Resubmissions
01-07-2023 10:36
230701-mngyhagf75 1001-07-2023 10:34
230701-ml5lsagf74 1001-07-2023 10:31
230701-mkjb6ahg8t 1001-07-2023 10:19
230701-mc171agf63 10Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
01-07-2023 10:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomware.exe
Resource
win10-20230621-en
windows10-1703-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
NitroRansomware.exe
Resource
win7-20230621-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
NitroRansomware.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
NitroRansomware.exe
-
Size
1.0MB
-
MD5
67158b9c2184e40339161fddffa9e850
-
SHA1
5715c4610d84a077de42b5d031ec70ad77a8433e
-
SHA256
6d65adceb3723db328eac3601cbb540d40bcad7289e98804e977fe24a22d747f
-
SHA512
617cecfee0d7ad0002cd1fb6782bbadc0642b4513d0b4b195fa94475d774acf8e7a943128ca448bd451573b1642c665b36035adfa12e5ec02cbbdbe4474777a1
-
SSDEEP
24576:0rYGGjodngwtlaHxN8KUWVe6tw2wvKhLnTU:0rYG2odngwwHv5VbtHw
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NitroRansomware.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org -
Program crash 1 IoCs
pid pid_target Process procid_target 1456 1740 WerFault.exe 26 -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1476 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1740 NitroRansomware.exe 1740 NitroRansomware.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 1740 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 944 wmic.exe Token: SeSecurityPrivilege 944 wmic.exe Token: SeTakeOwnershipPrivilege 944 wmic.exe Token: SeLoadDriverPrivilege 944 wmic.exe Token: SeSystemProfilePrivilege 944 wmic.exe Token: SeSystemtimePrivilege 944 wmic.exe Token: SeProfSingleProcessPrivilege 944 wmic.exe Token: SeIncBasePriorityPrivilege 944 wmic.exe Token: SeCreatePagefilePrivilege 944 wmic.exe Token: SeBackupPrivilege 944 wmic.exe Token: SeRestorePrivilege 944 wmic.exe Token: SeShutdownPrivilege 944 wmic.exe Token: SeDebugPrivilege 944 wmic.exe Token: SeSystemEnvironmentPrivilege 944 wmic.exe Token: SeRemoteShutdownPrivilege 944 wmic.exe Token: SeUndockPrivilege 944 wmic.exe Token: SeManageVolumePrivilege 944 wmic.exe Token: 33 944 wmic.exe Token: 34 944 wmic.exe Token: 35 944 wmic.exe Token: SeIncreaseQuotaPrivilege 944 wmic.exe Token: SeSecurityPrivilege 944 wmic.exe Token: SeTakeOwnershipPrivilege 944 wmic.exe Token: SeLoadDriverPrivilege 944 wmic.exe Token: SeSystemProfilePrivilege 944 wmic.exe Token: SeSystemtimePrivilege 944 wmic.exe Token: SeProfSingleProcessPrivilege 944 wmic.exe Token: SeIncBasePriorityPrivilege 944 wmic.exe Token: SeCreatePagefilePrivilege 944 wmic.exe Token: SeBackupPrivilege 944 wmic.exe Token: SeRestorePrivilege 944 wmic.exe Token: SeShutdownPrivilege 944 wmic.exe Token: SeDebugPrivilege 944 wmic.exe Token: SeSystemEnvironmentPrivilege 944 wmic.exe Token: SeRemoteShutdownPrivilege 944 wmic.exe Token: SeUndockPrivilege 944 wmic.exe Token: SeManageVolumePrivilege 944 wmic.exe Token: 33 944 wmic.exe Token: 34 944 wmic.exe Token: 35 944 wmic.exe Token: SeDebugPrivilege 1476 tasklist.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1740 wrote to memory of 944 1740 NitroRansomware.exe 28 PID 1740 wrote to memory of 944 1740 NitroRansomware.exe 28 PID 1740 wrote to memory of 944 1740 NitroRansomware.exe 28 PID 1740 wrote to memory of 944 1740 NitroRansomware.exe 28 PID 1740 wrote to memory of 1476 1740 NitroRansomware.exe 30 PID 1740 wrote to memory of 1476 1740 NitroRansomware.exe 30 PID 1740 wrote to memory of 1476 1740 NitroRansomware.exe 30 PID 1740 wrote to memory of 1476 1740 NitroRansomware.exe 30 PID 1740 wrote to memory of 1456 1740 NitroRansomware.exe 32 PID 1740 wrote to memory of 1456 1740 NitroRansomware.exe 32 PID 1740 wrote to memory of 1456 1740 NitroRansomware.exe 32 PID 1740 wrote to memory of 1456 1740 NitroRansomware.exe 32 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1740 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:944
-
-
C:\Windows\SysWOW64\tasklist.exe"tasklist"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 14282⤵
- Program crash
PID:1456
-