Analysis
-
max time kernel
101s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
12-08-2021 11:20
Static task
static1
Behavioral task
behavioral1
Sample
55d3a93ab948a1bad005a276fd64ca77.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
55d3a93ab948a1bad005a276fd64ca77.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
55d3a93ab948a1bad005a276fd64ca77.exe
-
Size
60KB
-
MD5
55d3a93ab948a1bad005a276fd64ca77
-
SHA1
03e59428389de848cd34da7482363faacd9a771d
-
SHA256
3c57851605d84398dfb0df0050ed4542a6a64a9c6008525dcaea4f35d0b5dd90
-
SHA512
59839df9722eff95d34ca44ad8c759763b8f2c255e040ef7c5cb79e6cb8e28ad5ff9a939e951ed403f5a17ba42933a96c65892388bbe3c968476afbb64521d50
Score
10/10
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Modifies extensions of user files 16 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\EnterComplete.tiff 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\GetSubmit.crw.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\RegisterSplit.png.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File opened for modification C:\Users\Admin\Pictures\WatchUninstall.tiff 55d3a93ab948a1bad005a276fd64ca77.exe File opened for modification C:\Users\Admin\Pictures\DisableEnable.tiff 55d3a93ab948a1bad005a276fd64ca77.exe File opened for modification C:\Users\Admin\Pictures\OpenProtect.tiff 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\WatchUninstall.tiff.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\UseDebug.crw.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\AssertStop.raw.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\InstallCompress.png.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\OpenResume.png.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\EnterComplete.tiff.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\OpenProtect.tiff.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\DisableEnable.tiff.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File created C:\Users\Admin\Pictures\EditSet.tiff.givemenitro 55d3a93ab948a1bad005a276fd64ca77.exe File opened for modification C:\Users\Admin\Pictures\EditSet.tiff 55d3a93ab948a1bad005a276fd64ca77.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\55d3a93ab948a1bad005a276fd64ca77.exe\"" 55d3a93ab948a1bad005a276fd64ca77.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini 55d3a93ab948a1bad005a276fd64ca77.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 55d3a93ab948a1bad005a276fd64ca77.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 55d3a93ab948a1bad005a276fd64ca77.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 55d3a93ab948a1bad005a276fd64ca77.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 55d3a93ab948a1bad005a276fd64ca77.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 api.ipify.org 12 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 55d3a93ab948a1bad005a276fd64ca77.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 528 55d3a93ab948a1bad005a276fd64ca77.exe 528 55d3a93ab948a1bad005a276fd64ca77.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 528 55d3a93ab948a1bad005a276fd64ca77.exe Token: SeIncreaseQuotaPrivilege 2912 WMIC.exe Token: SeSecurityPrivilege 2912 WMIC.exe Token: SeTakeOwnershipPrivilege 2912 WMIC.exe Token: SeLoadDriverPrivilege 2912 WMIC.exe Token: SeSystemProfilePrivilege 2912 WMIC.exe Token: SeSystemtimePrivilege 2912 WMIC.exe Token: SeProfSingleProcessPrivilege 2912 WMIC.exe Token: SeIncBasePriorityPrivilege 2912 WMIC.exe Token: SeCreatePagefilePrivilege 2912 WMIC.exe Token: SeBackupPrivilege 2912 WMIC.exe Token: SeRestorePrivilege 2912 WMIC.exe Token: SeShutdownPrivilege 2912 WMIC.exe Token: SeDebugPrivilege 2912 WMIC.exe Token: SeSystemEnvironmentPrivilege 2912 WMIC.exe Token: SeRemoteShutdownPrivilege 2912 WMIC.exe Token: SeUndockPrivilege 2912 WMIC.exe Token: SeManageVolumePrivilege 2912 WMIC.exe Token: 33 2912 WMIC.exe Token: 34 2912 WMIC.exe Token: 35 2912 WMIC.exe Token: 36 2912 WMIC.exe Token: SeIncreaseQuotaPrivilege 2912 WMIC.exe Token: SeSecurityPrivilege 2912 WMIC.exe Token: SeTakeOwnershipPrivilege 2912 WMIC.exe Token: SeLoadDriverPrivilege 2912 WMIC.exe Token: SeSystemProfilePrivilege 2912 WMIC.exe Token: SeSystemtimePrivilege 2912 WMIC.exe Token: SeProfSingleProcessPrivilege 2912 WMIC.exe Token: SeIncBasePriorityPrivilege 2912 WMIC.exe Token: SeCreatePagefilePrivilege 2912 WMIC.exe Token: SeBackupPrivilege 2912 WMIC.exe Token: SeRestorePrivilege 2912 WMIC.exe Token: SeShutdownPrivilege 2912 WMIC.exe Token: SeDebugPrivilege 2912 WMIC.exe Token: SeSystemEnvironmentPrivilege 2912 WMIC.exe Token: SeRemoteShutdownPrivilege 2912 WMIC.exe Token: SeUndockPrivilege 2912 WMIC.exe Token: SeManageVolumePrivilege 2912 WMIC.exe Token: 33 2912 WMIC.exe Token: 34 2912 WMIC.exe Token: 35 2912 WMIC.exe Token: 36 2912 WMIC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 528 wrote to memory of 3512 528 55d3a93ab948a1bad005a276fd64ca77.exe 75 PID 528 wrote to memory of 3512 528 55d3a93ab948a1bad005a276fd64ca77.exe 75 PID 528 wrote to memory of 3512 528 55d3a93ab948a1bad005a276fd64ca77.exe 75 PID 3512 wrote to memory of 2912 3512 cmd.exe 77 PID 3512 wrote to memory of 2912 3512 cmd.exe 77 PID 3512 wrote to memory of 2912 3512 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d3a93ab948a1bad005a276fd64ca77.exe"C:\Users\Admin\AppData\Local\Temp\55d3a93ab948a1bad005a276fd64ca77.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-