nitro | 154acc8a3f62a30a3c89c175bac5121019f5c40f6eb2677a2bd29b59e38e623c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NitroGen.exe
Size

335KB
MD5

dafb1f4e1689f2d2225d73bf26eb5da6
SHA1

17edf7a8771fb20d0e9543779915db2d189b42d6
SHA256

154acc8a3f62a30a3c89c175bac5121019f5c40f6eb2677a2bd29b59e38e623c
SHA512

4a1e71feb6946655d08139bfcd4314657e10ccecf8a23556d3b5e52eb1e534c7178f7f0de7c9d70e81e32129329f7062635f4bd053ab01a2e5838cd3c3c4a835
SSDEEP

6144:W5VP9Ge3+hoAvdeJBbLncZc6zyuyGG6RE74AsnAYLk/KTHNS:W5393whFOBbCzyc8rMjtS

Score

10^/10

nitro evasion persistence ransomware spyware stealer

Malware Config

Signatures

Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
ransomware nitro
Renames multiple (86) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.givemenitro	NitroRansomware.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	NitroRansomware.exe

Executes dropped EXE 1 IoCs

pid	Process
2656	NitroRansomware.exe

Loads dropped DLL 1 IoCs

pid	Process
1860	NitroGen.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroGen\\NitroRansomware.exe\""	NitroRansomware.exe

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	NitroRansomware.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	NitroRansomware.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	NitroRansomware.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	NitroRansomware.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NitroRansomware.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	NitroRansomware.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	NitroRansomware.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	NitroRansomware.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	NitroRansomware.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
10	discord.com
11	discord.com
6	discord.com
7	discord.com
8	discord.com
9	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png"	NitroRansomware.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	NitroRansomware.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
2488	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2656	NitroRansomware.exe
2656	NitroRansomware.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	NitroRansomware.exe
Token: SeIncreaseQuotaPrivilege	2836	WMIC.exe
Token: SeSecurityPrivilege	2836	WMIC.exe
Token: SeTakeOwnershipPrivilege	2836	WMIC.exe
Token: SeLoadDriverPrivilege	2836	WMIC.exe
Token: SeSystemProfilePrivilege	2836	WMIC.exe
Token: SeSystemtimePrivilege	2836	WMIC.exe
Token: SeProfSingleProcessPrivilege	2836	WMIC.exe
Token: SeIncBasePriorityPrivilege	2836	WMIC.exe
Token: SeCreatePagefilePrivilege	2836	WMIC.exe
Token: SeBackupPrivilege	2836	WMIC.exe
Token: SeRestorePrivilege	2836	WMIC.exe
Token: SeShutdownPrivilege	2836	WMIC.exe
Token: SeDebugPrivilege	2836	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2836	WMIC.exe
Token: SeRemoteShutdownPrivilege	2836	WMIC.exe
Token: SeUndockPrivilege	2836	WMIC.exe
Token: SeManageVolumePrivilege	2836	WMIC.exe
Token: 33	2836	WMIC.exe
Token: 34	2836	WMIC.exe
Token: 35	2836	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2836	WMIC.exe
Token: SeSecurityPrivilege	2836	WMIC.exe
Token: SeTakeOwnershipPrivilege	2836	WMIC.exe
Token: SeLoadDriverPrivilege	2836	WMIC.exe
Token: SeSystemProfilePrivilege	2836	WMIC.exe
Token: SeSystemtimePrivilege	2836	WMIC.exe
Token: SeProfSingleProcessPrivilege	2836	WMIC.exe
Token: SeIncBasePriorityPrivilege	2836	WMIC.exe
Token: SeCreatePagefilePrivilege	2836	WMIC.exe
Token: SeBackupPrivilege	2836	WMIC.exe
Token: SeRestorePrivilege	2836	WMIC.exe
Token: SeShutdownPrivilege	2836	WMIC.exe
Token: SeDebugPrivilege	2836	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2836	WMIC.exe
Token: SeRemoteShutdownPrivilege	2836	WMIC.exe
Token: SeUndockPrivilege	2836	WMIC.exe
Token: SeManageVolumePrivilege	2836	WMIC.exe
Token: 33	2836	WMIC.exe
Token: 34	2836	WMIC.exe
Token: 35	2836	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	NitroRansomware.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2656	NitroRansomware.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2656	1860	NitroGen.exe	28
PID 1860 wrote to memory of 2656	1860	NitroGen.exe	28
PID 1860 wrote to memory of 2656	1860	NitroGen.exe	28
PID 1860 wrote to memory of 2656	1860	NitroGen.exe	28
PID 2656 wrote to memory of 1648	2656	NitroRansomware.exe	29
PID 2656 wrote to memory of 1648	2656	NitroRansomware.exe	29
PID 2656 wrote to memory of 1648	2656	NitroRansomware.exe	29
PID 2656 wrote to memory of 1648	2656	NitroRansomware.exe	29
PID 2656 wrote to memory of 1648	2656	NitroRansomware.exe	29
PID 2656 wrote to memory of 1648	2656	NitroRansomware.exe	29
PID 2656 wrote to memory of 1648	2656	NitroRansomware.exe	29
PID 2656 wrote to memory of 2752	2656	NitroRansomware.exe	31
PID 2656 wrote to memory of 2752	2656	NitroRansomware.exe	31
PID 2656 wrote to memory of 2752	2656	NitroRansomware.exe	31
PID 2656 wrote to memory of 2752	2656	NitroRansomware.exe	31
PID 1648 wrote to memory of 2488	1648	cmd.exe	33
PID 1648 wrote to memory of 2488	1648	cmd.exe	33
PID 1648 wrote to memory of 2488	1648	cmd.exe	33
PID 1648 wrote to memory of 2488	1648	cmd.exe	33
PID 2752 wrote to memory of 2836	2752	cmd.exe	34
PID 2752 wrote to memory of 2836	2752	cmd.exe	34
PID 2752 wrote to memory of 2836	2752	cmd.exe	34
PID 2752 wrote to memory of 2836	2752	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\NitroGen.exe
"C:\Users\Admin\AppData\Local\Temp\NitroGen.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\NitroGen\NitroRansomware.exe
  "C:\Users\Admin\AppData\Local\Temp\NitroGen\NitroRansomware.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\NitroGen\patch.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s Patch.reg
      4⤵
      Runs .reg file with regedit
      PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NitroGen\NitroRansomware.exe.config

Filesize
184B

MD5
cc46a0995713ba7cb577b4bbbedf83e8

SHA1
6cc50a0e444e33f65d42423195ed045a3a55daf8

SHA256
5fe1ad802f68d7c47dbbd8e60162ba88abaed162da5d381c85d3e4935311962e

SHA512
36f5b3acbc520504cfe56e5fe19de2a22ae3d2ddddb4c0eb3e441f884033077fb411e69976c3e250c3ef01189d0e48016bde67a73a0dbc950dd5d8ec7783fd2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\NitroGen\Patch.reg

Filesize
310B

MD5
ea2cb363e38635a29fc698b78d59019d

SHA1
7b2fd924efcf1595e8fccae40b6137a7c63506d6

SHA256
0af6a21526ab47e7d53dbab649602e64bb5f2dafa27d9cc200572e6dbe22a030

SHA512
5a525f264a915062def515f58e20d0c539b0f9ccd5d40585e074e2e7ae37f0d8205d40db278f7cbd98d61d816dcc9450d4d7084483602eb5b7d9c9a8bfa5551e

Download Submit
C:\Users\Admin\AppData\Local\Temp\NitroGen\patch.bat

Filesize
37B

MD5
0a026d1d64eb8576241e8c4cfa642dc1

SHA1
26ae22c596114300041c676e27393f2bc5c1bc6c

SHA256
9a2c5d55b344f88a35839c62f2dd4a58b8d17a027892947f137f52ec13cba422

SHA512
d9100a8e0cca6c85d24fbe7b064fda68cae88e45e31df2bc21cb4d0a6b3694a50011db0da3eb4f9288557d278eb1b6b824213d73611601f429dd8eafc2d48e96

Download Submit
\Users\Admin\AppData\Local\Temp\NitroGen\NitroRansomware.exe

Filesize
285KB

MD5
84f3e8dc3f19e03950598b7005774ada

SHA1
865be991b10c71182f56e30e24ca75a5ca111ec7

SHA256
907b0951967bba240caa38494f1607e3e3acf3ff9557efd1d292a9bc12e199b9

SHA512
723f3166380bfd9aee957998b8acf6f0f8f17ef8284184df606836e769c0f7c1aac6c1bd860b35c49b11145e905889d75917fd69def415c07425007f181713bf

Download Submit
memory/2656-20-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download
memory/2656-22-0x0000000000BF0000-0x0000000000C3C000-memory.dmp

Filesize
304KB

Download
memory/2656-69-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download