92f4be23fd098350031cbe2f661f90c7377d691eec91808636d415b9741b029a | Triage

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2024 06:50

Sharing

Report Analysis Logs

General

Target

Nitrox_1.7.1.0.zip
Size

7.8MB
MD5

f7d25be0395feec244bc865acfa07043
SHA1

b3c74c8b4f3a2ac065ee8953c6ead832b2868e5d
SHA256

92f4be23fd098350031cbe2f661f90c7377d691eec91808636d415b9741b029a
SHA512

8efd8d687847b760c789cbe03313257543cb6b557b800c1c5e509754ae49a9dc18b05a5d62d1338298ec6cddd8166e7428479f7047feb6b221bfa1853db72a29
SSDEEP

196608:Wm/qcR6luQIsgHFFz+iT9iU4l6iHWCgczkWBu+ie3JWq92INOF:d/qc0lrSFp+JmEzkWB7iewq9OF

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	756	7zFM.exe
Token: 35	756	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
756	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Nitrox_1.7.1.0.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads