a168edbf63b98d8e0dbdb524308f89ff2fd3b7226e5b9a400763d1fa357f1483 | Triage

Analysis

max time kernel
100s
max time network
143s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
01-11-2024 18:16

Sharing

Report Analysis Logs

General

Target

Nitro Gen V1.0 By JF.rar
Size

896KB
MD5

13a99a4d50680729e184b063de8e9190
SHA1

2557e7feac1fc0e5a33a75e19308f0db76a5dffc
SHA256

a168edbf63b98d8e0dbdb524308f89ff2fd3b7226e5b9a400763d1fa357f1483
SHA512

7ad8d51b756942db12d25cbd425eaaf4560239d52278d56130bdd7b19c3c7d7217f38bfd9a72d0c6be8e1c14e64bad2b9945590ff8b10b085f53133d3bfdc57c
SSDEEP

24576:IDGcSY0uvqSsmJ/w/p7maGUmD2dEcg4cnzMFIEhzw:ICRnvNtlbXdMvWhc

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2268 7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zFM.exe

description	pid	process
Token: SeRestorePrivilege	2268	7zFM.exe
Token: 35	2268	7zFM.exe
Token: SeSecurityPrivilege	2268	7zFM.exe
Token: SeSecurityPrivilege	2268	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

7zFM.exe

pid process

2268 7zFM.exe
2268 7zFM.exe
2268 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Nitro Gen V1.0 By JF.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads