Analysis
-
max time kernel
31s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
05-07-2023 11:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomwareexe.exe
Resource
win7-20230703-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
NitroRansomwareexe.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
NitroRansomwareexe.exe
-
Size
1.7MB
-
MD5
4c76a86d5ae0b97c0aeb685ef0669b2e
-
SHA1
f82d664141c1aca3942f939491e36ed4d86e0167
-
SHA256
60727ce041da619eb4071fcf13de92d9f8ea9f21741782e3ead14117a63cc5b3
-
SHA512
c41cfe498dc52a5810836a91842b3632af9831747d9bfd6cf7dbdd9301e330f88592f78cdf8e4473fdd38bd0c974c306775f93a77e21bbd809ee36675626f350
-
SSDEEP
49152:UowYGwfZPnlXMTdngwwHv5VbtHw1kqXfd+/9AE:UoVDZdcNgNhVRw1kqXf0F
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomwareexe.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts NitroRansomwareexe.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomwareexe.exe\"" NitroRansomwareexe.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NitroRansomwareexe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomwareexe.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org -
Program crash 1 IoCs
pid pid_target Process procid_target 2940 2344 WerFault.exe 27 -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2176 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2344 NitroRansomwareexe.exe 2344 NitroRansomwareexe.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 2344 NitroRansomwareexe.exe Token: SeIncreaseQuotaPrivilege 2180 wmic.exe Token: SeSecurityPrivilege 2180 wmic.exe Token: SeTakeOwnershipPrivilege 2180 wmic.exe Token: SeLoadDriverPrivilege 2180 wmic.exe Token: SeSystemProfilePrivilege 2180 wmic.exe Token: SeSystemtimePrivilege 2180 wmic.exe Token: SeProfSingleProcessPrivilege 2180 wmic.exe Token: SeIncBasePriorityPrivilege 2180 wmic.exe Token: SeCreatePagefilePrivilege 2180 wmic.exe Token: SeBackupPrivilege 2180 wmic.exe Token: SeRestorePrivilege 2180 wmic.exe Token: SeShutdownPrivilege 2180 wmic.exe Token: SeDebugPrivilege 2180 wmic.exe Token: SeSystemEnvironmentPrivilege 2180 wmic.exe Token: SeRemoteShutdownPrivilege 2180 wmic.exe Token: SeUndockPrivilege 2180 wmic.exe Token: SeManageVolumePrivilege 2180 wmic.exe Token: 33 2180 wmic.exe Token: 34 2180 wmic.exe Token: 35 2180 wmic.exe Token: SeIncreaseQuotaPrivilege 2180 wmic.exe Token: SeSecurityPrivilege 2180 wmic.exe Token: SeTakeOwnershipPrivilege 2180 wmic.exe Token: SeLoadDriverPrivilege 2180 wmic.exe Token: SeSystemProfilePrivilege 2180 wmic.exe Token: SeSystemtimePrivilege 2180 wmic.exe Token: SeProfSingleProcessPrivilege 2180 wmic.exe Token: SeIncBasePriorityPrivilege 2180 wmic.exe Token: SeCreatePagefilePrivilege 2180 wmic.exe Token: SeBackupPrivilege 2180 wmic.exe Token: SeRestorePrivilege 2180 wmic.exe Token: SeShutdownPrivilege 2180 wmic.exe Token: SeDebugPrivilege 2180 wmic.exe Token: SeSystemEnvironmentPrivilege 2180 wmic.exe Token: SeRemoteShutdownPrivilege 2180 wmic.exe Token: SeUndockPrivilege 2180 wmic.exe Token: SeManageVolumePrivilege 2180 wmic.exe Token: 33 2180 wmic.exe Token: 34 2180 wmic.exe Token: 35 2180 wmic.exe Token: SeDebugPrivilege 2176 tasklist.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2180 2344 NitroRansomwareexe.exe 29 PID 2344 wrote to memory of 2180 2344 NitroRansomwareexe.exe 29 PID 2344 wrote to memory of 2180 2344 NitroRansomwareexe.exe 29 PID 2344 wrote to memory of 2180 2344 NitroRansomwareexe.exe 29 PID 2344 wrote to memory of 2176 2344 NitroRansomwareexe.exe 31 PID 2344 wrote to memory of 2176 2344 NitroRansomwareexe.exe 31 PID 2344 wrote to memory of 2176 2344 NitroRansomwareexe.exe 31 PID 2344 wrote to memory of 2176 2344 NitroRansomwareexe.exe 31 PID 2344 wrote to memory of 2940 2344 NitroRansomwareexe.exe 33 PID 2344 wrote to memory of 2940 2344 NitroRansomwareexe.exe 33 PID 2344 wrote to memory of 2940 2344 NitroRansomwareexe.exe 33 PID 2344 wrote to memory of 2940 2344 NitroRansomwareexe.exe 33 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomwareexe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomwareexe.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomwareexe.exe"1⤵
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2344 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\SysWOW64\tasklist.exe"tasklist"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 14682⤵
- Program crash
PID:2940
-