Resubmissions
01-07-2023 10:36
230701-mngyhagf75 1001-07-2023 10:34
230701-ml5lsagf74 1001-07-2023 10:31
230701-mkjb6ahg8t 1001-07-2023 10:19
230701-mc171agf63 10Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2023 10:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomware.exe
Resource
win10-20230621-en
windows10-1703-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
NitroRansomware.exe
Resource
win7-20230621-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
NitroRansomware.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
NitroRansomware.exe
-
Size
1.0MB
-
MD5
67158b9c2184e40339161fddffa9e850
-
SHA1
5715c4610d84a077de42b5d031ec70ad77a8433e
-
SHA256
6d65adceb3723db328eac3601cbb540d40bcad7289e98804e977fe24a22d747f
-
SHA512
617cecfee0d7ad0002cd1fb6782bbadc0642b4513d0b4b195fa94475d774acf8e7a943128ca448bd451573b1642c665b36035adfa12e5ec02cbbdbe4474777a1
-
SSDEEP
24576:0rYGGjodngwtlaHxN8KUWVe6tw2wvKhLnTU:0rYG2odngwwHv5VbtHw
Score
10/10
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe -
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\StartGroup.png.lmao NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\UnprotectWrite.tiff NitroRansomware.exe File created C:\Users\Admin\Pictures\ExpandApprove.crw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\RestartDisable.png.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\EditSearch.tif.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\ReadDisable.crw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\SearchNew.tiff.lmao NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\SearchNew.tiff NitroRansomware.exe File created C:\Users\Admin\Pictures\GroupUnpublish.png.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\GroupWrite.png.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\MeasureUnprotect.tif.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\RenameRead.crw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\UnprotectWrite.tiff.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\DisableRead.raw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\JoinMeasure.raw.lmao NitroRansomware.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NitroRansomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 api.ipify.org 24 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 452 4308 WerFault.exe 85 1796 4308 WerFault.exe 85 -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4880 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4308 NitroRansomware.exe 4308 NitroRansomware.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4308 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 3640 wmic.exe Token: SeSecurityPrivilege 3640 wmic.exe Token: SeTakeOwnershipPrivilege 3640 wmic.exe Token: SeLoadDriverPrivilege 3640 wmic.exe Token: SeSystemProfilePrivilege 3640 wmic.exe Token: SeSystemtimePrivilege 3640 wmic.exe Token: SeProfSingleProcessPrivilege 3640 wmic.exe Token: SeIncBasePriorityPrivilege 3640 wmic.exe Token: SeCreatePagefilePrivilege 3640 wmic.exe Token: SeBackupPrivilege 3640 wmic.exe Token: SeRestorePrivilege 3640 wmic.exe Token: SeShutdownPrivilege 3640 wmic.exe Token: SeDebugPrivilege 3640 wmic.exe Token: SeSystemEnvironmentPrivilege 3640 wmic.exe Token: SeRemoteShutdownPrivilege 3640 wmic.exe Token: SeUndockPrivilege 3640 wmic.exe Token: SeManageVolumePrivilege 3640 wmic.exe Token: 33 3640 wmic.exe Token: 34 3640 wmic.exe Token: 35 3640 wmic.exe Token: 36 3640 wmic.exe Token: SeIncreaseQuotaPrivilege 3640 wmic.exe Token: SeSecurityPrivilege 3640 wmic.exe Token: SeTakeOwnershipPrivilege 3640 wmic.exe Token: SeLoadDriverPrivilege 3640 wmic.exe Token: SeSystemProfilePrivilege 3640 wmic.exe Token: SeSystemtimePrivilege 3640 wmic.exe Token: SeProfSingleProcessPrivilege 3640 wmic.exe Token: SeIncBasePriorityPrivilege 3640 wmic.exe Token: SeCreatePagefilePrivilege 3640 wmic.exe Token: SeBackupPrivilege 3640 wmic.exe Token: SeRestorePrivilege 3640 wmic.exe Token: SeShutdownPrivilege 3640 wmic.exe Token: SeDebugPrivilege 3640 wmic.exe Token: SeSystemEnvironmentPrivilege 3640 wmic.exe Token: SeRemoteShutdownPrivilege 3640 wmic.exe Token: SeUndockPrivilege 3640 wmic.exe Token: SeManageVolumePrivilege 3640 wmic.exe Token: 33 3640 wmic.exe Token: 34 3640 wmic.exe Token: 35 3640 wmic.exe Token: 36 3640 wmic.exe Token: SeDebugPrivilege 4880 tasklist.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4308 wrote to memory of 3640 4308 NitroRansomware.exe 88 PID 4308 wrote to memory of 3640 4308 NitroRansomware.exe 88 PID 4308 wrote to memory of 3640 4308 NitroRansomware.exe 88 PID 4308 wrote to memory of 4880 4308 NitroRansomware.exe 91 PID 4308 wrote to memory of 4880 4308 NitroRansomware.exe 91 PID 4308 wrote to memory of 4880 4308 NitroRansomware.exe 91 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4308 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3640
-
-
C:\Windows\SysWOW64\tasklist.exe"tasklist"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 22682⤵
- Program crash
PID:452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 22682⤵
- Program crash
PID:1796
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4308 -ip 43081⤵PID:1508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4308 -ip 43081⤵PID:440