Analysis
-
max time kernel
56s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
10-02-2024 19:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Zummyy/discord-token-grabber
Resource
win10v2004-20231222-en
General
-
Target
https://github.com/Zummyy/discord-token-grabber
Malware Config
Extracted
C:\Users\Admin\Downloads\Unconfirmed 253589.crdownload
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Renames multiple (62) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 4836 NitroRansomware.exe 4784 NitroRansomware.exe 4792 NitroRansomware.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroRansomware.exe\"" NitroRansomware.exe -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 80 discord.com 81 discord.com 83 discord.com 84 discord.com 56 raw.githubusercontent.com 57 raw.githubusercontent.com 76 discord.com 79 discord.com 77 discord.com 78 discord.com 82 discord.com 85 discord.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 71 api.ipify.org 72 api.ipify.org 73 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 253589.crdownload:SmartScreen msedge.exe File created C:\Users\Admin\AppData\Local\Temp\NitroRansomware.exe\:SmartScreen:$DATA NitroRansomware.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1628 msedge.exe 1628 msedge.exe 556 msedge.exe 556 msedge.exe 4520 identity_helper.exe 4520 identity_helper.exe 4760 msedge.exe 4760 msedge.exe 4784 NitroRansomware.exe 4784 NitroRansomware.exe 4836 NitroRansomware.exe 4836 NitroRansomware.exe 4784 NitroRansomware.exe 4836 NitroRansomware.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4784 NitroRansomware.exe Token: SeDebugPrivilege 4836 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 2044 WMIC.exe Token: SeSecurityPrivilege 2044 WMIC.exe Token: SeTakeOwnershipPrivilege 2044 WMIC.exe Token: SeLoadDriverPrivilege 2044 WMIC.exe Token: SeSystemProfilePrivilege 2044 WMIC.exe Token: SeSystemtimePrivilege 2044 WMIC.exe Token: SeProfSingleProcessPrivilege 2044 WMIC.exe Token: SeIncBasePriorityPrivilege 2044 WMIC.exe Token: SeCreatePagefilePrivilege 2044 WMIC.exe Token: SeBackupPrivilege 2044 WMIC.exe Token: SeRestorePrivilege 2044 WMIC.exe Token: SeShutdownPrivilege 2044 WMIC.exe Token: SeDebugPrivilege 2044 WMIC.exe Token: SeSystemEnvironmentPrivilege 2044 WMIC.exe Token: SeRemoteShutdownPrivilege 2044 WMIC.exe Token: SeUndockPrivilege 2044 WMIC.exe Token: SeManageVolumePrivilege 2044 WMIC.exe Token: 33 2044 WMIC.exe Token: 34 2044 WMIC.exe Token: 35 2044 WMIC.exe Token: 36 2044 WMIC.exe Token: SeIncreaseQuotaPrivilege 4548 WMIC.exe Token: SeSecurityPrivilege 4548 WMIC.exe Token: SeTakeOwnershipPrivilege 4548 WMIC.exe Token: SeLoadDriverPrivilege 4548 WMIC.exe Token: SeSystemProfilePrivilege 4548 WMIC.exe Token: SeSystemtimePrivilege 4548 WMIC.exe Token: SeProfSingleProcessPrivilege 4548 WMIC.exe Token: SeIncBasePriorityPrivilege 4548 WMIC.exe Token: SeCreatePagefilePrivilege 4548 WMIC.exe Token: SeBackupPrivilege 4548 WMIC.exe Token: SeRestorePrivilege 4548 WMIC.exe Token: SeShutdownPrivilege 4548 WMIC.exe Token: SeDebugPrivilege 4548 WMIC.exe Token: SeSystemEnvironmentPrivilege 4548 WMIC.exe Token: SeRemoteShutdownPrivilege 4548 WMIC.exe Token: SeUndockPrivilege 4548 WMIC.exe Token: SeManageVolumePrivilege 4548 WMIC.exe Token: 33 4548 WMIC.exe Token: 34 4548 WMIC.exe Token: 35 4548 WMIC.exe Token: 36 4548 WMIC.exe Token: SeIncreaseQuotaPrivilege 4548 WMIC.exe Token: SeSecurityPrivilege 4548 WMIC.exe Token: SeTakeOwnershipPrivilege 4548 WMIC.exe Token: SeLoadDriverPrivilege 4548 WMIC.exe Token: SeSystemProfilePrivilege 4548 WMIC.exe Token: SeSystemtimePrivilege 4548 WMIC.exe Token: SeProfSingleProcessPrivilege 4548 WMIC.exe Token: SeIncBasePriorityPrivilege 4548 WMIC.exe Token: SeCreatePagefilePrivilege 4548 WMIC.exe Token: SeBackupPrivilege 4548 WMIC.exe Token: SeRestorePrivilege 4548 WMIC.exe Token: SeShutdownPrivilege 4548 WMIC.exe Token: SeDebugPrivilege 4548 WMIC.exe Token: SeSystemEnvironmentPrivilege 4548 WMIC.exe Token: SeRemoteShutdownPrivilege 4548 WMIC.exe Token: SeUndockPrivilege 4548 WMIC.exe Token: SeManageVolumePrivilege 4548 WMIC.exe Token: 33 4548 WMIC.exe Token: 34 4548 WMIC.exe Token: 35 4548 WMIC.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 556 wrote to memory of 4664 556 msedge.exe 84 PID 556 wrote to memory of 4664 556 msedge.exe 84 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1544 556 msedge.exe 86 PID 556 wrote to memory of 1628 556 msedge.exe 85 PID 556 wrote to memory of 1628 556 msedge.exe 85 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87 PID 556 wrote to memory of 2248 556 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Zummyy/discord-token-grabber1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb0ae46f8,0x7ffcb0ae4708,0x7ffcb0ae47182⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5904 /prefetch:82⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:12⤵PID:1200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6300 /prefetch:82⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:2424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3521007497104189502,15370080786160090720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4760
-
-
C:\Users\Admin\Downloads\NitroRansomware.exe"C:\Users\Admin\Downloads\NitroRansomware.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"3⤵PID:1808
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
-
-
C:\Users\Admin\Downloads\NitroRansomware.exe"C:\Users\Admin\Downloads\NitroRansomware.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"3⤵PID:3352
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
-
-
C:\Users\Admin\Downloads\NitroRansomware.exe"C:\Users\Admin\Downloads\NitroRansomware.exe"2⤵
- Executes dropped EXE
PID:4792
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2508
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c81c2ec1b8be0ab444eedaf2893390ed
SHA1444566609a28efbfed1c21a9a787812945ab04d3
SHA25666e7acc21981c89e9d363178d606d4bed94e9f15e861903c6b94c23b4dc0f876
SHA512ac593a805d22bcbd59ed922f1efd87343f7c03fb9d7b95a5e4a62f35898cd08747a6bade4dae948ee4118a8205ea33d3754a30408d51f642fa1fe847d91469fe
-
Filesize
152B
MD51386433ecc349475d39fb1e4f9e149a0
SHA1f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA256a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
SHA512fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5787516a9356c915f03fe9cace5a260c8
SHA10c7f13bc3257496d87eb74a2ec08af1237f35b1c
SHA256a93bddf6a10f822865bdf251a6925c39efa8264b69c1de4520a3e50c0e27844b
SHA512837bd583035c30a4ac42dff7fcfc13a9e055614fad548c93b2a3d1541551ef931a84df612f9bd4b34ee36a3767c5721a09866aab42482819cd31f7a0c06b7ffe
-
Filesize
5KB
MD54dd95ccd62b25f4b1d6ecfa54bfee685
SHA1634b64090ab79e3d1c9f5ce25aa508119c61a6e0
SHA256a8a4227858620b0b6bc1ddc1f53ef0bfbd3d01f5252468545536a9c254266ce1
SHA512a5a863d2aca5b3a66e6c05d754bf4532575b3b1d2f9ffa44578a52e1cd0687e772a8fc50934d2ef9b2c1e4aa3a4106ce2530ed1b3bfe1da1399cb346fca14abe
-
Filesize
5KB
MD5efd02e9ca379392ca3e2f734c6d06ab6
SHA1786454bf9a7979473ce13698a28f2cb2f4af0d3a
SHA256f7477624c27688a1e7ca56798315f1b5b9c8c9bafa652f96175384fc0f139748
SHA512e03440aa5a1fe2adbe3cba7ed9e55878c2b8243d71e6e7aa602b2ccadf58823a80d62b18c0440533c01ea3f0ce2332f48650e59dabed6cb225e02cf0c74b57ec
-
Filesize
6KB
MD583284348f42bd939ad78b1659f5b6dc6
SHA13543b00bd8b782b759104526718b684e90f8679c
SHA256324434a97172aae4e908131f6a25bceadc97b84971bf30a994ebda05df138030
SHA5127b36ed848c93e2a8e2898e79ea41d8cef428f6ac5aacede6fa5805c827af52539f2b4120de6526a001143145e0e564b45fa1636cb30a4f1061ac7fff1dd8e2a6
-
Filesize
24KB
MD5e664066e3aa135f185ed1c194b9fa1f8
SHA1358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA25686e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
SHA51258710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
-
Filesize
1KB
MD524d552d8c737b502499a855dd0950aac
SHA123337629f1755cfa43390cf0da2fa5a383bef77b
SHA25655666e81ac182271619a1f509a99381128285b1ca0b185d2c58a556acdd49cab
SHA512c7e919711cc7e1338bc0c2d7d3f839ad9769c3379b41d37513b51dbe81c07d26694a7b4646431dd7d458171ba2d338844724f9bb268bbc1c4e3c6743baabc3b9
-
Filesize
874B
MD52312dd8518becd91fc977052b26d6b5e
SHA1aa718e205856eb138f7944d47fb92ea54ca84283
SHA2562813bcf4d590ee190f2db5b17dc648795b2b5e3993870ddf829166fc8c3a11c6
SHA51269c0badbb3bf2bad4e4012dd76e6e35dd9682999b068f1370485022acb3bc34a92936f3f151b12d52f5eb02dcd5cb6984de77e54920b62017998c3137fe53a4e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD593c210f9d6e76974367eb83a89377558
SHA1abab7e94aa19628fabd4fa7fab05a32ab62da0dd
SHA256217af85e0d925029c4e8d0262b41bdfacf781b0967a386b4877dc787e4329349
SHA512ab90ec9e3fa5d9c27d46a5b30e4394b7ba1109f524982fdaf99ba61ca414e1764680ad992f5099a4e05e075bd5f0ca2c476c2ecd368e4688e757bfbb8f28dc23
-
Filesize
10KB
MD53223ea7ca75da24973f00d0fd9669bac
SHA1c9100a4fc34cd4db726e7645b384714fa88160d1
SHA256df0a20ecb7ee49133c206dfa79e59b703333475c00b1164c9bf68527e6758afd
SHA512eda8b09812a5593ec8e861ecf748f6286ce9a01ae177060eda24884f97c20cfe25efde0843e873201d724e8051fef6a2570020cd9db3409cad0b983d0cf393e9
-
Filesize
10KB
MD512546226a7a3fe5c759432019bb4a33f
SHA17814e7dd4cd2763e35af0bf85b1ef11df8b4094b
SHA2568fb15206dceb3696f88aa8212bfc0aa17e772f59ee73bdda835a45c44bdb237e
SHA51222e8b8fb9dca2ee416c2c57cc8571c425a3d9b6aca7a380f58f1e187d37cfc6a62d889433680de4dc5f1f784285ba8e3bed08bb3407f6e374727088d103a18ae
-
Filesize
61KB
MD530fffd9a00691f9864c19e7a35f3f96f
SHA1dda9824f3661340241cfa98a592ad4b676946e2e
SHA256268a0705b818f5e0e113f3c66329bff1466219c011127eb57a6b1dfd6109ca3d
SHA512fc27c6649adc1e788ceed3f53e6dc84aca005b3885692d24cb1fb0f1a2b4f0725f44143addd35f88c1fdeb6729b6222707727e188474e1dc2954d3bf55bfe742