Analysis
-
max time kernel
73s -
max time network
138s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
12-08-2021 11:19
Static task
static1
Behavioral task
behavioral1
Sample
28c6930ca323e61d91b92e4bb843d0bb.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
28c6930ca323e61d91b92e4bb843d0bb.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
28c6930ca323e61d91b92e4bb843d0bb.exe
-
Size
61KB
-
MD5
28c6930ca323e61d91b92e4bb843d0bb
-
SHA1
a2699d09bc912dff2cce4f1ebb1ad5e5dc470cf9
-
SHA256
33ee355f77eef2768f6f5e210f008eb78e396f4adc97f090124ced1100507679
-
SHA512
c0c44664f5f6e717f9878776f443fd56cffe87db6bc96ad80a74483aa2bf04ebbe7506d5387e661c185260d04372ccf28f96770e8348199514060b9e452d456a
Score
10/10
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SubmitDismount.tiff 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\EditCompress.raw.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\LimitRepair.tif.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\ResetUnpublish.crw.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\SelectMount.png.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\StepCompress.tif.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\SubmitDismount.tiff.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\28c6930ca323e61d91b92e4bb843d0bb.exe\"" 28c6930ca323e61d91b92e4bb843d0bb.exe -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini 28c6930ca323e61d91b92e4bb843d0bb.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 28c6930ca323e61d91b92e4bb843d0bb.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 28c6930ca323e61d91b92e4bb843d0bb.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 28c6930ca323e61d91b92e4bb843d0bb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\Wallpaper.jpg" 28c6930ca323e61d91b92e4bb843d0bb.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1060 28c6930ca323e61d91b92e4bb843d0bb.exe 1060 28c6930ca323e61d91b92e4bb843d0bb.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1060 28c6930ca323e61d91b92e4bb843d0bb.exe Token: SeIncreaseQuotaPrivilege 652 WMIC.exe Token: SeSecurityPrivilege 652 WMIC.exe Token: SeTakeOwnershipPrivilege 652 WMIC.exe Token: SeLoadDriverPrivilege 652 WMIC.exe Token: SeSystemProfilePrivilege 652 WMIC.exe Token: SeSystemtimePrivilege 652 WMIC.exe Token: SeProfSingleProcessPrivilege 652 WMIC.exe Token: SeIncBasePriorityPrivilege 652 WMIC.exe Token: SeCreatePagefilePrivilege 652 WMIC.exe Token: SeBackupPrivilege 652 WMIC.exe Token: SeRestorePrivilege 652 WMIC.exe Token: SeShutdownPrivilege 652 WMIC.exe Token: SeDebugPrivilege 652 WMIC.exe Token: SeSystemEnvironmentPrivilege 652 WMIC.exe Token: SeRemoteShutdownPrivilege 652 WMIC.exe Token: SeUndockPrivilege 652 WMIC.exe Token: SeManageVolumePrivilege 652 WMIC.exe Token: 33 652 WMIC.exe Token: 34 652 WMIC.exe Token: 35 652 WMIC.exe Token: SeIncreaseQuotaPrivilege 652 WMIC.exe Token: SeSecurityPrivilege 652 WMIC.exe Token: SeTakeOwnershipPrivilege 652 WMIC.exe Token: SeLoadDriverPrivilege 652 WMIC.exe Token: SeSystemProfilePrivilege 652 WMIC.exe Token: SeSystemtimePrivilege 652 WMIC.exe Token: SeProfSingleProcessPrivilege 652 WMIC.exe Token: SeIncBasePriorityPrivilege 652 WMIC.exe Token: SeCreatePagefilePrivilege 652 WMIC.exe Token: SeBackupPrivilege 652 WMIC.exe Token: SeRestorePrivilege 652 WMIC.exe Token: SeShutdownPrivilege 652 WMIC.exe Token: SeDebugPrivilege 652 WMIC.exe Token: SeSystemEnvironmentPrivilege 652 WMIC.exe Token: SeRemoteShutdownPrivilege 652 WMIC.exe Token: SeUndockPrivilege 652 WMIC.exe Token: SeManageVolumePrivilege 652 WMIC.exe Token: 33 652 WMIC.exe Token: 34 652 WMIC.exe Token: 35 652 WMIC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1984 1060 28c6930ca323e61d91b92e4bb843d0bb.exe 26 PID 1060 wrote to memory of 1984 1060 28c6930ca323e61d91b92e4bb843d0bb.exe 26 PID 1060 wrote to memory of 1984 1060 28c6930ca323e61d91b92e4bb843d0bb.exe 26 PID 1060 wrote to memory of 1984 1060 28c6930ca323e61d91b92e4bb843d0bb.exe 26 PID 1984 wrote to memory of 652 1984 cmd.exe 28 PID 1984 wrote to memory of 652 1984 cmd.exe 28 PID 1984 wrote to memory of 652 1984 cmd.exe 28 PID 1984 wrote to memory of 652 1984 cmd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\28c6930ca323e61d91b92e4bb843d0bb.exe"C:\Users\Admin\AppData\Local\Temp\28c6930ca323e61d91b92e4bb843d0bb.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:652
-
-