Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2024 15:28
Static task
static1
Behavioral task
behavioral1
Sample
56d38ab845746b9706c51859e9591765.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
56d38ab845746b9706c51859e9591765.exe
Resource
win10v2004-20231215-en
General
-
Target
56d38ab845746b9706c51859e9591765.exe
-
Size
35KB
-
MD5
56d38ab845746b9706c51859e9591765
-
SHA1
758031a2724e854364887e88dcfccb0fd3645ccd
-
SHA256
1ce72c1b0c2abec8e895a1d97778e12642700a78999f63b02dcd5a6bf5721a9c
-
SHA512
75127a4d5d6ac211c9944fd6fc6910b5123667569e720964645167d478ac5d3b29306996a9f9127753607b02f9e0470714a4a0d3502b6693538f346f9dd3ff1d
-
SSDEEP
768:SqUg8PaEPPHHzYIwiADy557s3zHSYDkb+YEE89fA:SqQPPnzYjiADy55Q+YDkbqE89I
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Renames multiple (78) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 56d38ab845746b9706c51859e9591765.exe -
Executes dropped EXE 1 IoCs
pid Process 5088 NitroRansomware.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomware.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 api.ipify.org 33 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4712 5088 WerFault.exe 90 4788 5088 WerFault.exe 90 -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 4144 PING.EXE 4060 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5088 NitroRansomware.exe 5088 NitroRansomware.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 5088 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 4148 WMIC.exe Token: SeSecurityPrivilege 4148 WMIC.exe Token: SeTakeOwnershipPrivilege 4148 WMIC.exe Token: SeLoadDriverPrivilege 4148 WMIC.exe Token: SeSystemProfilePrivilege 4148 WMIC.exe Token: SeSystemtimePrivilege 4148 WMIC.exe Token: SeProfSingleProcessPrivilege 4148 WMIC.exe Token: SeIncBasePriorityPrivilege 4148 WMIC.exe Token: SeCreatePagefilePrivilege 4148 WMIC.exe Token: SeBackupPrivilege 4148 WMIC.exe Token: SeRestorePrivilege 4148 WMIC.exe Token: SeShutdownPrivilege 4148 WMIC.exe Token: SeDebugPrivilege 4148 WMIC.exe Token: SeSystemEnvironmentPrivilege 4148 WMIC.exe Token: SeRemoteShutdownPrivilege 4148 WMIC.exe Token: SeUndockPrivilege 4148 WMIC.exe Token: SeManageVolumePrivilege 4148 WMIC.exe Token: 33 4148 WMIC.exe Token: 34 4148 WMIC.exe Token: 35 4148 WMIC.exe Token: 36 4148 WMIC.exe Token: SeIncreaseQuotaPrivilege 4148 WMIC.exe Token: SeSecurityPrivilege 4148 WMIC.exe Token: SeTakeOwnershipPrivilege 4148 WMIC.exe Token: SeLoadDriverPrivilege 4148 WMIC.exe Token: SeSystemProfilePrivilege 4148 WMIC.exe Token: SeSystemtimePrivilege 4148 WMIC.exe Token: SeProfSingleProcessPrivilege 4148 WMIC.exe Token: SeIncBasePriorityPrivilege 4148 WMIC.exe Token: SeCreatePagefilePrivilege 4148 WMIC.exe Token: SeBackupPrivilege 4148 WMIC.exe Token: SeRestorePrivilege 4148 WMIC.exe Token: SeShutdownPrivilege 4148 WMIC.exe Token: SeDebugPrivilege 4148 WMIC.exe Token: SeSystemEnvironmentPrivilege 4148 WMIC.exe Token: SeRemoteShutdownPrivilege 4148 WMIC.exe Token: SeUndockPrivilege 4148 WMIC.exe Token: SeManageVolumePrivilege 4148 WMIC.exe Token: 33 4148 WMIC.exe Token: 34 4148 WMIC.exe Token: 35 4148 WMIC.exe Token: 36 4148 WMIC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2884 wrote to memory of 5088 2884 56d38ab845746b9706c51859e9591765.exe 90 PID 2884 wrote to memory of 5088 2884 56d38ab845746b9706c51859e9591765.exe 90 PID 2884 wrote to memory of 5088 2884 56d38ab845746b9706c51859e9591765.exe 90 PID 2884 wrote to memory of 5004 2884 56d38ab845746b9706c51859e9591765.exe 91 PID 2884 wrote to memory of 5004 2884 56d38ab845746b9706c51859e9591765.exe 91 PID 5004 wrote to memory of 4060 5004 cmd.exe 94 PID 5004 wrote to memory of 4060 5004 cmd.exe 94 PID 5004 wrote to memory of 4144 5004 cmd.exe 95 PID 5004 wrote to memory of 4144 5004 cmd.exe 95 PID 5088 wrote to memory of 1016 5088 NitroRansomware.exe 99 PID 5088 wrote to memory of 1016 5088 NitroRansomware.exe 99 PID 5088 wrote to memory of 1016 5088 NitroRansomware.exe 99 PID 1016 wrote to memory of 4148 1016 cmd.exe 100 PID 1016 wrote to memory of 4148 1016 cmd.exe 100 PID 1016 wrote to memory of 4148 1016 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\56d38ab845746b9706c51859e9591765.exe"C:\Users\Admin\AppData\Local\Temp\56d38ab845746b9706c51859e9591765.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 22123⤵
- Program crash
PID:4712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 22123⤵
- Program crash
PID:4788
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\56d38ab845746b9706c51859e9591765.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\56d38ab845746b9706c51859e9591765.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 1003⤵
- Runs ping.exe
PID:4060
-
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 9003⤵
- Runs ping.exe
PID:4144
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5088 -ip 50881⤵PID:1708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5088 -ip 50881⤵PID:3228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD51484a0ecf720d351f8897c2f9b3f5046
SHA18770a72054cc21f07051df2b4c0f7775cc4fa731
SHA256a00d950fbee25d407f79f5d7211cbd1f15d27f89bf5714e44f222c9013f6c131
SHA512136ef22f74ed55859bb143a26b2dbf1f4bb84c267d461e60d44934eb879a9efc4902e05dd386bb4926ea2cc469f8f7efe24ae6d6a4bb45511b4939558b379d97