Analysis
- max time kernel
72s - max time network
124s - platform
windows10_x64 - resource
win10v20210408 - submitted
12/08/2021, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
28c6930ca323e61d91b92e4bb843d0bb.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
28c6930ca323e61d91b92e4bb843d0bb.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 28c6930ca323e61d91b92e4bb843d0bb.exe
- Size 61KB
- Sample210812-t3tltlyca2
- SHA256 33ee355f77eef2768f6f5e210f008eb78e396f4adc97f090124ced1100507679
- MD5 28c6930ca323e61d91b92e4bb843d0bb
- SHA1 a2699d09bc912dff2cce4f1ebb1ad5e5dc470cf9
- SHA512 c0c44664f5f6e717f9878776f443fd56cffe87db6bc96ad80a74483aa2bf04ebbe7506d5387e661c185260d04372ccf28f96770e8348199514060b9e452d456a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
- Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\CloseResume.tif.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\PingInvoke.png.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\ResumeConvertFrom.tiff.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File opened for modification C:\Users\Admin\Pictures\ReceiveUnpublish.tiff 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\ResetExport.raw.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\ResetRepair.png.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\RestartUse.raw.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\ApproveOptimize.tif.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\CompareRename.tif.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\ReadResize.crw.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File created C:\Users\Admin\Pictures\ReceiveUnpublish.tiff.givemenitro 28c6930ca323e61d91b92e4bb843d0bb.exe File opened for modification C:\Users\Admin\Pictures\ResumeConvertFrom.tiff 28c6930ca323e61d91b92e4bb843d0bb.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\28c6930ca323e61d91b92e4bb843d0bb.exe\"" 28c6930ca323e61d91b92e4bb843d0bb.exe - Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 28c6930ca323e61d91b92e4bb843d0bb.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 28c6930ca323e61d91b92e4bb843d0bb.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 28c6930ca323e61d91b92e4bb843d0bb.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 28c6930ca323e61d91b92e4bb843d0bb.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 28c6930ca323e61d91b92e4bb843d0bb.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 api.ipify.org 10 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 28c6930ca323e61d91b92e4bb843d0bb.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 656 28c6930ca323e61d91b92e4bb843d0bb.exe 656 28c6930ca323e61d91b92e4bb843d0bb.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 656 28c6930ca323e61d91b92e4bb843d0bb.exe Token: SeIncreaseQuotaPrivilege 2872 WMIC.exe Token: SeSecurityPrivilege 2872 WMIC.exe Token: SeTakeOwnershipPrivilege 2872 WMIC.exe Token: SeLoadDriverPrivilege 2872 WMIC.exe Token: SeSystemProfilePrivilege 2872 WMIC.exe Token: SeSystemtimePrivilege 2872 WMIC.exe Token: SeProfSingleProcessPrivilege 2872 WMIC.exe Token: SeIncBasePriorityPrivilege 2872 WMIC.exe Token: SeCreatePagefilePrivilege 2872 WMIC.exe Token: SeBackupPrivilege 2872 WMIC.exe Token: SeRestorePrivilege 2872 WMIC.exe Token: SeShutdownPrivilege 2872 WMIC.exe Token: SeDebugPrivilege 2872 WMIC.exe Token: SeSystemEnvironmentPrivilege 2872 WMIC.exe Token: SeRemoteShutdownPrivilege 2872 WMIC.exe Token: SeUndockPrivilege 2872 WMIC.exe Token: SeManageVolumePrivilege 2872 WMIC.exe Token: 33 2872 WMIC.exe Token: 34 2872 WMIC.exe Token: 35 2872 WMIC.exe Token: 36 2872 WMIC.exe Token: SeIncreaseQuotaPrivilege 2872 WMIC.exe Token: SeSecurityPrivilege 2872 WMIC.exe Token: SeTakeOwnershipPrivilege 2872 WMIC.exe Token: SeLoadDriverPrivilege 2872 WMIC.exe Token: SeSystemProfilePrivilege 2872 WMIC.exe Token: SeSystemtimePrivilege 2872 WMIC.exe Token: SeProfSingleProcessPrivilege 2872 WMIC.exe Token: SeIncBasePriorityPrivilege 2872 WMIC.exe Token: SeCreatePagefilePrivilege 2872 WMIC.exe Token: SeBackupPrivilege 2872 WMIC.exe Token: SeRestorePrivilege 2872 WMIC.exe Token: SeShutdownPrivilege 2872 WMIC.exe Token: SeDebugPrivilege 2872 WMIC.exe Token: SeSystemEnvironmentPrivilege 2872 WMIC.exe Token: SeRemoteShutdownPrivilege 2872 WMIC.exe Token: SeUndockPrivilege 2872 WMIC.exe Token: SeManageVolumePrivilege 2872 WMIC.exe Token: 33 2872 WMIC.exe Token: 34 2872 WMIC.exe Token: 35 2872 WMIC.exe Token: 36 2872 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 656 wrote to memory of 3648 656 28c6930ca323e61d91b92e4bb843d0bb.exe 75 PID 656 wrote to memory of 3648 656 28c6930ca323e61d91b92e4bb843d0bb.exe 75 PID 656 wrote to memory of 3648 656 28c6930ca323e61d91b92e4bb843d0bb.exe 75 PID 3648 wrote to memory of 2872 3648 cmd.exe 77 PID 3648 wrote to memory of 2872 3648 cmd.exe 77 PID 3648 wrote to memory of 2872 3648 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\28c6930ca323e61d91b92e4bb843d0bb.exe"C:\Users\Admin\AppData\Local\Temp\28c6930ca323e61d91b92e4bb843d0bb.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-