Resubmissions
01-07-2023 10:36
230701-mngyhagf75 1001-07-2023 10:34
230701-ml5lsagf74 1001-07-2023 10:31
230701-mkjb6ahg8t 1001-07-2023 10:19
230701-mc171agf63 10Analysis
-
max time kernel
66s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2023 10:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomware.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
13 signatures
1800 seconds
General
-
Target
NitroRansomware.exe
-
Size
1.0MB
-
MD5
67158b9c2184e40339161fddffa9e850
-
SHA1
5715c4610d84a077de42b5d031ec70ad77a8433e
-
SHA256
6d65adceb3723db328eac3601cbb540d40bcad7289e98804e977fe24a22d747f
-
SHA512
617cecfee0d7ad0002cd1fb6782bbadc0642b4513d0b4b195fa94475d774acf8e7a943128ca448bd451573b1642c665b36035adfa12e5ec02cbbdbe4474777a1
-
SSDEEP
24576:0rYGGjodngwtlaHxN8KUWVe6tw2wvKhLnTU:0rYG2odngwwHv5VbtHw
Score
10/10
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe -
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\CopyReset.png.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\DenyRegister.raw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\MountRepair.tif.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\ProtectStep.png.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\RequestGet.crw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\RequestRedo.raw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\CompressStep.tiff.lmao NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\CompressStep.tiff NitroRansomware.exe File created C:\Users\Admin\Pictures\RestoreSave.png.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\StartClose.tif.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\UnprotectResolve.crw.lmao NitroRansomware.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NitroRansomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomware.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 40 api.ipify.org 41 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2328 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 456 NitroRansomware.exe 456 NitroRansomware.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 456 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 3564 wmic.exe Token: SeSecurityPrivilege 3564 wmic.exe Token: SeTakeOwnershipPrivilege 3564 wmic.exe Token: SeLoadDriverPrivilege 3564 wmic.exe Token: SeSystemProfilePrivilege 3564 wmic.exe Token: SeSystemtimePrivilege 3564 wmic.exe Token: SeProfSingleProcessPrivilege 3564 wmic.exe Token: SeIncBasePriorityPrivilege 3564 wmic.exe Token: SeCreatePagefilePrivilege 3564 wmic.exe Token: SeBackupPrivilege 3564 wmic.exe Token: SeRestorePrivilege 3564 wmic.exe Token: SeShutdownPrivilege 3564 wmic.exe Token: SeDebugPrivilege 3564 wmic.exe Token: SeSystemEnvironmentPrivilege 3564 wmic.exe Token: SeRemoteShutdownPrivilege 3564 wmic.exe Token: SeUndockPrivilege 3564 wmic.exe Token: SeManageVolumePrivilege 3564 wmic.exe Token: 33 3564 wmic.exe Token: 34 3564 wmic.exe Token: 35 3564 wmic.exe Token: 36 3564 wmic.exe Token: SeIncreaseQuotaPrivilege 3564 wmic.exe Token: SeSecurityPrivilege 3564 wmic.exe Token: SeTakeOwnershipPrivilege 3564 wmic.exe Token: SeLoadDriverPrivilege 3564 wmic.exe Token: SeSystemProfilePrivilege 3564 wmic.exe Token: SeSystemtimePrivilege 3564 wmic.exe Token: SeProfSingleProcessPrivilege 3564 wmic.exe Token: SeIncBasePriorityPrivilege 3564 wmic.exe Token: SeCreatePagefilePrivilege 3564 wmic.exe Token: SeBackupPrivilege 3564 wmic.exe Token: SeRestorePrivilege 3564 wmic.exe Token: SeShutdownPrivilege 3564 wmic.exe Token: SeDebugPrivilege 3564 wmic.exe Token: SeSystemEnvironmentPrivilege 3564 wmic.exe Token: SeRemoteShutdownPrivilege 3564 wmic.exe Token: SeUndockPrivilege 3564 wmic.exe Token: SeManageVolumePrivilege 3564 wmic.exe Token: 33 3564 wmic.exe Token: 34 3564 wmic.exe Token: 35 3564 wmic.exe Token: 36 3564 wmic.exe Token: SeDebugPrivilege 2328 tasklist.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 456 wrote to memory of 3564 456 NitroRansomware.exe 89 PID 456 wrote to memory of 3564 456 NitroRansomware.exe 89 PID 456 wrote to memory of 3564 456 NitroRansomware.exe 89 PID 456 wrote to memory of 2328 456 NitroRansomware.exe 93 PID 456 wrote to memory of 2328 456 NitroRansomware.exe 93 PID 456 wrote to memory of 2328 456 NitroRansomware.exe 93 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:456 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
-
C:\Windows\SysWOW64\tasklist.exe"tasklist"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2328
-