quasar | hxxps://github[.]com/Nvcommander2/Nitro-Generator/blob/main/Nitro%20Generator[.]exe

Analysis

max time kernel
44s
max time network
47s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07/01/2025, 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Nvcommander2/Nitro-Generator/blob/main/Nitro%20Generator.exe

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

185.228.82.21:4782

Mutex

c29ebb5d-3238-45d0-be99-1e518c50fa01

Attributes

encryption_key
570A0FECB7A94886A39E42A9D21C10D5D3C9EE96
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Nova
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x002a0000000451ef-248.dat	family_quasar
behavioral1/memory/3284-316-0x00000000005A0000-0x00000000008C4000-memory.dmp	family_quasar

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
3284	Nitro Generator.exe
5180	Client.exe
5480	Nitro Generator.exe
5660	Nitro Generator.exe
5728	Nitro Generator.exe
5872	Nitro Generator.exe
5928	Nitro Generator.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
41	raw.githubusercontent.com
42	raw.githubusercontent.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	Nitro Generator.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Nitro Generator.exe
File opened for modification	C:\Windows\system32\SubDir	Nitro Generator.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\398f99d5-b9dc-4f6a-b400-eae9acb60b26.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250107073903.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4808	schtasks.exe
5272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1576	msedge.exe
1576	msedge.exe
3752	identity_helper.exe
3752	identity_helper.exe
4764	msedge.exe
4764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3284	Nitro Generator.exe
Token: SeDebugPrivilege	5180	Client.exe
Token: SeDebugPrivilege	5480	Nitro Generator.exe
Token: SeDebugPrivilege	5660	Nitro Generator.exe
Token: SeDebugPrivilege	5728	Nitro Generator.exe
Token: SeDebugPrivilege	5872	Nitro Generator.exe
Token: SeDebugPrivilege	5928	Nitro Generator.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
5180	Client.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
5180	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5180	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1584	1576	msedge.exe	80
PID 1576 wrote to memory of 1584	1576	msedge.exe	80
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 2792	1576	msedge.exe	81
PID 1576 wrote to memory of 1952	1576	msedge.exe	82
PID 1576 wrote to memory of 1952	1576	msedge.exe	82
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83
PID 1576 wrote to memory of 1840	1576	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Nvcommander2/Nitro-Generator/blob/main/Nitro%20Generator.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffa11c046f8,0x7ffa11c04708,0x7ffa11c04718
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff799605460,0x7ff799605470,0x7ff799605480
    3⤵
    PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,17711582362585903514,10144015789156332185,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:3064
- C:\Users\Admin\Downloads\Nitro Generator.exe
  "C:\Users\Admin\Downloads\Nitro Generator.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3284
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Nova" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4808
- - C:\Windows\system32\SubDir\Client.exe
    "C:\Windows\system32\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5180
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Nova" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5348

C:\Users\Admin\Downloads\Nitro Generator.exe
"C:\Users\Admin\Downloads\Nitro Generator.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Users\Admin\Downloads\Nitro Generator.exe
"C:\Users\Admin\Downloads\Nitro Generator.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5660

C:\Users\Admin\Downloads\Nitro Generator.exe
"C:\Users\Admin\Downloads\Nitro Generator.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Users\Admin\Downloads\Nitro Generator.exe
"C:\Users\Admin\Downloads\Nitro Generator.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Users\Admin\Downloads\Nitro Generator.exe
"C:\Users\Admin\Downloads\Nitro Generator.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Nitro Generator.exe.log

Filesize
1KB

MD5
b08c36ce99a5ed11891ef6fc6d8647e9

SHA1
db95af417857221948eb1882e60f98ab2914bf1d

SHA256
cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674

SHA512
07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9fc751d5fa08ca574eba851a781b900

SHA1
963c71087bd9360fa4aa1f12e84128cd26597af4

SHA256
360b095e7721603c82e03afa392eb3c3df58e91a831195fc9683e528c2363bbb

SHA512
ecb8d509380f5e7fe96f14966a4d83305cd9a2292bf42dec349269f51176a293bda3273dfe5fba5a32a6209f411e28a7c2ab0d36454b75e155fc053974980757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d9a93ee5221bd6f61ae818935430ccac

SHA1
f35db7fca9a0204cefc2aef07558802de13f9424

SHA256
a756ec37aec7cd908ea1338159800fd302481acfddad3b1701c399a765b7c968

SHA512
b47250fdd1dd86ad16843c3df5bed88146c29279143e20f51af51f5a8d9481ae655db675ca31801e98ab1b82b01cb87ae3c83b6e68af3f7835d3cfa83100ad44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e4e149e25206bb2205406fdfa5aec163

SHA1
2c58eae958c94236a56073200478144545ba55b7

SHA256
cdb9e86fd3c72c5abc9fe71ff66f308f292b73e68a2966f3e5aaf2ffb42174ab

SHA512
72c91743d903b03d7bc5acefdce8f74f6f2208629efe8844c6c5ccd60d0241552977953fc9c6bb47868b1dc6202347a538aae59a8606817b6996ec73bad11a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
67d3792372b2dd924e85b9c531e03914

SHA1
8e261a7f32f2aca9f01638b529eb9c8b890cbc89

SHA256
a92ff8a4964bb111197baa15095f1c451b75557ac8fd97ee885eb46bf652630d

SHA512
55dbfe95afc9da7e9d64586592a7dcdde2f83fee2b87f30304706d7d407c5bafb87d9fffa42ec7446b4c2b21b1482321eed3725bdc124f5598c314f27bbaccef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1e360be292b9f112cb54f0c91effdce1

SHA1
d0cbe1d54ccb9cef2dfe40c500cd7ec81fe5c686

SHA256
052695c7bd555422708fd29b2db9e8944218d8c4babadd98f8906865e6ae78b4

SHA512
3c72a3e879fe122364a57966c7228f874543218950c6949ce7b153519f73361b1964d3e08ccf7edfb9307d6ca55c36456b29e3a5f568acc4165252cc7e598911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9baec75200d6a5af54f04c7a2bdb5f9a

SHA1
6097e7e4d2215fb396381bd5d2d517a2943ac239

SHA256
356dc4e8f0da4f93a8803adb3048a141ed339f03cf28f14d5fef270e3b134110

SHA512
7ac6f8055507acf8d63e819c87399b5be9696be93f96e42738b8dc44ca50448db6795dfb8899a1a169c4e8939a5ece4caf61f3d2b85ed18f4ac2a2e43add302d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
67fc4a9e86bb538e25da3b086e529263

SHA1
ea5c0fb8480c2d23d3afa8f054246390f1b2eeac

SHA256
01baa14b1246ef912b81d6674defd75312cfcfaea759d4f2c2e8a6b3155a86ab

SHA512
6d4be112bebd1b6c7c7079b912aeb13421f6ad158bffa2bd17b3f0ac1a89648dc6788a2f4c0875c7392af77a6033a6cb54e2155f895680777e8150e95c359035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f9055ea0f42cb1609ff65d5be99750dc

SHA1
6f3a884d348e9f58271ddb0cdf4ee0e29becadd4

SHA256
1cacba6574ba8cc5278c387d6465ff72ef63df4c29cfbec5c76fbaf285d92348

SHA512
b1937bc9598d584a02c5c7ac42b96ed6121f16fe2de2623b74bb9b2ca3559fc7aff11464f83a9e9e3002a1c74d4bb0ee8136b0746a5773f8f12f857a7b2b3cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d3412a01d4c3df1df43f94ecd14a889a

SHA1
2900a987c87791c4b64d80e9ce8c8bd26b679c2f

SHA256
dd1511db0f7bf3dc835c2588c1fdd1976b6977ad7babe06380c21c63540919be

SHA512
7d216a9db336322310d7a6191ebac7d80fd4fa084413d0474f42b6eff3feb1baf3e1fb24172ea8abcb67d577f4e3aea2bc68fdb112205fc7592a311a18952f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
36d0ecef7d63de8c7d035dc73e98be7f

SHA1
e1b0419ac90ac905faf86d99233753d509d6aa5d

SHA256
360a3d952e34ffaabe760595cb635976ac9d3d31a1bc502675b38be90ddd3ade

SHA512
10e3c348431669e960c2a026ef5384ff3f75bca090b596dcc7e09be4244f3a8c9f34f87755f118294465e40a653e4c177e9cc867b34ce6e267cd128d98881499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6e7b7132ca3542d5fe5b81128be0d852

SHA1
e11c7713dfbdc98fbda4efe90874f4099cbc28cc

SHA256
c3e0eb4e1097c8a0a116971170a4ce75021ed5386066bace760ea520ecd06893

SHA512
84de38789baf055e3ef5998d84c08204ddc8f317bb33f03c4ab5535a628c555392253781863c7b17bf446fde67765dd8414c6b5650f237936bd4b9c9483ae5c2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e7d81523fd53b067c0ff3ca6d1561ff6

SHA1
d86f69614a1f0e91eb9fafb3c0c97dc95db557ed

SHA256
c1d82c465767ef7a908c8c4fd722bf88c51105871b9f068a9101eeaf9b8a7634

SHA512
a6614dfe6cd7751b58f17f97b2e9a6dc75d424343374ccb4b9d92e1ac5109b6e57b720b5bc6f2540809817821bf6bfa40cefe2f67377b2c39a03dfa140a85c9e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
89fa0efec23f97f4476ddb8d18e9e455

SHA1
a21657e1ea9d95a7962e4259f6d58dd9c2db7176

SHA256
09c25879d571dcc53bf34fdc0da5f9cf2692f1a08875498f9faa129cac4d3c11

SHA512
e79a167b4e9851ffba9fbb70fe2e3a15b377e836f5a44eec844f886d2d5ab9a9540245c54eb8fd26d9397567c265be3b0c69982e07b89b7f5664a8e649ec957e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 699907.crdownload

Filesize
3.1MB

MD5
84c14dc966c77300c086a8e6c59936ad

SHA1
19d0992af0609a9d0848c697477db8133e6d7644

SHA256
e257d6335e170bb70344b66f3b90794275c242ab602be96205f53116ef3c4074

SHA512
8c7bff0cd39f06972cd49b6994178e276de30ab005726689cfa9769afadf36d10e0cd9dcfc5c0899ff1fc6a4933c96da07e599ae6d8fc272f3806eeeb605b44a

Download Submit
memory/3284-316-0x00000000005A0000-0x00000000008C4000-memory.dmp

Filesize
3.1MB

Download
memory/5180-319-0x000000001D490000-0x000000001D4E0000-memory.dmp

Filesize
320KB

Download
memory/5180-320-0x000000001D5A0000-0x000000001D652000-memory.dmp

Filesize
712KB

Download