Analysis
-
max time kernel
95s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 14:55
General
-
Target
NitroTool.pyc
-
Size
6KB
-
MD5
1b3b73e54e1b1ecd5fd9e93ad8509d71
-
SHA1
dcfd954b5565ca9e1dc5dc77e991d0e160a6d1e9
-
SHA256
78df7be06e01d98790df6a7326c6f232f998a0203e585e2a2e6127838ab37eac
-
SHA512
cafb114c61c0387f60da3943004547ebb1e5af52df00d06eb06ab34af7b1a10308773c9c5b83087117ab0182f3098f848cd868c6017f26399f9a0fb32f0db4c9
-
SSDEEP
192:0k1HM8ytEQoQdzQFghyf//E09Hhyf//sPTmve9mhyf//6Zsu:hvQoQdzQFghyf//79Hhyf//sLmve9mhx
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\NitroTool.pyc1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx