Analysis

  • max time kernel
    84s
  • max time network
    174s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    12-08-2021 11:20

General

  • Target

    89fbfa647b0558f766bee4029fe66187.exe

  • Size

    62KB

  • MD5

    89fbfa647b0558f766bee4029fe66187

  • SHA1

    72260bdc557b500d3c4c13d8f1228c0b49c5ae95

  • SHA256

    155e6b0ba6cc29659970f69c00034f7b591e8f63c4727a12c64f13f7543421e3

  • SHA512

    025485d9577127babd06b130de117f0b9c756b8a90f0fb6a00399411bb5f284e94e81412a45e5f98a4c3927a32139216c34ffdf5c73c2288f2ddc88cb89b4fc4

Malware Config

Signatures

  • Nitro

    A ransomware that demands Discord nitro gift codes to decrypt files.

  • Modifies extensions of user files 15 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89fbfa647b0558f766bee4029fe66187.exe
    "C:\Users\Admin\AppData\Local\Temp\89fbfa647b0558f766bee4029fe66187.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1780

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1136-59-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

    Filesize

    4KB

  • memory/1136-61-0x0000000075B31000-0x0000000075B33000-memory.dmp

    Filesize

    8KB

  • memory/1136-64-0x0000000004350000-0x0000000004351000-memory.dmp

    Filesize

    4KB

  • memory/1136-65-0x0000000004355000-0x0000000004366000-memory.dmp

    Filesize

    68KB

  • memory/1776-62-0x0000000000000000-mapping.dmp

  • memory/1780-63-0x0000000000000000-mapping.dmp