Analysis
-
max time kernel
84s -
max time network
174s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
12-08-2021 11:20
Static task
static1
Behavioral task
behavioral1
Sample
89fbfa647b0558f766bee4029fe66187.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
89fbfa647b0558f766bee4029fe66187.exe
Resource
win10v20210408
General
-
Target
89fbfa647b0558f766bee4029fe66187.exe
-
Size
62KB
-
MD5
89fbfa647b0558f766bee4029fe66187
-
SHA1
72260bdc557b500d3c4c13d8f1228c0b49c5ae95
-
SHA256
155e6b0ba6cc29659970f69c00034f7b591e8f63c4727a12c64f13f7543421e3
-
SHA512
025485d9577127babd06b130de117f0b9c756b8a90f0fb6a00399411bb5f284e94e81412a45e5f98a4c3927a32139216c34ffdf5c73c2288f2ddc88cb89b4fc4
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
89fbfa647b0558f766bee4029fe66187.exedescription ioc process File created C:\Users\Admin\Pictures\SubmitSuspend.tiff.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File opened for modification C:\Users\Admin\Pictures\BackupEdit.tiff 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\CloseUnblock.raw.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\DisableSuspend.tif.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\EnterRevoke.crw.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\CompleteRemove.tif.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\ExpandSuspend.crw.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\CheckpointRestart.crw.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\InstallStop.crw.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\StartUse.tif.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File opened for modification C:\Users\Admin\Pictures\SubmitSuspend.tiff 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\AssertPush.png.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\BackupEdit.tiff.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\FindDebug.crw.givemenitro 89fbfa647b0558f766bee4029fe66187.exe File created C:\Users\Admin\Pictures\UseFind.raw.givemenitro 89fbfa647b0558f766bee4029fe66187.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
89fbfa647b0558f766bee4029fe66187.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\89fbfa647b0558f766bee4029fe66187.exe\"" 89fbfa647b0558f766bee4029fe66187.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
89fbfa647b0558f766bee4029fe66187.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini 89fbfa647b0558f766bee4029fe66187.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 89fbfa647b0558f766bee4029fe66187.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 89fbfa647b0558f766bee4029fe66187.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
89fbfa647b0558f766bee4029fe66187.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 89fbfa647b0558f766bee4029fe66187.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\Wallpaper.jpg" 89fbfa647b0558f766bee4029fe66187.exe -
Processes:
89fbfa647b0558f766bee4029fe66187.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 89fbfa647b0558f766bee4029fe66187.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 89fbfa647b0558f766bee4029fe66187.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 89fbfa647b0558f766bee4029fe66187.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
89fbfa647b0558f766bee4029fe66187.exepid process 1136 89fbfa647b0558f766bee4029fe66187.exe 1136 89fbfa647b0558f766bee4029fe66187.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
89fbfa647b0558f766bee4029fe66187.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1136 89fbfa647b0558f766bee4029fe66187.exe Token: SeIncreaseQuotaPrivilege 1780 WMIC.exe Token: SeSecurityPrivilege 1780 WMIC.exe Token: SeTakeOwnershipPrivilege 1780 WMIC.exe Token: SeLoadDriverPrivilege 1780 WMIC.exe Token: SeSystemProfilePrivilege 1780 WMIC.exe Token: SeSystemtimePrivilege 1780 WMIC.exe Token: SeProfSingleProcessPrivilege 1780 WMIC.exe Token: SeIncBasePriorityPrivilege 1780 WMIC.exe Token: SeCreatePagefilePrivilege 1780 WMIC.exe Token: SeBackupPrivilege 1780 WMIC.exe Token: SeRestorePrivilege 1780 WMIC.exe Token: SeShutdownPrivilege 1780 WMIC.exe Token: SeDebugPrivilege 1780 WMIC.exe Token: SeSystemEnvironmentPrivilege 1780 WMIC.exe Token: SeRemoteShutdownPrivilege 1780 WMIC.exe Token: SeUndockPrivilege 1780 WMIC.exe Token: SeManageVolumePrivilege 1780 WMIC.exe Token: 33 1780 WMIC.exe Token: 34 1780 WMIC.exe Token: 35 1780 WMIC.exe Token: SeIncreaseQuotaPrivilege 1780 WMIC.exe Token: SeSecurityPrivilege 1780 WMIC.exe Token: SeTakeOwnershipPrivilege 1780 WMIC.exe Token: SeLoadDriverPrivilege 1780 WMIC.exe Token: SeSystemProfilePrivilege 1780 WMIC.exe Token: SeSystemtimePrivilege 1780 WMIC.exe Token: SeProfSingleProcessPrivilege 1780 WMIC.exe Token: SeIncBasePriorityPrivilege 1780 WMIC.exe Token: SeCreatePagefilePrivilege 1780 WMIC.exe Token: SeBackupPrivilege 1780 WMIC.exe Token: SeRestorePrivilege 1780 WMIC.exe Token: SeShutdownPrivilege 1780 WMIC.exe Token: SeDebugPrivilege 1780 WMIC.exe Token: SeSystemEnvironmentPrivilege 1780 WMIC.exe Token: SeRemoteShutdownPrivilege 1780 WMIC.exe Token: SeUndockPrivilege 1780 WMIC.exe Token: SeManageVolumePrivilege 1780 WMIC.exe Token: 33 1780 WMIC.exe Token: 34 1780 WMIC.exe Token: 35 1780 WMIC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
89fbfa647b0558f766bee4029fe66187.execmd.exedescription pid process target process PID 1136 wrote to memory of 1776 1136 89fbfa647b0558f766bee4029fe66187.exe cmd.exe PID 1136 wrote to memory of 1776 1136 89fbfa647b0558f766bee4029fe66187.exe cmd.exe PID 1136 wrote to memory of 1776 1136 89fbfa647b0558f766bee4029fe66187.exe cmd.exe PID 1136 wrote to memory of 1776 1136 89fbfa647b0558f766bee4029fe66187.exe cmd.exe PID 1776 wrote to memory of 1780 1776 cmd.exe WMIC.exe PID 1776 wrote to memory of 1780 1776 cmd.exe WMIC.exe PID 1776 wrote to memory of 1780 1776 cmd.exe WMIC.exe PID 1776 wrote to memory of 1780 1776 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\89fbfa647b0558f766bee4029fe66187.exe"C:\Users\Admin\AppData\Local\Temp\89fbfa647b0558f766bee4029fe66187.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
-