Analysis
-
max time kernel
60s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2023 00:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomware.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
12 signatures
1800 seconds
General
-
Target
NitroRansomware.exe
-
Size
1.3MB
-
MD5
4d306858073b2a678c7562a3e845a63a
-
SHA1
4c6364886770069508bfdd236f54f246cdf61188
-
SHA256
2c120f921e46cdb14f70e8723338ff34465495bfa3955e3df6972d606b4ed202
-
SHA512
92c85a20ec85010c04c35cc45eca023307968d5b6280391060564113b5e02b7f5e14a751f01b5c31d19d5298f87e24939570dd56b6898520c19de5703795c091
-
SSDEEP
24576:66YGGjodngwtlaHxN8KUWVe6tw2wvKhLnekqjVnlqud+/2P+Ap4:66YG2odngwwHv5VbtHw1kqXfd+/9A
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe -
Disables Task Manager via registry modification
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\ConnectPublish.tiff.lmao NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\ConnectPublish.tiff NitroRansomware.exe File created C:\Users\Admin\Pictures\DebugPublish.tiff.lmao NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\DebugPublish.tiff NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\LimitProtect.tiff NitroRansomware.exe File created C:\Users\Admin\Pictures\LimitProtect.tiff.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\OutGrant.raw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\ProtectTest.crw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\RemoveSkip.raw.lmao NitroRansomware.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NitroRansomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 40 api.ipify.org 41 api.ipify.org -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2920 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4396 NitroRansomware.exe 4396 NitroRansomware.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4396 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 920 wmic.exe Token: SeSecurityPrivilege 920 wmic.exe Token: SeTakeOwnershipPrivilege 920 wmic.exe Token: SeLoadDriverPrivilege 920 wmic.exe Token: SeSystemProfilePrivilege 920 wmic.exe Token: SeSystemtimePrivilege 920 wmic.exe Token: SeProfSingleProcessPrivilege 920 wmic.exe Token: SeIncBasePriorityPrivilege 920 wmic.exe Token: SeCreatePagefilePrivilege 920 wmic.exe Token: SeBackupPrivilege 920 wmic.exe Token: SeRestorePrivilege 920 wmic.exe Token: SeShutdownPrivilege 920 wmic.exe Token: SeDebugPrivilege 920 wmic.exe Token: SeSystemEnvironmentPrivilege 920 wmic.exe Token: SeRemoteShutdownPrivilege 920 wmic.exe Token: SeUndockPrivilege 920 wmic.exe Token: SeManageVolumePrivilege 920 wmic.exe Token: 33 920 wmic.exe Token: 34 920 wmic.exe Token: 35 920 wmic.exe Token: 36 920 wmic.exe Token: SeIncreaseQuotaPrivilege 920 wmic.exe Token: SeSecurityPrivilege 920 wmic.exe Token: SeTakeOwnershipPrivilege 920 wmic.exe Token: SeLoadDriverPrivilege 920 wmic.exe Token: SeSystemProfilePrivilege 920 wmic.exe Token: SeSystemtimePrivilege 920 wmic.exe Token: SeProfSingleProcessPrivilege 920 wmic.exe Token: SeIncBasePriorityPrivilege 920 wmic.exe Token: SeCreatePagefilePrivilege 920 wmic.exe Token: SeBackupPrivilege 920 wmic.exe Token: SeRestorePrivilege 920 wmic.exe Token: SeShutdownPrivilege 920 wmic.exe Token: SeDebugPrivilege 920 wmic.exe Token: SeSystemEnvironmentPrivilege 920 wmic.exe Token: SeRemoteShutdownPrivilege 920 wmic.exe Token: SeUndockPrivilege 920 wmic.exe Token: SeManageVolumePrivilege 920 wmic.exe Token: 33 920 wmic.exe Token: 34 920 wmic.exe Token: 35 920 wmic.exe Token: 36 920 wmic.exe Token: SeDebugPrivilege 2920 tasklist.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4396 wrote to memory of 920 4396 NitroRansomware.exe 89 PID 4396 wrote to memory of 920 4396 NitroRansomware.exe 89 PID 4396 wrote to memory of 920 4396 NitroRansomware.exe 89 PID 4396 wrote to memory of 2920 4396 NitroRansomware.exe 92 PID 4396 wrote to memory of 2920 4396 NitroRansomware.exe 92 PID 4396 wrote to memory of 2920 4396 NitroRansomware.exe 92 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4396 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
C:\Windows\SysWOW64\tasklist.exe"tasklist"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2920
-