Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-12-2021 08:47
Static task
static1
Behavioral task
behavioral1
Sample
c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe
-
Size
179KB
-
MD5
8f06a36119294e2950b0fa5ec41b605a
-
SHA1
27c9aba4fb5f1da2b109e22fa898f23b73512af5
-
SHA256
c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4
-
SHA512
fb98058d6a03ed25b8981a8b29d29282ba090fc138a96edc3cd3beaf9b0c4d904a0cc27eb58730e05e33c55fb8b5de3eaadb5c63ca92201d6bb49481d0522a0d
Score
10/10
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\DebugEdit.raw.tom c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe File created C:\Users\Admin\Pictures\MoveInvoke.raw.tom c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe File created C:\Users\Admin\Pictures\PushCompress.tiff.tom c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe File opened for modification C:\Users\Admin\Pictures\PushCompress.tiff c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe File created C:\Users\Admin\Pictures\SaveRestore.png.tom c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe File created C:\Users\Admin\Pictures\UseRestart.png.tom c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe\"" c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe File opened for modification C:\Users\Admin\Documents\desktop.ini c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\Wallpaper.jpg" c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1876 c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe 1876 c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1876 c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe Token: SeIncreaseQuotaPrivilege 560 WMIC.exe Token: SeSecurityPrivilege 560 WMIC.exe Token: SeTakeOwnershipPrivilege 560 WMIC.exe Token: SeLoadDriverPrivilege 560 WMIC.exe Token: SeSystemProfilePrivilege 560 WMIC.exe Token: SeSystemtimePrivilege 560 WMIC.exe Token: SeProfSingleProcessPrivilege 560 WMIC.exe Token: SeIncBasePriorityPrivilege 560 WMIC.exe Token: SeCreatePagefilePrivilege 560 WMIC.exe Token: SeBackupPrivilege 560 WMIC.exe Token: SeRestorePrivilege 560 WMIC.exe Token: SeShutdownPrivilege 560 WMIC.exe Token: SeDebugPrivilege 560 WMIC.exe Token: SeSystemEnvironmentPrivilege 560 WMIC.exe Token: SeRemoteShutdownPrivilege 560 WMIC.exe Token: SeUndockPrivilege 560 WMIC.exe Token: SeManageVolumePrivilege 560 WMIC.exe Token: 33 560 WMIC.exe Token: 34 560 WMIC.exe Token: 35 560 WMIC.exe Token: SeIncreaseQuotaPrivilege 560 WMIC.exe Token: SeSecurityPrivilege 560 WMIC.exe Token: SeTakeOwnershipPrivilege 560 WMIC.exe Token: SeLoadDriverPrivilege 560 WMIC.exe Token: SeSystemProfilePrivilege 560 WMIC.exe Token: SeSystemtimePrivilege 560 WMIC.exe Token: SeProfSingleProcessPrivilege 560 WMIC.exe Token: SeIncBasePriorityPrivilege 560 WMIC.exe Token: SeCreatePagefilePrivilege 560 WMIC.exe Token: SeBackupPrivilege 560 WMIC.exe Token: SeRestorePrivilege 560 WMIC.exe Token: SeShutdownPrivilege 560 WMIC.exe Token: SeDebugPrivilege 560 WMIC.exe Token: SeSystemEnvironmentPrivilege 560 WMIC.exe Token: SeRemoteShutdownPrivilege 560 WMIC.exe Token: SeUndockPrivilege 560 WMIC.exe Token: SeManageVolumePrivilege 560 WMIC.exe Token: 33 560 WMIC.exe Token: 34 560 WMIC.exe Token: 35 560 WMIC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1876 wrote to memory of 672 1876 c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe 27 PID 1876 wrote to memory of 672 1876 c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe 27 PID 1876 wrote to memory of 672 1876 c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe 27 PID 672 wrote to memory of 560 672 cmd.exe 29 PID 672 wrote to memory of 560 672 cmd.exe 29 PID 672 wrote to memory of 560 672 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe"C:\Users\Admin\AppData\Local\Temp\c62841916d8477986697839c68025bd4158367c8c7e0e05fdc29fcdd210099f4.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\system32\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-