Analysis
-
max time kernel
70s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
12-08-2021 11:18
Static task
static1
Behavioral task
behavioral1
Sample
21b111a98beb3fade37bdff4abd0e8ce.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
21b111a98beb3fade37bdff4abd0e8ce.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
21b111a98beb3fade37bdff4abd0e8ce.exe
-
Size
61KB
-
MD5
21b111a98beb3fade37bdff4abd0e8ce
-
SHA1
b74d2e4477efc84bf239a1a780fb59f10ac7f371
-
SHA256
5728cda6365347f792106d8826d9ebdfaf9d8cc40cec5cf0ef21e6584e81d5af
-
SHA512
9933ad28242e7712df2fd667153d32b3576d25ed3d7460c329aa56662e0749d0313e83bcdbb4d9c0e8923edd1d95aac188afbc84c3a6f3b1f552726b4761aea5
Score
10/10
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
21b111a98beb3fade37bdff4abd0e8ce.exedescription ioc Process File created C:\Users\Admin\Pictures\BackupRedo.tif.givemenitro 21b111a98beb3fade37bdff4abd0e8ce.exe File created C:\Users\Admin\Pictures\JoinEnable.tif.givemenitro 21b111a98beb3fade37bdff4abd0e8ce.exe File created C:\Users\Admin\Pictures\SuspendRestore.png.givemenitro 21b111a98beb3fade37bdff4abd0e8ce.exe File created C:\Users\Admin\Pictures\TraceConvertFrom.png.givemenitro 21b111a98beb3fade37bdff4abd0e8ce.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
21b111a98beb3fade37bdff4abd0e8ce.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\21b111a98beb3fade37bdff4abd0e8ce.exe\"" 21b111a98beb3fade37bdff4abd0e8ce.exe -
Drops desktop.ini file(s) 5 IoCs
Processes:
21b111a98beb3fade37bdff4abd0e8ce.exedescription ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini 21b111a98beb3fade37bdff4abd0e8ce.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 21b111a98beb3fade37bdff4abd0e8ce.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 21b111a98beb3fade37bdff4abd0e8ce.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 21b111a98beb3fade37bdff4abd0e8ce.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 21b111a98beb3fade37bdff4abd0e8ce.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.ipify.org 9 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
21b111a98beb3fade37bdff4abd0e8ce.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 21b111a98beb3fade37bdff4abd0e8ce.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
21b111a98beb3fade37bdff4abd0e8ce.exepid Process 3728 21b111a98beb3fade37bdff4abd0e8ce.exe 3728 21b111a98beb3fade37bdff4abd0e8ce.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
21b111a98beb3fade37bdff4abd0e8ce.exeWMIC.exedescription pid Process Token: SeDebugPrivilege 3728 21b111a98beb3fade37bdff4abd0e8ce.exe Token: SeIncreaseQuotaPrivilege 4008 WMIC.exe Token: SeSecurityPrivilege 4008 WMIC.exe Token: SeTakeOwnershipPrivilege 4008 WMIC.exe Token: SeLoadDriverPrivilege 4008 WMIC.exe Token: SeSystemProfilePrivilege 4008 WMIC.exe Token: SeSystemtimePrivilege 4008 WMIC.exe Token: SeProfSingleProcessPrivilege 4008 WMIC.exe Token: SeIncBasePriorityPrivilege 4008 WMIC.exe Token: SeCreatePagefilePrivilege 4008 WMIC.exe Token: SeBackupPrivilege 4008 WMIC.exe Token: SeRestorePrivilege 4008 WMIC.exe Token: SeShutdownPrivilege 4008 WMIC.exe Token: SeDebugPrivilege 4008 WMIC.exe Token: SeSystemEnvironmentPrivilege 4008 WMIC.exe Token: SeRemoteShutdownPrivilege 4008 WMIC.exe Token: SeUndockPrivilege 4008 WMIC.exe Token: SeManageVolumePrivilege 4008 WMIC.exe Token: 33 4008 WMIC.exe Token: 34 4008 WMIC.exe Token: 35 4008 WMIC.exe Token: 36 4008 WMIC.exe Token: SeIncreaseQuotaPrivilege 4008 WMIC.exe Token: SeSecurityPrivilege 4008 WMIC.exe Token: SeTakeOwnershipPrivilege 4008 WMIC.exe Token: SeLoadDriverPrivilege 4008 WMIC.exe Token: SeSystemProfilePrivilege 4008 WMIC.exe Token: SeSystemtimePrivilege 4008 WMIC.exe Token: SeProfSingleProcessPrivilege 4008 WMIC.exe Token: SeIncBasePriorityPrivilege 4008 WMIC.exe Token: SeCreatePagefilePrivilege 4008 WMIC.exe Token: SeBackupPrivilege 4008 WMIC.exe Token: SeRestorePrivilege 4008 WMIC.exe Token: SeShutdownPrivilege 4008 WMIC.exe Token: SeDebugPrivilege 4008 WMIC.exe Token: SeSystemEnvironmentPrivilege 4008 WMIC.exe Token: SeRemoteShutdownPrivilege 4008 WMIC.exe Token: SeUndockPrivilege 4008 WMIC.exe Token: SeManageVolumePrivilege 4008 WMIC.exe Token: 33 4008 WMIC.exe Token: 34 4008 WMIC.exe Token: 35 4008 WMIC.exe Token: 36 4008 WMIC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
21b111a98beb3fade37bdff4abd0e8ce.execmd.exedescription pid Process procid_target PID 3728 wrote to memory of 2824 3728 21b111a98beb3fade37bdff4abd0e8ce.exe 75 PID 3728 wrote to memory of 2824 3728 21b111a98beb3fade37bdff4abd0e8ce.exe 75 PID 3728 wrote to memory of 2824 3728 21b111a98beb3fade37bdff4abd0e8ce.exe 75 PID 2824 wrote to memory of 4008 2824 cmd.exe 77 PID 2824 wrote to memory of 4008 2824 cmd.exe 77 PID 2824 wrote to memory of 4008 2824 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\21b111a98beb3fade37bdff4abd0e8ce.exe"C:\Users\Admin\AppData\Local\Temp\21b111a98beb3fade37bdff4abd0e8ce.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-