FIN7 (TxF-based loaders)

Attributions are based on open-source threat reports. A family appearing here means at least one syscall record cites it; absence does not imply non-use.

2 syscalls cited

NtCreateTransaction
Creates a new KTM (Kernel Transaction Manager) transaction object used to wrap NTFS operations atomically.
NtRollbackTransaction
Rolls back a KTM transaction, discarding every change made under it.