nitro | 6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9

Analysis

max time kernel
64s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-11-2022 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
Size

173KB
MD5

cb01abb8d6243fb221a9ad82b045f8d5
SHA1

1de449599b00a296444dba9fae178e3ebab11fcf
SHA256

6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9
SHA512

a99f74a0a8ffd788ecf328415703148c798df1fb058a427d55aebd6bba429f75dffeb74613503834e29bb911f5f46381327ec4656e26a56d5ac57c7617698323
SSDEEP

1536:DYXaUsozJCno/PhFqy+iLU2oxF7pbbeAkOppZfS/Eo:DYjhIyv4F7pPeAkOppw/t

Score

10^/10

nitro persistence ransomware

Malware Config

Signatures

Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
ransomware nitro

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\InitializeMount.crw.getfuckedretard	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File created	C:\Users\Admin\Pictures\InvokeGrant.raw.getfuckedretard	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File created	C:\Users\Admin\Pictures\ExitRestore.png.getfuckedretard	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\"	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png"	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1768	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
1768	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

C:\Users\Admin\AppData\Local\Temp\6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
"C:\Users\Admin\AppData\Local\Temp\6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-54-0x00000000001A0000-0x00000000001D2000-memory.dmp

Filesize
200KB

Download
memory/1768-55-0x0000000001D10000-0x0000000001D20000-memory.dmp

Filesize
64KB

Download
memory/1768-56-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1768-57-0x0000000004525000-0x0000000004536000-memory.dmp

Filesize
68KB

Download