b6c7009dd8b089a584aeb6ba37fb75c11a415d63512347beece251e69da5c63b | Triage

Resubmissions

02-02-2025 02:35

250202-c21mnatkcq 10

02-02-2025 02:32

250202-c1ezka1ngt 10

02-02-2025 02:21

250202-ctafhasqbl 10

Analysis

max time kernel
146s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-02-2025 02:32

Sharing

Report Analysis Logs

General

Target

NebulaExecutor.rar
Size

27KB
MD5

f44ba3369f118e9cc2611886494cc3f8
SHA1

ecfcbd5f3149762e00298980c79137ee3299be3a
SHA256

b6c7009dd8b089a584aeb6ba37fb75c11a415d63512347beece251e69da5c63b
SHA512

b31cd82c9c490e5dc0358459e7d81f12e2ba4ca092d71e27d078d740475fc5857e758b1c3e3996e69ee989bcf21e0acde9c6eeaaba6f30c9f1ea1bcb1eb3cac1
SSDEEP

768:2/Dgm33+7HbJRN4FnxT+nugwNwlG+sbiVTRsn:1Ou7Hbh4Ftou9zfbmRu

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	2408	7zFM.exe
Token: 35	2408	7zFM.exe
Token: 33	2404	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2404	AUDIODG.EXE
Token: 33	2404	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2404	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NebulaExecutor.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2408

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads