Analysis
-
max time kernel
109s -
max time network
77s -
platform
windows10-1703_x64 -
resource
win10-20230621-en -
resource tags
arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system -
submitted
02-07-2023 23:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomware.exe
Resource
win10-20230621-en
windows10-1703-x64
17 signatures
1800 seconds
General
-
Target
NitroRansomware.exe
-
Size
1.3MB
-
MD5
d8bc15d7823c0db0882be71f853ce8f7
-
SHA1
b17969bbc6826d6d33ab6ca6b9cfad0af46d6ec8
-
SHA256
c853ee6eb1abf28eab76d035f1b5b5548563f375f0f98335aa0853e8a66181b3
-
SHA512
222926d57978c16b6ad3b7a487c3c862f932e5dd734e6e889026996fcb37b2168dd205f29201549dad5c7955775e6b3b8bf5f960df06504419ed5369de082c2a
-
SSDEEP
24576:WNYGGwodngwtlaHxN8KUWVe6tw2wvKhLnekqjVnlqud+/2P+AP3:WNYGjodngwwHv5VbtHw1kqXfd+/9A
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe -
AgentTesla payload 1 IoCs
resource yara_rule behavioral1/memory/4240-220-0x0000000007580000-0x0000000007776000-memory.dmp family_agenttesla -
Disables Task Manager via registry modification
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\LimitStart.raw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\RemoveConfirm.raw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\RepairConfirm.png.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\RepairPop.tif.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\SaveRevoke.png.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\WatchJoin.tiff.lmao NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\WatchJoin.tiff NitroRansomware.exe File created C:\Users\Admin\Pictures\ConvertConvertTo.tif.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\LimitUnpublish.tiff.lmao NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\LimitUnpublish.tiff NitroRansomware.exe File created C:\Users\Admin\Pictures\WaitConvert.raw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\WriteRevoke.crw.lmao NitroRansomware.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2920667096-3376612704-1562175574-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NitroRansomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomware.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 2 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2920667096-3376612704-1562175574-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4080 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer NitroRansomware.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion NitroRansomware.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS NitroRansomware.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4240 NitroRansomware.exe 4240 NitroRansomware.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4240 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 5072 wmic.exe Token: SeSecurityPrivilege 5072 wmic.exe Token: SeTakeOwnershipPrivilege 5072 wmic.exe Token: SeLoadDriverPrivilege 5072 wmic.exe Token: SeSystemProfilePrivilege 5072 wmic.exe Token: SeSystemtimePrivilege 5072 wmic.exe Token: SeProfSingleProcessPrivilege 5072 wmic.exe Token: SeIncBasePriorityPrivilege 5072 wmic.exe Token: SeCreatePagefilePrivilege 5072 wmic.exe Token: SeBackupPrivilege 5072 wmic.exe Token: SeRestorePrivilege 5072 wmic.exe Token: SeShutdownPrivilege 5072 wmic.exe Token: SeDebugPrivilege 5072 wmic.exe Token: SeSystemEnvironmentPrivilege 5072 wmic.exe Token: SeRemoteShutdownPrivilege 5072 wmic.exe Token: SeUndockPrivilege 5072 wmic.exe Token: SeManageVolumePrivilege 5072 wmic.exe Token: 33 5072 wmic.exe Token: 34 5072 wmic.exe Token: 35 5072 wmic.exe Token: 36 5072 wmic.exe Token: SeIncreaseQuotaPrivilege 5072 wmic.exe Token: SeSecurityPrivilege 5072 wmic.exe Token: SeTakeOwnershipPrivilege 5072 wmic.exe Token: SeLoadDriverPrivilege 5072 wmic.exe Token: SeSystemProfilePrivilege 5072 wmic.exe Token: SeSystemtimePrivilege 5072 wmic.exe Token: SeProfSingleProcessPrivilege 5072 wmic.exe Token: SeIncBasePriorityPrivilege 5072 wmic.exe Token: SeCreatePagefilePrivilege 5072 wmic.exe Token: SeBackupPrivilege 5072 wmic.exe Token: SeRestorePrivilege 5072 wmic.exe Token: SeShutdownPrivilege 5072 wmic.exe Token: SeDebugPrivilege 5072 wmic.exe Token: SeSystemEnvironmentPrivilege 5072 wmic.exe Token: SeRemoteShutdownPrivilege 5072 wmic.exe Token: SeUndockPrivilege 5072 wmic.exe Token: SeManageVolumePrivilege 5072 wmic.exe Token: 33 5072 wmic.exe Token: 34 5072 wmic.exe Token: 35 5072 wmic.exe Token: 36 5072 wmic.exe Token: SeDebugPrivilege 4080 tasklist.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4240 wrote to memory of 5072 4240 NitroRansomware.exe 67 PID 4240 wrote to memory of 5072 4240 NitroRansomware.exe 67 PID 4240 wrote to memory of 5072 4240 NitroRansomware.exe 67 PID 4240 wrote to memory of 4080 4240 NitroRansomware.exe 69 PID 4240 wrote to memory of 4080 4240 NitroRansomware.exe 69 PID 4240 wrote to memory of 4080 4240 NitroRansomware.exe 69 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4240 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Windows\SysWOW64\tasklist.exe"tasklist"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4080
-