nitro | 6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2022, 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
Size

173KB
MD5

cb01abb8d6243fb221a9ad82b045f8d5
SHA1

1de449599b00a296444dba9fae178e3ebab11fcf
SHA256

6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9
SHA512

a99f74a0a8ffd788ecf328415703148c798df1fb058a427d55aebd6bba429f75dffeb74613503834e29bb911f5f46381327ec4656e26a56d5ac57c7617698323
SSDEEP

1536:DYXaUsozJCno/PhFqy+iLU2oxF7pbbeAkOppZfS/Eo:DYjhIyv4F7pPeAkOppw/t

Score

10^/10

nitro persistence ransomware

Malware Config

Signatures

Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
ransomware nitro

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\FindInitialize.tiff.getfuckedretard	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File opened for modification	C:\Users\Admin\Pictures\FindInitialize.tiff	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File created	C:\Users\Admin\Pictures\InstallEnter.raw.getfuckedretard	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File created	C:\Users\Admin\Pictures\LimitCheckpoint.crw.getfuckedretard	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File created	C:\Users\Admin\Pictures\SendRevoke.tiff.getfuckedretard	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File opened for modification	C:\Users\Admin\Pictures\SendRevoke.tiff	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe\""	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png"	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4812	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
4812	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe

C:\Users\Admin\AppData\Local\Temp\6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
"C:\Users\Admin\AppData\Local\Temp\6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4812-132-0x0000000000AA0000-0x0000000000AD2000-memory.dmp

Filesize
200KB

Download
memory/4812-133-0x0000000005B70000-0x0000000006114000-memory.dmp

Filesize
5.6MB

Download
memory/4812-134-0x0000000005510000-0x00000000055A2000-memory.dmp

Filesize
584KB

Download
memory/4812-135-0x0000000005AF0000-0x0000000005AFA000-memory.dmp

Filesize
40KB

Download