Analysis
-
max time kernel
106s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2023 17:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomware.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
15 signatures
1800 seconds
General
-
Target
NitroRansomware.exe
-
Size
690KB
-
MD5
70e4e301109564dc54617ac74edb4770
-
SHA1
26e1c6ce39150bb6aeb8473e5c2438ffd7190537
-
SHA256
402ee7839d85633b339e4c03aa4baeac4a2a6bc5338d20b3ced3d6314c1cec0c
-
SHA512
018f2354783579a102c216db38aa4b1220d6072337dbc377c6bb9a8f284672efdfb654465a821de3f0f0c3ad801f79ecd97e09f718a336fce79abcb5cbaf2b3a
-
SSDEEP
12288:H4+ACgkCHHdmg0ByvR4mWWaqMpWTYkmIWXoKOvp5y8HN7CzsXgxx9/06UqU4q:IkamxmWeeWFDuorh57HN7Czswxj/tVO
Score
10/10
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Renames multiple (65) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org 7 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 3932 2612 WerFault.exe 82 3028 2612 WerFault.exe 82 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2612 NitroRansomware.exe 2612 NitroRansomware.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2612 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 3840 WMIC.exe Token: SeSecurityPrivilege 3840 WMIC.exe Token: SeTakeOwnershipPrivilege 3840 WMIC.exe Token: SeLoadDriverPrivilege 3840 WMIC.exe Token: SeSystemProfilePrivilege 3840 WMIC.exe Token: SeSystemtimePrivilege 3840 WMIC.exe Token: SeProfSingleProcessPrivilege 3840 WMIC.exe Token: SeIncBasePriorityPrivilege 3840 WMIC.exe Token: SeCreatePagefilePrivilege 3840 WMIC.exe Token: SeBackupPrivilege 3840 WMIC.exe Token: SeRestorePrivilege 3840 WMIC.exe Token: SeShutdownPrivilege 3840 WMIC.exe Token: SeDebugPrivilege 3840 WMIC.exe Token: SeSystemEnvironmentPrivilege 3840 WMIC.exe Token: SeRemoteShutdownPrivilege 3840 WMIC.exe Token: SeUndockPrivilege 3840 WMIC.exe Token: SeManageVolumePrivilege 3840 WMIC.exe Token: 33 3840 WMIC.exe Token: 34 3840 WMIC.exe Token: 35 3840 WMIC.exe Token: 36 3840 WMIC.exe Token: SeIncreaseQuotaPrivilege 3840 WMIC.exe Token: SeSecurityPrivilege 3840 WMIC.exe Token: SeTakeOwnershipPrivilege 3840 WMIC.exe Token: SeLoadDriverPrivilege 3840 WMIC.exe Token: SeSystemProfilePrivilege 3840 WMIC.exe Token: SeSystemtimePrivilege 3840 WMIC.exe Token: SeProfSingleProcessPrivilege 3840 WMIC.exe Token: SeIncBasePriorityPrivilege 3840 WMIC.exe Token: SeCreatePagefilePrivilege 3840 WMIC.exe Token: SeBackupPrivilege 3840 WMIC.exe Token: SeRestorePrivilege 3840 WMIC.exe Token: SeShutdownPrivilege 3840 WMIC.exe Token: SeDebugPrivilege 3840 WMIC.exe Token: SeSystemEnvironmentPrivilege 3840 WMIC.exe Token: SeRemoteShutdownPrivilege 3840 WMIC.exe Token: SeUndockPrivilege 3840 WMIC.exe Token: SeManageVolumePrivilege 3840 WMIC.exe Token: 33 3840 WMIC.exe Token: 34 3840 WMIC.exe Token: 35 3840 WMIC.exe Token: 36 3840 WMIC.exe Token: SeDebugPrivilege 1320 taskmgr.exe Token: SeSystemProfilePrivilege 1320 taskmgr.exe Token: SeCreateGlobalPrivilege 1320 taskmgr.exe Token: 33 1320 taskmgr.exe Token: SeIncBasePriorityPrivilege 1320 taskmgr.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe -
Suspicious use of SendNotifyMessage 36 IoCs
pid Process 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe 1320 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2612 wrote to memory of 3016 2612 NitroRansomware.exe 86 PID 2612 wrote to memory of 3016 2612 NitroRansomware.exe 86 PID 2612 wrote to memory of 3016 2612 NitroRansomware.exe 86 PID 3016 wrote to memory of 3840 3016 cmd.exe 88 PID 3016 wrote to memory of 3840 3016 cmd.exe 88 PID 3016 wrote to memory of 3840 3016 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 23162⤵
- Program crash
PID:3932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 23162⤵
- Program crash
PID:3028
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2612 -ip 26121⤵PID:4656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 2612 -ip 26121⤵PID:3228