Analysis
- max time kernel
142s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
05/07/2023, 11:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomwareexe.exe
Resource
win7-20230703-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
NitroRansomwareexe.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target NitroRansomwareexe.exe
- Size 1.7MB
- Sample230705-nv8kgaca22
- SHA256 60727ce041da619eb4071fcf13de92d9f8ea9f21741782e3ead14117a63cc5b3
- MD5 4c76a86d5ae0b97c0aeb685ef0669b2e
- SHA1 f82d664141c1aca3942f939491e36ed4d86e0167
- SHA512 c41cfe498dc52a5810836a91842b3632af9831747d9bfd6cf7dbdd9301e330f88592f78cdf8e4473fdd38bd0c974c306775f93a77e21bbd809ee36675626f350
- SSDEEP 49152:UowYGwfZPnlXMTdngwwHv5VbtHw1kqXfd+/9AE:UoVDZdcNgNhVRw1kqXf0F
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomwareexe.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts NitroRansomwareexe.exe - Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\StartEdit.tiff.lmao NitroRansomwareexe.exe File opened for modification C:\Users\Admin\Pictures\StartEdit.tiff NitroRansomwareexe.exe File created C:\Users\Admin\Pictures\StartOptimize.crw.lmao NitroRansomwareexe.exe File created C:\Users\Admin\Pictures\ClearGrant.tif.lmao NitroRansomwareexe.exe File created C:\Users\Admin\Pictures\ConvertReset.tif.lmao NitroRansomwareexe.exe File created C:\Users\Admin\Pictures\ConvertToSwitch.raw.lmao NitroRansomwareexe.exe File created C:\Users\Admin\Pictures\FindOptimize.png.lmao NitroRansomwareexe.exe File created C:\Users\Admin\Pictures\SendFind.tif.lmao NitroRansomwareexe.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomwareexe.exe\"" NitroRansomwareexe.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NitroRansomwareexe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomwareexe.exe - Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomwareexe.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomwareexe.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomwareexe.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomwareexe.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomwareexe.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 31 api.ipify.org 32 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomwareexe.exe - Program crash 2 IoCs
pid pid_target Process procid_target 4696 1332 WerFault.exe 84 4436 1332 WerFault.exe 84 - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1700 tasklist.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1332 NitroRansomwareexe.exe 1332 NitroRansomwareexe.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 1332 NitroRansomwareexe.exe Token: SeIncreaseQuotaPrivilege 4692 wmic.exe Token: SeSecurityPrivilege 4692 wmic.exe Token: SeTakeOwnershipPrivilege 4692 wmic.exe Token: SeLoadDriverPrivilege 4692 wmic.exe Token: SeSystemProfilePrivilege 4692 wmic.exe Token: SeSystemtimePrivilege 4692 wmic.exe Token: SeProfSingleProcessPrivilege 4692 wmic.exe Token: SeIncBasePriorityPrivilege 4692 wmic.exe Token: SeCreatePagefilePrivilege 4692 wmic.exe Token: SeBackupPrivilege 4692 wmic.exe Token: SeRestorePrivilege 4692 wmic.exe Token: SeShutdownPrivilege 4692 wmic.exe Token: SeDebugPrivilege 4692 wmic.exe Token: SeSystemEnvironmentPrivilege 4692 wmic.exe Token: SeRemoteShutdownPrivilege 4692 wmic.exe Token: SeUndockPrivilege 4692 wmic.exe Token: SeManageVolumePrivilege 4692 wmic.exe Token: 33 4692 wmic.exe Token: 34 4692 wmic.exe Token: 35 4692 wmic.exe Token: 36 4692 wmic.exe Token: SeIncreaseQuotaPrivilege 4692 wmic.exe Token: SeSecurityPrivilege 4692 wmic.exe Token: SeTakeOwnershipPrivilege 4692 wmic.exe Token: SeLoadDriverPrivilege 4692 wmic.exe Token: SeSystemProfilePrivilege 4692 wmic.exe Token: SeSystemtimePrivilege 4692 wmic.exe Token: SeProfSingleProcessPrivilege 4692 wmic.exe Token: SeIncBasePriorityPrivilege 4692 wmic.exe Token: SeCreatePagefilePrivilege 4692 wmic.exe Token: SeBackupPrivilege 4692 wmic.exe Token: SeRestorePrivilege 4692 wmic.exe Token: SeShutdownPrivilege 4692 wmic.exe Token: SeDebugPrivilege 4692 wmic.exe Token: SeSystemEnvironmentPrivilege 4692 wmic.exe Token: SeRemoteShutdownPrivilege 4692 wmic.exe Token: SeUndockPrivilege 4692 wmic.exe Token: SeManageVolumePrivilege 4692 wmic.exe Token: 33 4692 wmic.exe Token: 34 4692 wmic.exe Token: 35 4692 wmic.exe Token: 36 4692 wmic.exe Token: SeDebugPrivilege 1700 tasklist.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1332 wrote to memory of 4692 1332 NitroRansomwareexe.exe 88 PID 1332 wrote to memory of 4692 1332 NitroRansomwareexe.exe 88 PID 1332 wrote to memory of 4692 1332 NitroRansomwareexe.exe 88 PID 1332 wrote to memory of 1700 1332 NitroRansomwareexe.exe 90 PID 1332 wrote to memory of 1700 1332 NitroRansomwareexe.exe 90 PID 1332 wrote to memory of 1700 1332 NitroRansomwareexe.exe 90 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NitroRansomwareexe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomwareexe.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomwareexe.exe"1⤵
- UAC bypass
- Drops file in Drivers directory
- Modifies extensions of user files
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1332 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Windows\SysWOW64\tasklist.exe"tasklist"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 23562⤵
- Program crash
PID:4696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 23562⤵
- Program crash
PID:4436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1332 -ip 13321⤵PID:1868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1332 -ip 13321⤵PID:3328