Analysis
- max time kernel
261s - max time network
323s - platform
windows10-2004_x64 - resource
win10v2004-20230621-en - resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system - submitted
03/07/2023, 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomware.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
15 signatures
1800 seconds
General
- Target NitroRansomware.exe
- Size 1.3MB
- Sample230703-btm6xsec55
- SHA256 499a7b4ac1d0a8492c824d6d0ae6332440d23fe1cbb94cce9c46dd31b69c5e9b
- MD5 b22fc12931613892b91226393a8b4223
- SHA1 aa0623f250393cff21a47e814ef69d53e7ac3e06
- SHA512 819d126d0394a826b92cdfd21e9c4eb12acc44932c988bc576e9d0db033ee7405b96603f64be0e58dbe4c121aee8896687718bc57e8c06f5b1326d4a41ba441e
- SSDEEP 24576:ZoYGGwodngwtlaHxN8KUWVe6tw2wvKhLnekqjVnlqud+/2P+Air:ZoYGjodngwwHv5VbtHw1kqXfd+/9A
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe - Disables Task Manager via registry modification
- Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\MergeLimit.tiff NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\SaveEnable.tiff NitroRansomware.exe File created C:\Users\Admin\Pictures\UnpublishMount.tiff.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\AssertRedo.crw.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\ConfirmSkip.tiff.lmao NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\ConfirmSkip.tiff NitroRansomware.exe File created C:\Users\Admin\Pictures\MergeLimit.tiff.lmao NitroRansomware.exe File created C:\Users\Admin\Pictures\SaveEnable.tiff.lmao NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\UnpublishMount.tiff NitroRansomware.exe File created C:\Users\Admin\Pictures\WatchRegister.crw.lmao NitroRansomware.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NitroRansomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe - Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 28 api.ipify.org 29 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe - Program crash 2 IoCs
pid pid_target Process procid_target 2404 3700 WerFault.exe 79 5024 3700 WerFault.exe 79 - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 5068 tasklist.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3700 NitroRansomware.exe 3700 NitroRansomware.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 3700 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 664 wmic.exe Token: SeSecurityPrivilege 664 wmic.exe Token: SeTakeOwnershipPrivilege 664 wmic.exe Token: SeLoadDriverPrivilege 664 wmic.exe Token: SeSystemProfilePrivilege 664 wmic.exe Token: SeSystemtimePrivilege 664 wmic.exe Token: SeProfSingleProcessPrivilege 664 wmic.exe Token: SeIncBasePriorityPrivilege 664 wmic.exe Token: SeCreatePagefilePrivilege 664 wmic.exe Token: SeBackupPrivilege 664 wmic.exe Token: SeRestorePrivilege 664 wmic.exe Token: SeShutdownPrivilege 664 wmic.exe Token: SeDebugPrivilege 664 wmic.exe Token: SeSystemEnvironmentPrivilege 664 wmic.exe Token: SeRemoteShutdownPrivilege 664 wmic.exe Token: SeUndockPrivilege 664 wmic.exe Token: SeManageVolumePrivilege 664 wmic.exe Token: 33 664 wmic.exe Token: 34 664 wmic.exe Token: 35 664 wmic.exe Token: 36 664 wmic.exe Token: SeIncreaseQuotaPrivilege 664 wmic.exe Token: SeSecurityPrivilege 664 wmic.exe Token: SeTakeOwnershipPrivilege 664 wmic.exe Token: SeLoadDriverPrivilege 664 wmic.exe Token: SeSystemProfilePrivilege 664 wmic.exe Token: SeSystemtimePrivilege 664 wmic.exe Token: SeProfSingleProcessPrivilege 664 wmic.exe Token: SeIncBasePriorityPrivilege 664 wmic.exe Token: SeCreatePagefilePrivilege 664 wmic.exe Token: SeBackupPrivilege 664 wmic.exe Token: SeRestorePrivilege 664 wmic.exe Token: SeShutdownPrivilege 664 wmic.exe Token: SeDebugPrivilege 664 wmic.exe Token: SeSystemEnvironmentPrivilege 664 wmic.exe Token: SeRemoteShutdownPrivilege 664 wmic.exe Token: SeUndockPrivilege 664 wmic.exe Token: SeManageVolumePrivilege 664 wmic.exe Token: 33 664 wmic.exe Token: 34 664 wmic.exe Token: 35 664 wmic.exe Token: 36 664 wmic.exe Token: SeDebugPrivilege 5068 tasklist.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3700 wrote to memory of 664 3700 NitroRansomware.exe 81 PID 3700 wrote to memory of 664 3700 NitroRansomware.exe 81 PID 3700 wrote to memory of 664 3700 NitroRansomware.exe 81 PID 3700 wrote to memory of 5068 3700 NitroRansomware.exe 83 PID 3700 wrote to memory of 5068 3700 NitroRansomware.exe 83 PID 3700 wrote to memory of 5068 3700 NitroRansomware.exe 83 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3700 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:664
-
-
C:\Windows\SysWOW64\tasklist.exe"tasklist"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 23162⤵
- Program crash
PID:2404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 23162⤵
- Program crash
PID:5024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3700 -ip 37001⤵PID:4632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3700 -ip 37001⤵PID:3252