Analysis
- max time kernel
103s - max time network
134s - platform
windows10_x64 - resource
win10-en - submitted
06/09/2021, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe
- Size 606KB
- Sample210906-hhm54safa4
- SHA256 a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82
- MD5 1bc6efe6458d77805f2513cbea6a92f7
- SHA1 af642d06cff4b2e71370e0c14d8ed73f8b24b8d5
- SHA512 180eb1ccd2960def79a3df258b13da1627ac557d762e59d1a463a6f9b976f16f915d57d37670dd4e9be2c19669be83c63989e07e4086f79e1c9bc4eab185ae5b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
- Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\ResumeFormat.png.givemenitro a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File created C:\Users\Admin\Pictures\UnlockSearch.raw.givemenitro a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File created C:\Users\Admin\Pictures\ConvertFromMount.tiff.givemenitro a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File opened for modification C:\Users\Admin\Pictures\GetDeny.tiff a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File created C:\Users\Admin\Pictures\ReceiveExport.crw.givemenitro a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File created C:\Users\Admin\Pictures\RedoUpdate.crw.givemenitro a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File created C:\Users\Admin\Pictures\RequestDismount.raw.givemenitro a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromMount.tiff a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File created C:\Users\Admin\Pictures\GetDeny.tiff.givemenitro a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File created C:\Users\Admin\Pictures\SetResolve.png.givemenitro a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe\"" a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe - Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File opened for modification C:\Users\Admin\Documents\desktop.ini a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 api.ipify.org 13 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4524 a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe 4524 a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4524 a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe Token: SeIncreaseQuotaPrivilege 3500 WMIC.exe Token: SeSecurityPrivilege 3500 WMIC.exe Token: SeTakeOwnershipPrivilege 3500 WMIC.exe Token: SeLoadDriverPrivilege 3500 WMIC.exe Token: SeSystemProfilePrivilege 3500 WMIC.exe Token: SeSystemtimePrivilege 3500 WMIC.exe Token: SeProfSingleProcessPrivilege 3500 WMIC.exe Token: SeIncBasePriorityPrivilege 3500 WMIC.exe Token: SeCreatePagefilePrivilege 3500 WMIC.exe Token: SeBackupPrivilege 3500 WMIC.exe Token: SeRestorePrivilege 3500 WMIC.exe Token: SeShutdownPrivilege 3500 WMIC.exe Token: SeDebugPrivilege 3500 WMIC.exe Token: SeSystemEnvironmentPrivilege 3500 WMIC.exe Token: SeRemoteShutdownPrivilege 3500 WMIC.exe Token: SeUndockPrivilege 3500 WMIC.exe Token: SeManageVolumePrivilege 3500 WMIC.exe Token: 33 3500 WMIC.exe Token: 34 3500 WMIC.exe Token: 35 3500 WMIC.exe Token: 36 3500 WMIC.exe Token: SeIncreaseQuotaPrivilege 3500 WMIC.exe Token: SeSecurityPrivilege 3500 WMIC.exe Token: SeTakeOwnershipPrivilege 3500 WMIC.exe Token: SeLoadDriverPrivilege 3500 WMIC.exe Token: SeSystemProfilePrivilege 3500 WMIC.exe Token: SeSystemtimePrivilege 3500 WMIC.exe Token: SeProfSingleProcessPrivilege 3500 WMIC.exe Token: SeIncBasePriorityPrivilege 3500 WMIC.exe Token: SeCreatePagefilePrivilege 3500 WMIC.exe Token: SeBackupPrivilege 3500 WMIC.exe Token: SeRestorePrivilege 3500 WMIC.exe Token: SeShutdownPrivilege 3500 WMIC.exe Token: SeDebugPrivilege 3500 WMIC.exe Token: SeSystemEnvironmentPrivilege 3500 WMIC.exe Token: SeRemoteShutdownPrivilege 3500 WMIC.exe Token: SeUndockPrivilege 3500 WMIC.exe Token: SeManageVolumePrivilege 3500 WMIC.exe Token: 33 3500 WMIC.exe Token: 34 3500 WMIC.exe Token: 35 3500 WMIC.exe Token: 36 3500 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4524 wrote to memory of 3508 4524 a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe 76 PID 4524 wrote to memory of 3508 4524 a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe 76 PID 4524 wrote to memory of 3508 4524 a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe 76 PID 3508 wrote to memory of 3500 3508 cmd.exe 78 PID 3508 wrote to memory of 3500 3508 cmd.exe 78 PID 3508 wrote to memory of 3500 3508 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe"C:\Users\Admin\AppData\Local\Temp\a8c5c86763a1d698f301011ac3d3380b94d541bac5cfa0e37cd5dae9d6308e82.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-