Analysis
-
max time kernel
1795s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2023 17:30
Static task
static1
Behavioral task
behavioral1
Sample
W-DAX-main/D WAX.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
W-DAX-main/D WAX.exe
Resource
win10-20231023-en
Behavioral task
behavioral3
Sample
W-DAX-main/D WAX.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral4
Sample
W-DAX-main/D WAX.exe
Resource
win11-20231129-en
General
-
Target
W-DAX-main/D WAX.exe
-
Size
220KB
-
MD5
72b51e28589fbeac9400380dddedb79a
-
SHA1
4d14ab35e4425a8b1b1b655c2178b0ea2522e7f0
-
SHA256
6ca01f81cc92345981212659aa05d5595a45e96a1f4a6f8678d21f1d24c96aa0
-
SHA512
31cdc53b75d92b258ff5c160224e6212228d5ab42d5ed6b7e976439c0bd97cf444687079b95810e88c3ef36aa9670e4089578cf102baa37cc2f91d1dbe658cca
-
SSDEEP
6144:w9/COjX6BAs8WN7wwZV/pt2qFnM/pte63AX:wVvXK8WNzfptHEptpM
Malware Config
Extracted
xworm
3.0
16.ip.gl.ply.gg:59539
-
Install_directory
%AppData%
-
install_file
USB.exe
Extracted
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe
Signatures
-
Detect Xworm Payload 4 IoCs
Processes:
resource yara_rule behavioral3/files/0x0007000000023121-7.dat family_xworm behavioral3/files/0x0007000000023121-20.dat family_xworm behavioral3/files/0x0007000000023121-21.dat family_xworm behavioral3/memory/4304-26-0x0000000000F30000-0x0000000000F50000-memory.dmp family_xworm -
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Renames multiple (95) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
D WAX.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Control Panel\International\Geo\Nation D WAX.exe -
Drops startup file 2 IoCs
Processes:
SECURITY AVAST.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SECURITY AVAST.lnk SECURITY AVAST.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SECURITY AVAST.lnk SECURITY AVAST.exe -
Executes dropped EXE 2 IoCs
Processes:
SECURITY AVAST.exeNitroRansomware.exepid Process 4304 SECURITY AVAST.exe 1400 NitroRansomware.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
D WAX.exeNitroRansomware.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SECURITY AVAST = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SECURITY AVAST.exe" D WAX.exe Set value (str) \REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
Drops desktop.ini file(s) 5 IoCs
Processes:
NitroRansomware.exedescription ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomware.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
NitroRansomware.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 3188 1400 WerFault.exe 88 2624 1400 WerFault.exe 88 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
NitroRansomware.exepid Process 1400 NitroRansomware.exe 1400 NitroRansomware.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
SECURITY AVAST.exeNitroRansomware.exeWMIC.exedescription pid Process Token: SeDebugPrivilege 4304 SECURITY AVAST.exe Token: SeDebugPrivilege 1400 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 3948 WMIC.exe Token: SeSecurityPrivilege 3948 WMIC.exe Token: SeTakeOwnershipPrivilege 3948 WMIC.exe Token: SeLoadDriverPrivilege 3948 WMIC.exe Token: SeSystemProfilePrivilege 3948 WMIC.exe Token: SeSystemtimePrivilege 3948 WMIC.exe Token: SeProfSingleProcessPrivilege 3948 WMIC.exe Token: SeIncBasePriorityPrivilege 3948 WMIC.exe Token: SeCreatePagefilePrivilege 3948 WMIC.exe Token: SeBackupPrivilege 3948 WMIC.exe Token: SeRestorePrivilege 3948 WMIC.exe Token: SeShutdownPrivilege 3948 WMIC.exe Token: SeDebugPrivilege 3948 WMIC.exe Token: SeSystemEnvironmentPrivilege 3948 WMIC.exe Token: SeRemoteShutdownPrivilege 3948 WMIC.exe Token: SeUndockPrivilege 3948 WMIC.exe Token: SeManageVolumePrivilege 3948 WMIC.exe Token: 33 3948 WMIC.exe Token: 34 3948 WMIC.exe Token: 35 3948 WMIC.exe Token: 36 3948 WMIC.exe Token: SeIncreaseQuotaPrivilege 3948 WMIC.exe Token: SeSecurityPrivilege 3948 WMIC.exe Token: SeTakeOwnershipPrivilege 3948 WMIC.exe Token: SeLoadDriverPrivilege 3948 WMIC.exe Token: SeSystemProfilePrivilege 3948 WMIC.exe Token: SeSystemtimePrivilege 3948 WMIC.exe Token: SeProfSingleProcessPrivilege 3948 WMIC.exe Token: SeIncBasePriorityPrivilege 3948 WMIC.exe Token: SeCreatePagefilePrivilege 3948 WMIC.exe Token: SeBackupPrivilege 3948 WMIC.exe Token: SeRestorePrivilege 3948 WMIC.exe Token: SeShutdownPrivilege 3948 WMIC.exe Token: SeDebugPrivilege 3948 WMIC.exe Token: SeSystemEnvironmentPrivilege 3948 WMIC.exe Token: SeRemoteShutdownPrivilege 3948 WMIC.exe Token: SeUndockPrivilege 3948 WMIC.exe Token: SeManageVolumePrivilege 3948 WMIC.exe Token: 33 3948 WMIC.exe Token: 34 3948 WMIC.exe Token: 35 3948 WMIC.exe Token: 36 3948 WMIC.exe Token: SeDebugPrivilege 4304 SECURITY AVAST.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
D WAX.exeNitroRansomware.execmd.exedescription pid Process procid_target PID 1244 wrote to memory of 4304 1244 D WAX.exe 87 PID 1244 wrote to memory of 4304 1244 D WAX.exe 87 PID 1244 wrote to memory of 1400 1244 D WAX.exe 88 PID 1244 wrote to memory of 1400 1244 D WAX.exe 88 PID 1244 wrote to memory of 1400 1244 D WAX.exe 88 PID 1400 wrote to memory of 1464 1400 NitroRansomware.exe 90 PID 1400 wrote to memory of 1464 1400 NitroRansomware.exe 90 PID 1400 wrote to memory of 1464 1400 NitroRansomware.exe 90 PID 1464 wrote to memory of 3948 1464 cmd.exe 91 PID 1464 wrote to memory of 3948 1464 cmd.exe 91 PID 1464 wrote to memory of 3948 1464 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\W-DAX-main\D WAX.exe"C:\Users\Admin\AppData\Local\Temp\W-DAX-main\D WAX.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\SECURITY AVAST.exe"C:\Users\Admin\AppData\Local\Temp\SECURITY AVAST.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 10283⤵
- Program crash
PID:3188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 17323⤵
- Program crash
PID:2624
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1400 -ip 14001⤵PID:4296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1400 -ip 14001⤵PID:4380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD59d45fedb0c67a1c04a89edb3ee707d44
SHA17773d0e37a0c478191f11e57b338a7a780001a3a
SHA2567019f42701a888986b9dda599f0e8a6d21a762d409f539a05345778e39de7865
SHA51288f99051e5023846d6cb1886031e6f390ac8c04b4f60ba1433edadb3239d23b8a817e20b06d6135a700b85d23ce8885714a8349d2f1c980a93b55a638262c7d6
-
Filesize
106KB
MD59d45fedb0c67a1c04a89edb3ee707d44
SHA17773d0e37a0c478191f11e57b338a7a780001a3a
SHA2567019f42701a888986b9dda599f0e8a6d21a762d409f539a05345778e39de7865
SHA51288f99051e5023846d6cb1886031e6f390ac8c04b4f60ba1433edadb3239d23b8a817e20b06d6135a700b85d23ce8885714a8349d2f1c980a93b55a638262c7d6
-
Filesize
106KB
MD59d45fedb0c67a1c04a89edb3ee707d44
SHA17773d0e37a0c478191f11e57b338a7a780001a3a
SHA2567019f42701a888986b9dda599f0e8a6d21a762d409f539a05345778e39de7865
SHA51288f99051e5023846d6cb1886031e6f390ac8c04b4f60ba1433edadb3239d23b8a817e20b06d6135a700b85d23ce8885714a8349d2f1c980a93b55a638262c7d6
-
Filesize
104KB
MD5cceba0ca8ed89f7c181bcfbbd934c591
SHA12166e325c5a65d751547e0a5b53f66e341e6ba40
SHA2562f8785ef55401b2a906b9bc6a4d995bb58084c12577d39dae5a32d49525ae629
SHA512c56d0716db3df6d657f199b3e879cb09ebc7cccef5a722ad651ee4c44e019ca7bd62f5954af6404ec235f53afe9f248300619c99e7bf0e4ba3a8d5f4180f0262
-
Filesize
104KB
MD5cceba0ca8ed89f7c181bcfbbd934c591
SHA12166e325c5a65d751547e0a5b53f66e341e6ba40
SHA2562f8785ef55401b2a906b9bc6a4d995bb58084c12577d39dae5a32d49525ae629
SHA512c56d0716db3df6d657f199b3e879cb09ebc7cccef5a722ad651ee4c44e019ca7bd62f5954af6404ec235f53afe9f248300619c99e7bf0e4ba3a8d5f4180f0262
-
Filesize
104KB
MD5cceba0ca8ed89f7c181bcfbbd934c591
SHA12166e325c5a65d751547e0a5b53f66e341e6ba40
SHA2562f8785ef55401b2a906b9bc6a4d995bb58084c12577d39dae5a32d49525ae629
SHA512c56d0716db3df6d657f199b3e879cb09ebc7cccef5a722ad651ee4c44e019ca7bd62f5954af6404ec235f53afe9f248300619c99e7bf0e4ba3a8d5f4180f0262