Analysis
- max time kernel
80s - max time network
79s - platform
windows10_x64 - resource
win10v20210408 - submitted
12/08/2021, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
043fbd84e0a00c3fbf71b88a3e2739bc.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
043fbd84e0a00c3fbf71b88a3e2739bc.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 043fbd84e0a00c3fbf71b88a3e2739bc.exe
- Size 60KB
- Sample210812-d4rk3httrj
- SHA256 39c7f0761cb71570fc1a3dda81f18f97ac6d58e15b7b24cdadc9cf60dffd18a1
- MD5 043fbd84e0a00c3fbf71b88a3e2739bc
- SHA1 02f42bcab70e675d309a89b34125461cde1a7ea5
- SHA512 26506f5843c573f2b1a8c4923a4b38d83e998a6a34d1ce087e127a9099fb04f7baa5d6d4bc166ccd4094220054f569e54bac9403bd4944d62ca225bd0bc16660
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
- Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\RedoWatch.png.givemenitro 043fbd84e0a00c3fbf71b88a3e2739bc.exe File created C:\Users\Admin\Pictures\SelectRename.crw.givemenitro 043fbd84e0a00c3fbf71b88a3e2739bc.exe File created C:\Users\Admin\Pictures\WaitGet.crw.givemenitro 043fbd84e0a00c3fbf71b88a3e2739bc.exe File created C:\Users\Admin\Pictures\OutReset.raw.givemenitro 043fbd84e0a00c3fbf71b88a3e2739bc.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\043fbd84e0a00c3fbf71b88a3e2739bc.exe\"" 043fbd84e0a00c3fbf71b88a3e2739bc.exe - Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini 043fbd84e0a00c3fbf71b88a3e2739bc.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 043fbd84e0a00c3fbf71b88a3e2739bc.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 043fbd84e0a00c3fbf71b88a3e2739bc.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 043fbd84e0a00c3fbf71b88a3e2739bc.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 043fbd84e0a00c3fbf71b88a3e2739bc.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 api.ipify.org 8 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 043fbd84e0a00c3fbf71b88a3e2739bc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 628 043fbd84e0a00c3fbf71b88a3e2739bc.exe 628 043fbd84e0a00c3fbf71b88a3e2739bc.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 628 043fbd84e0a00c3fbf71b88a3e2739bc.exe Token: SeIncreaseQuotaPrivilege 2752 WMIC.exe Token: SeSecurityPrivilege 2752 WMIC.exe Token: SeTakeOwnershipPrivilege 2752 WMIC.exe Token: SeLoadDriverPrivilege 2752 WMIC.exe Token: SeSystemProfilePrivilege 2752 WMIC.exe Token: SeSystemtimePrivilege 2752 WMIC.exe Token: SeProfSingleProcessPrivilege 2752 WMIC.exe Token: SeIncBasePriorityPrivilege 2752 WMIC.exe Token: SeCreatePagefilePrivilege 2752 WMIC.exe Token: SeBackupPrivilege 2752 WMIC.exe Token: SeRestorePrivilege 2752 WMIC.exe Token: SeShutdownPrivilege 2752 WMIC.exe Token: SeDebugPrivilege 2752 WMIC.exe Token: SeSystemEnvironmentPrivilege 2752 WMIC.exe Token: SeRemoteShutdownPrivilege 2752 WMIC.exe Token: SeUndockPrivilege 2752 WMIC.exe Token: SeManageVolumePrivilege 2752 WMIC.exe Token: 33 2752 WMIC.exe Token: 34 2752 WMIC.exe Token: 35 2752 WMIC.exe Token: 36 2752 WMIC.exe Token: SeIncreaseQuotaPrivilege 2752 WMIC.exe Token: SeSecurityPrivilege 2752 WMIC.exe Token: SeTakeOwnershipPrivilege 2752 WMIC.exe Token: SeLoadDriverPrivilege 2752 WMIC.exe Token: SeSystemProfilePrivilege 2752 WMIC.exe Token: SeSystemtimePrivilege 2752 WMIC.exe Token: SeProfSingleProcessPrivilege 2752 WMIC.exe Token: SeIncBasePriorityPrivilege 2752 WMIC.exe Token: SeCreatePagefilePrivilege 2752 WMIC.exe Token: SeBackupPrivilege 2752 WMIC.exe Token: SeRestorePrivilege 2752 WMIC.exe Token: SeShutdownPrivilege 2752 WMIC.exe Token: SeDebugPrivilege 2752 WMIC.exe Token: SeSystemEnvironmentPrivilege 2752 WMIC.exe Token: SeRemoteShutdownPrivilege 2752 WMIC.exe Token: SeUndockPrivilege 2752 WMIC.exe Token: SeManageVolumePrivilege 2752 WMIC.exe Token: 33 2752 WMIC.exe Token: 34 2752 WMIC.exe Token: 35 2752 WMIC.exe Token: 36 2752 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 628 wrote to memory of 3500 628 043fbd84e0a00c3fbf71b88a3e2739bc.exe 75 PID 628 wrote to memory of 3500 628 043fbd84e0a00c3fbf71b88a3e2739bc.exe 75 PID 628 wrote to memory of 3500 628 043fbd84e0a00c3fbf71b88a3e2739bc.exe 75 PID 3500 wrote to memory of 2752 3500 cmd.exe 77 PID 3500 wrote to memory of 2752 3500 cmd.exe 77 PID 3500 wrote to memory of 2752 3500 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\043fbd84e0a00c3fbf71b88a3e2739bc.exe"C:\Users\Admin\AppData\Local\Temp\043fbd84e0a00c3fbf71b88a3e2739bc.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-