.zip Launcher.exe File created C:\Windows\IMF\LICENCE.dat Launcher.exe File created C:\Windows\IMF\Windows Services.exe.tmp Launcher.exe File created C:\Windows\IMF\Runtime Explorer.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Runtime Explorer.exe Launcher.exe File created C:\Windows\IMF\Secure System Shell.exe.tmp Launcher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 28 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NitroGen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows Services.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Secure System Shell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Launcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2692 Launcher.exe 2820 powershell.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 924 Secure System Shell.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe 1112 Windows Services.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2692 Launcher.exe Token: SeDebugPrivilege 2820 powershell.exe Token: SeDebugPrivilege 1112 Windows Services.exe Token: SeDebugPrivilege 924 Secure System Shell.exe -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 2632 Runtime Explorer.exe 2324 Runtime Explorer.exe 1272 Runtime Explorer.exe 2280 Runtime Explorer.exe 2016 Runtime Explorer.exe 2432 Runtime Explorer.exe 2352 Runtime Explorer.exe 1448 Runtime Explorer.exe 1636 Runtime Explorer.exe 2424 Runtime Explorer.exe 928 Runtime Explorer.exe 2004 Runtime Explorer.exe 1200 Runtime Explorer.exe 2756 Runtime Explorer.exe 2936 Runtime Explorer.exe 2656 Runtime Explorer.exe 2592 Runtime Explorer.exe 2888 Runtime Explorer.exe 3032 Runtime Explorer.exe 2456 Runtime Explorer.exe 3060 Runtime Explorer.exe 1460 Runtime Explorer.exe 2812 Runtime Explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2692 2788 NitroGen.exe 30 PID 2788 wrote to memory of 2692 2788 NitroGen.exe 30 PID 2788 wrote to memory of 2692 2788 NitroGen.exe 30 PID 2788 wrote to memory of 2692 2788 NitroGen.exe 30 PID 2788 wrote to memory of 2692 2788 NitroGen.exe 30 PID 2788 wrote to memory of 2692 2788 NitroGen.exe 30 PID 2788 wrote to memory of 2692 2788 NitroGen.exe 30 PID 2692 wrote to memory of 2820 2692 Launcher.exe 31 PID 2692 wrote to memory of 2820 2692 Launcher.exe 31 PID 2692 wrote to memory of 2820 2692 Launcher.exe 31 PID 2692 wrote to memory of 2820 2692 Launcher.exe 31 PID 2692 wrote to memory of 2820 2692 Launcher.exe 31 PID 2692 wrote to memory of 2820 2692 Launcher.exe 31 PID 2692 wrote to memory of 2820 2692 Launcher.exe 31 PID 2788 wrote to memory of 2560 2788 NitroGen.exe 33 PID 2788 wrote to memory of 2560 2788 NitroGen.exe 33 PID 2788 wrote to memory of 2560 2788 NitroGen.exe 33 PID 2788 wrote to memory of 2560 2788 NitroGen.exe 33 PID 2560 wrote to memory of 2600 2560 Jint.exe 35 PID 2560 wrote to memory of 2600 2560 Jint.exe 35 PID 2560 wrote to memory of 2600 2560 Jint.exe 35 PID 2692 wrote to memory of 1112 2692 Launcher.exe 36 PID 2692 wrote to memory of 1112 2692 Launcher.exe 36 PID 2692 wrote to memory of 1112 2692 Launcher.exe 36 PID 2692 wrote to memory of 1112 2692 Launcher.exe 36 PID 2692 wrote to memory of 1112 2692 Launcher.exe 36 PID 2692 wrote to memory of 1112 2692 Launcher.exe 36 PID 2692 wrote to memory of 1112 2692 Launcher.exe 36 PID 1112 wrote to memory of 924 1112 Windows Services.exe 37 PID 1112 wrote to memory of 924 1112 Windows Services.exe 37 PID 1112 wrote to memory of 924 1112 Windows Services.exe 37 PID 1112 wrote to memory of 924 1112 Windows Services.exe 37 PID 1112 wrote to memory of 924 1112 Windows Services.exe 37 PID 1112 wrote to memory of 924 1112 Windows Services.exe 37 PID 1112 wrote to memory of 924 1112 Windows Services.exe 37 PID 1112 wrote to memory of 2632 1112 Windows Services.exe 38 PID 1112 wrote to memory of 2632 1112 Windows Services.exe 38 PID 1112 wrote to memory of 2632 1112 Windows Services.exe 38 PID 1112 wrote to memory of 2632 1112 Windows Services.exe 38 PID 1112 wrote to memory of 2632 1112 Windows Services.exe 38 PID 1112 wrote to memory of 2632 1112 Windows Services.exe 38 PID 1112 wrote to memory of 2632 1112 Windows Services.exe 38 PID 1112 wrote to memory of 2324 1112 Windows Services.exe 39 PID 1112 wrote to memory of 2324 1112 Windows Services.exe 39 PID 1112 wrote to memory of 2324 1112 Windows Services.exe 39 PID 1112 wrote to memory of 2324 1112 Windows Services.exe 39 PID 1112 wrote to memory of 2324 1112 Windows Services.exe 39 PID 1112 wrote to memory of 2324 1112 Windows Services.exe 39 PID 1112 wrote to memory of 2324 1112 Windows Services.exe 39 PID 1112 wrote to memory of 1272 1112 Windows Services.exe 40 PID 1112 wrote to memory of 1272 1112 Windows Services.exe 40 PID 1112 wrote to memory of 1272 1112 Windows Services.exe 40 PID 1112 wrote to memory of 1272 1112 Windows Services.exe 40 PID 1112 wrote to memory of 1272 1112 Windows Services.exe 40 PID 1112 wrote to memory of 1272 1112 Windows Services.exe 40 PID 1112 wrote to memory of 1272 1112 Windows Services.exe 40 PID 1112 wrote to memory of 2280 1112 Windows Services.exe 41 PID 1112 wrote to memory of 2280 1112 Windows Services.exe 41 PID 1112 wrote to memory of 2280 1112 Windows Services.exe 41 PID 1112 wrote to memory of 2280 1112 Windows Services.exe 41 PID 1112 wrote to memory of 2280 1112 Windows Services.exe 41 PID 1112 wrote to memory of 2280 1112 Windows Services.exe 41 PID 1112 wrote to memory of 2280 1112 Windows Services.exe 41 PID 1112 wrote to memory of 2016 1112 Windows Services.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nitro Generator with Checker\NitroGen.exe"C:\Users\Admin\AppData\Local\Temp\Nitro Generator with Checker\NitroGen.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\Nitro Generator with Checker\WebDriver\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Nitro Generator with Checker\WebDriver\Launcher.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Windows\IMF\Windows Services.exe"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\IMF\Secure System Shell.exe"C:\Windows\IMF\Secure System Shell.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2324
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1272
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2280
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2432
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2352
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1448
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1636
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2424
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:928
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2004
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1200
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2756
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2936
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2656
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2592
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2888
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3032
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2456
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3060
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2812
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Nitro Generator with Checker\WebDriver\Jint.exe"C:\Users\Admin\AppData\Local\Temp\Nitro Generator with Checker\WebDriver\Jint.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\Nitro Generator with Checker\WebDriver\Jint.exe"C:\Users\Admin\AppData\Local\Temp\Nitro Generator with Checker\WebDriver\Jint.exe"3⤵
- Loads dropped DLL
PID:2600
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD51d5e4c20a20740f38f061bdf48aaca4f
SHA1de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0
SHA256f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366
SHA5129df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397
-
Filesize
152KB
MD503f5e0141f4519f0c5ac26ce0b036a0f
SHA14f7a2a230e7a194a898cc9f2d563ac8777fe99c0
SHA25678a408c628e33e3332645f480ee7ce01b5dc24fc96cf16ffa0868d43f3d421ef
SHA51286a68f040654006e06b51c5714e0d7168d0d1bef7f3c39843632068104f773f771d21be4bc251d712f3e915cd1058f89ad31d9e3f3d9e7cf6da6785cbf22d8d7
-
Filesize
45KB
MD57d0c7359e5b2daa5665d01afdc98cc00
SHA1c3cc830c8ffd0f53f28d89dcd9f3426be87085cb
SHA256f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809
SHA512a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407
-
Filesize
46KB
MD5ad0ce1302147fbdfecaec58480eb9cf9
SHA1874efbc76e5f91bc1425a43ea19400340f98d42b
SHA2562c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3
SHA512adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53