Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
15/03/2024, 07:34
General
- Target cad7af2b2714b813aa083c5e692cd7ba.exe
- Size 9.0MB
- Sample240315-jelnjsba8x
- SHA256 7eceee2d481d80031eb26f51bd11fbf9671c123107c83b0100b5dbaaf52ec833
Score
10/10
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
- Renames multiple (84) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 41 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad7af2b2714b813aa083c5e692cd7ba.exe"C:\Users\Admin\AppData\Local\Temp\cad7af2b2714b813aa083c5e692cd7ba.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2340-0-0x0000000000E90000-0x0000000000EA6000-memory.dmp
memory/2340-1-0x0000000074800000-0x0000000074EEE000-memory.dmp
memory/2340-2-0x0000000000DC0000-0x0000000000E00000-memory.dmp
memory/2340-55-0x0000000074800000-0x0000000074EEE000-memory.dmp
memory/2340-60-0x0000000000DC0000-0x0000000000E00000-memory.dmp
memory/2340-92-0x0000000000DC0000-0x0000000000E00000-memory.dmp
memory/2340-93-0x0000000000DC0000-0x0000000000E00000-memory.dmp