Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
10s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2023, 07:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomware.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
10 signatures
1800 seconds
General
-
Target
NitroRansomware.exe
-
Size
1.0MB
-
MD5
49bd540f675ab86f4cc99008103a0593
-
SHA1
5412cf9129ee7fb43bc132da22d4f628b475995d
-
SHA256
3c2b8203efee6f5cc3b74802d02a650dc105dc3ae81ca888b08cc2f830b8f838
-
SHA512
19811c18d80e742360b6bf1c19dadd8ba5ecca42f1c9f53718ee8f09da170565680050d1af78e6e701c296efd75406d3c48a88adb6a1f618e5b28e7cfcbf5b2d
-
SSDEEP
24576:YoYGGjodngwtlaHxN8KUWVe6tw2wvKhLnmY:YoYG2odngwwHv5VbtHw
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\AddNew.png.lmao NitroRansomware.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NitroRansomware.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 api.ipify.org 21 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1332 NitroRansomware.exe 1332 NitroRansomware.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1332 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 4224 wmic.exe Token: SeSecurityPrivilege 4224 wmic.exe Token: SeTakeOwnershipPrivilege 4224 wmic.exe Token: SeLoadDriverPrivilege 4224 wmic.exe Token: SeSystemProfilePrivilege 4224 wmic.exe Token: SeSystemtimePrivilege 4224 wmic.exe Token: SeProfSingleProcessPrivilege 4224 wmic.exe Token: SeIncBasePriorityPrivilege 4224 wmic.exe Token: SeCreatePagefilePrivilege 4224 wmic.exe Token: SeBackupPrivilege 4224 wmic.exe Token: SeRestorePrivilege 4224 wmic.exe Token: SeShutdownPrivilege 4224 wmic.exe Token: SeDebugPrivilege 4224 wmic.exe Token: SeSystemEnvironmentPrivilege 4224 wmic.exe Token: SeRemoteShutdownPrivilege 4224 wmic.exe Token: SeUndockPrivilege 4224 wmic.exe Token: SeManageVolumePrivilege 4224 wmic.exe Token: 33 4224 wmic.exe Token: 34 4224 wmic.exe Token: 35 4224 wmic.exe Token: 36 4224 wmic.exe Token: SeIncreaseQuotaPrivilege 4224 wmic.exe Token: SeSecurityPrivilege 4224 wmic.exe Token: SeTakeOwnershipPrivilege 4224 wmic.exe Token: SeLoadDriverPrivilege 4224 wmic.exe Token: SeSystemProfilePrivilege 4224 wmic.exe Token: SeSystemtimePrivilege 4224 wmic.exe Token: SeProfSingleProcessPrivilege 4224 wmic.exe Token: SeIncBasePriorityPrivilege 4224 wmic.exe Token: SeCreatePagefilePrivilege 4224 wmic.exe Token: SeBackupPrivilege 4224 wmic.exe Token: SeRestorePrivilege 4224 wmic.exe Token: SeShutdownPrivilege 4224 wmic.exe Token: SeDebugPrivilege 4224 wmic.exe Token: SeSystemEnvironmentPrivilege 4224 wmic.exe Token: SeRemoteShutdownPrivilege 4224 wmic.exe Token: SeUndockPrivilege 4224 wmic.exe Token: SeManageVolumePrivilege 4224 wmic.exe Token: 33 4224 wmic.exe Token: 34 4224 wmic.exe Token: 35 4224 wmic.exe Token: 36 4224 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1332 wrote to memory of 4224 1332 NitroRansomware.exe 84 PID 1332 wrote to memory of 4224 1332 NitroRansomware.exe 84 PID 1332 wrote to memory of 4224 1332 NitroRansomware.exe 84 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1332 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224
-