Analysis
- max time kernel
89s - max time network
150s - platform
windows10_x64 - resource
win10v20210408 - submitted
12/08/2021, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
92eea22c70cf0fe4116b1021e91eb373.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
92eea22c70cf0fe4116b1021e91eb373.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 92eea22c70cf0fe4116b1021e91eb373.exe
- Size 61KB
- Sample210812-yn4wfndeaa
- SHA256 73d55d99c41e89daa8c9bd213d02974d89b53c3e5a0dcd5bbf0b99ff36424cac
- MD5 92eea22c70cf0fe4116b1021e91eb373
- SHA1 66b8c24be3b82ecbbebb5e5a70ddf746d212e16f
- SHA512 b8d2b6bba4027bda2ac3ef09c346a1e8ee768afb990bcacbd860bbead42a420303814e4f4081a32b81f89085b53879f7ce888c864cf34654a7c066facb44d035
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
- Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\BlockSwitch.tif.givemenitro 92eea22c70cf0fe4116b1021e91eb373.exe File created C:\Users\Admin\Pictures\CompressRevoke.raw.givemenitro 92eea22c70cf0fe4116b1021e91eb373.exe File created C:\Users\Admin\Pictures\ProtectMove.tiff.givemenitro 92eea22c70cf0fe4116b1021e91eb373.exe File opened for modification C:\Users\Admin\Pictures\SaveHide.tiff 92eea22c70cf0fe4116b1021e91eb373.exe File created C:\Users\Admin\Pictures\SelectTrace.raw.givemenitro 92eea22c70cf0fe4116b1021e91eb373.exe File created C:\Users\Admin\Pictures\UpdateJoin.tif.givemenitro 92eea22c70cf0fe4116b1021e91eb373.exe File opened for modification C:\Users\Admin\Pictures\ProtectMove.tiff 92eea22c70cf0fe4116b1021e91eb373.exe File created C:\Users\Admin\Pictures\RenameRead.raw.givemenitro 92eea22c70cf0fe4116b1021e91eb373.exe File created C:\Users\Admin\Pictures\SaveHide.tiff.givemenitro 92eea22c70cf0fe4116b1021e91eb373.exe File created C:\Users\Admin\Pictures\SplitSave.png.givemenitro 92eea22c70cf0fe4116b1021e91eb373.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\92eea22c70cf0fe4116b1021e91eb373.exe\"" 92eea22c70cf0fe4116b1021e91eb373.exe - Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 92eea22c70cf0fe4116b1021e91eb373.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 92eea22c70cf0fe4116b1021e91eb373.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 92eea22c70cf0fe4116b1021e91eb373.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 92eea22c70cf0fe4116b1021e91eb373.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 92eea22c70cf0fe4116b1021e91eb373.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 api.ipify.org 13 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 92eea22c70cf0fe4116b1021e91eb373.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 396 92eea22c70cf0fe4116b1021e91eb373.exe 396 92eea22c70cf0fe4116b1021e91eb373.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 396 92eea22c70cf0fe4116b1021e91eb373.exe Token: SeIncreaseQuotaPrivilege 2856 WMIC.exe Token: SeSecurityPrivilege 2856 WMIC.exe Token: SeTakeOwnershipPrivilege 2856 WMIC.exe Token: SeLoadDriverPrivilege 2856 WMIC.exe Token: SeSystemProfilePrivilege 2856 WMIC.exe Token: SeSystemtimePrivilege 2856 WMIC.exe Token: SeProfSingleProcessPrivilege 2856 WMIC.exe Token: SeIncBasePriorityPrivilege 2856 WMIC.exe Token: SeCreatePagefilePrivilege 2856 WMIC.exe Token: SeBackupPrivilege 2856 WMIC.exe Token: SeRestorePrivilege 2856 WMIC.exe Token: SeShutdownPrivilege 2856 WMIC.exe Token: SeDebugPrivilege 2856 WMIC.exe Token: SeSystemEnvironmentPrivilege 2856 WMIC.exe Token: SeRemoteShutdownPrivilege 2856 WMIC.exe Token: SeUndockPrivilege 2856 WMIC.exe Token: SeManageVolumePrivilege 2856 WMIC.exe Token: 33 2856 WMIC.exe Token: 34 2856 WMIC.exe Token: 35 2856 WMIC.exe Token: 36 2856 WMIC.exe Token: SeIncreaseQuotaPrivilege 2856 WMIC.exe Token: SeSecurityPrivilege 2856 WMIC.exe Token: SeTakeOwnershipPrivilege 2856 WMIC.exe Token: SeLoadDriverPrivilege 2856 WMIC.exe Token: SeSystemProfilePrivilege 2856 WMIC.exe Token: SeSystemtimePrivilege 2856 WMIC.exe Token: SeProfSingleProcessPrivilege 2856 WMIC.exe Token: SeIncBasePriorityPrivilege 2856 WMIC.exe Token: SeCreatePagefilePrivilege 2856 WMIC.exe Token: SeBackupPrivilege 2856 WMIC.exe Token: SeRestorePrivilege 2856 WMIC.exe Token: SeShutdownPrivilege 2856 WMIC.exe Token: SeDebugPrivilege 2856 WMIC.exe Token: SeSystemEnvironmentPrivilege 2856 WMIC.exe Token: SeRemoteShutdownPrivilege 2856 WMIC.exe Token: SeUndockPrivilege 2856 WMIC.exe Token: SeManageVolumePrivilege 2856 WMIC.exe Token: 33 2856 WMIC.exe Token: 34 2856 WMIC.exe Token: 35 2856 WMIC.exe Token: 36 2856 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 396 wrote to memory of 4076 396 92eea22c70cf0fe4116b1021e91eb373.exe 75 PID 396 wrote to memory of 4076 396 92eea22c70cf0fe4116b1021e91eb373.exe 75 PID 396 wrote to memory of 4076 396 92eea22c70cf0fe4116b1021e91eb373.exe 75 PID 4076 wrote to memory of 2856 4076 cmd.exe 77 PID 4076 wrote to memory of 2856 4076 cmd.exe 77 PID 4076 wrote to memory of 2856 4076 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\92eea22c70cf0fe4116b1021e91eb373.exe"C:\Users\Admin\AppData\Local\Temp\92eea22c70cf0fe4116b1021e91eb373.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-