Analysis
-
max time kernel
115s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2023 17:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NitroRansomware.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
17 signatures
1800 seconds
Errors
Reason
Machine shutdown
General
-
Target
NitroRansomware.exe
-
Size
690KB
-
MD5
0aa959049ed181008cd30a818ca4abc1
-
SHA1
9dee42230d2b31eebe14e68c103c7423fcb5de92
-
SHA256
faaac111b93bcfdc0024a28ee3d07a4e1a464d0211cac0eb387dc8542be69048
-
SHA512
90315cdabbfd0826d39cc4ea166cd037a371e72e9068926f8da0c00a9a59d00114b0422c2ecc59527e08e426a7a9d96c2b1a94592995707c58453a39e45fac91
-
SSDEEP
12288:08+ACgkCHHdmg0ByvR4mWWaqMpWTYkmIWXoKOvp5y8HN7CzsXgxx9/06UqU4q:JkamxmWeeWFDuorh57HN7Czswxj/tVO
Score
10/10
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Renames multiple (78) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomware.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 api.ipify.org 12 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 5024 2852 WerFault.exe 83 788 2852 WerFault.exe 83 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "79" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 2852 NitroRansomware.exe 2852 NitroRansomware.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2852 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 1696 WMIC.exe Token: SeSecurityPrivilege 1696 WMIC.exe Token: SeTakeOwnershipPrivilege 1696 WMIC.exe Token: SeLoadDriverPrivilege 1696 WMIC.exe Token: SeSystemProfilePrivilege 1696 WMIC.exe Token: SeSystemtimePrivilege 1696 WMIC.exe Token: SeProfSingleProcessPrivilege 1696 WMIC.exe Token: SeIncBasePriorityPrivilege 1696 WMIC.exe Token: SeCreatePagefilePrivilege 1696 WMIC.exe Token: SeBackupPrivilege 1696 WMIC.exe Token: SeRestorePrivilege 1696 WMIC.exe Token: SeShutdownPrivilege 1696 WMIC.exe Token: SeDebugPrivilege 1696 WMIC.exe Token: SeSystemEnvironmentPrivilege 1696 WMIC.exe Token: SeRemoteShutdownPrivilege 1696 WMIC.exe Token: SeUndockPrivilege 1696 WMIC.exe Token: SeManageVolumePrivilege 1696 WMIC.exe Token: 33 1696 WMIC.exe Token: 34 1696 WMIC.exe Token: 35 1696 WMIC.exe Token: 36 1696 WMIC.exe Token: SeIncreaseQuotaPrivilege 1696 WMIC.exe Token: SeSecurityPrivilege 1696 WMIC.exe Token: SeTakeOwnershipPrivilege 1696 WMIC.exe Token: SeLoadDriverPrivilege 1696 WMIC.exe Token: SeSystemProfilePrivilege 1696 WMIC.exe Token: SeSystemtimePrivilege 1696 WMIC.exe Token: SeProfSingleProcessPrivilege 1696 WMIC.exe Token: SeIncBasePriorityPrivilege 1696 WMIC.exe Token: SeCreatePagefilePrivilege 1696 WMIC.exe Token: SeBackupPrivilege 1696 WMIC.exe Token: SeRestorePrivilege 1696 WMIC.exe Token: SeShutdownPrivilege 1696 WMIC.exe Token: SeDebugPrivilege 1696 WMIC.exe Token: SeSystemEnvironmentPrivilege 1696 WMIC.exe Token: SeRemoteShutdownPrivilege 1696 WMIC.exe Token: SeUndockPrivilege 1696 WMIC.exe Token: SeManageVolumePrivilege 1696 WMIC.exe Token: 33 1696 WMIC.exe Token: 34 1696 WMIC.exe Token: 35 1696 WMIC.exe Token: 36 1696 WMIC.exe Token: SeDebugPrivilege 368 taskmgr.exe Token: SeSystemProfilePrivilege 368 taskmgr.exe Token: SeCreateGlobalPrivilege 368 taskmgr.exe Token: 33 368 taskmgr.exe Token: SeIncBasePriorityPrivilege 368 taskmgr.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe -
Suspicious use of SendNotifyMessage 56 IoCs
pid Process 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe 368 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3188 LogonUI.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2852 wrote to memory of 3752 2852 NitroRansomware.exe 86 PID 2852 wrote to memory of 3752 2852 NitroRansomware.exe 86 PID 2852 wrote to memory of 3752 2852 NitroRansomware.exe 86 PID 3752 wrote to memory of 1696 3752 cmd.exe 89 PID 3752 wrote to memory of 1696 3752 cmd.exe 89 PID 3752 wrote to memory of 1696 3752 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 21202⤵
- Program crash
PID:5024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 21602⤵
- Program crash
PID:788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2852 -ip 28521⤵PID:2796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2852 -ip 28521⤵PID:5096
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:368
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3951055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3188