Analysis
-
max time kernel
132s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 16:48
Static task
static1
Behavioral task
behavioral1
Sample
NitroGen.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
NitroGen.exe
Resource
win10v2004-20240508-en
General
-
Target
NitroGen.exe
-
Size
335KB
-
MD5
dafb1f4e1689f2d2225d73bf26eb5da6
-
SHA1
17edf7a8771fb20d0e9543779915db2d189b42d6
-
SHA256
154acc8a3f62a30a3c89c175bac5121019f5c40f6eb2677a2bd29b59e38e623c
-
SHA512
4a1e71feb6946655d08139bfcd4314657e10ccecf8a23556d3b5e52eb1e534c7178f7f0de7c9d70e81e32129329f7062635f4bd053ab01a2e5838cd3c3c4a835
-
SSDEEP
6144:W5VP9Ge3+hoAvdeJBbLncZc6zyuyGG6RE74AsnAYLk/KTHNS:W5393whFOBbCzyc8rMjtS
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\NitroGen\NitroRansomware.exe
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Renames multiple (99) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation NitroGen.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation NitroRansomware.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.givemenitro NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini NitroRansomware.exe -
Executes dropped EXE 1 IoCs
pid Process 4044 NitroRansomware.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroGen\\NitroRansomware.exe\"" NitroRansomware.exe -
Drops desktop.ini file(s) 11 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini NitroRansomware.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
flow ioc 11 discord.com 12 discord.com 15 discord.com 21 discord.com 24 discord.com 54 discord.com 59 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 api.ipify.org 8 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs .reg file with regedit 1 IoCs
pid Process 3240 regedit.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4044 NitroRansomware.exe 4044 NitroRansomware.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4044 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 3244 WMIC.exe Token: SeSecurityPrivilege 3244 WMIC.exe Token: SeTakeOwnershipPrivilege 3244 WMIC.exe Token: SeLoadDriverPrivilege 3244 WMIC.exe Token: SeSystemProfilePrivilege 3244 WMIC.exe Token: SeSystemtimePrivilege 3244 WMIC.exe Token: SeProfSingleProcessPrivilege 3244 WMIC.exe Token: SeIncBasePriorityPrivilege 3244 WMIC.exe Token: SeCreatePagefilePrivilege 3244 WMIC.exe Token: SeBackupPrivilege 3244 WMIC.exe Token: SeRestorePrivilege 3244 WMIC.exe Token: SeShutdownPrivilege 3244 WMIC.exe Token: SeDebugPrivilege 3244 WMIC.exe Token: SeSystemEnvironmentPrivilege 3244 WMIC.exe Token: SeRemoteShutdownPrivilege 3244 WMIC.exe Token: SeUndockPrivilege 3244 WMIC.exe Token: SeManageVolumePrivilege 3244 WMIC.exe Token: 33 3244 WMIC.exe Token: 34 3244 WMIC.exe Token: 35 3244 WMIC.exe Token: 36 3244 WMIC.exe Token: SeIncreaseQuotaPrivilege 3244 WMIC.exe Token: SeSecurityPrivilege 3244 WMIC.exe Token: SeTakeOwnershipPrivilege 3244 WMIC.exe Token: SeLoadDriverPrivilege 3244 WMIC.exe Token: SeSystemProfilePrivilege 3244 WMIC.exe Token: SeSystemtimePrivilege 3244 WMIC.exe Token: SeProfSingleProcessPrivilege 3244 WMIC.exe Token: SeIncBasePriorityPrivilege 3244 WMIC.exe Token: SeCreatePagefilePrivilege 3244 WMIC.exe Token: SeBackupPrivilege 3244 WMIC.exe Token: SeRestorePrivilege 3244 WMIC.exe Token: SeShutdownPrivilege 3244 WMIC.exe Token: SeDebugPrivilege 3244 WMIC.exe Token: SeSystemEnvironmentPrivilege 3244 WMIC.exe Token: SeRemoteShutdownPrivilege 3244 WMIC.exe Token: SeUndockPrivilege 3244 WMIC.exe Token: SeManageVolumePrivilege 3244 WMIC.exe Token: 33 3244 WMIC.exe Token: 34 3244 WMIC.exe Token: 35 3244 WMIC.exe Token: 36 3244 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4044 NitroRansomware.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4044 NitroRansomware.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4964 wrote to memory of 4044 4964 NitroGen.exe 83 PID 4964 wrote to memory of 4044 4964 NitroGen.exe 83 PID 4964 wrote to memory of 4044 4964 NitroGen.exe 83 PID 4044 wrote to memory of 4940 4044 NitroRansomware.exe 85 PID 4044 wrote to memory of 4940 4044 NitroRansomware.exe 85 PID 4044 wrote to memory of 4940 4044 NitroRansomware.exe 85 PID 4044 wrote to memory of 2744 4044 NitroRansomware.exe 87 PID 4044 wrote to memory of 2744 4044 NitroRansomware.exe 87 PID 4044 wrote to memory of 2744 4044 NitroRansomware.exe 87 PID 2744 wrote to memory of 3244 2744 cmd.exe 89 PID 2744 wrote to memory of 3244 2744 cmd.exe 89 PID 2744 wrote to memory of 3244 2744 cmd.exe 89 PID 4940 wrote to memory of 3240 4940 cmd.exe 90 PID 4940 wrote to memory of 3240 4940 cmd.exe 90 PID 4940 wrote to memory of 3240 4940 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroGen.exe"C:\Users\Admin\AppData\Local\Temp\NitroGen.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\NitroGen\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroGen\NitroRansomware.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NitroGen\patch.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\regedit.exeregedit /s Patch.reg4⤵
- Runs .reg file with regedit
PID:3240
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD584f3e8dc3f19e03950598b7005774ada
SHA1865be991b10c71182f56e30e24ca75a5ca111ec7
SHA256907b0951967bba240caa38494f1607e3e3acf3ff9557efd1d292a9bc12e199b9
SHA512723f3166380bfd9aee957998b8acf6f0f8f17ef8284184df606836e769c0f7c1aac6c1bd860b35c49b11145e905889d75917fd69def415c07425007f181713bf
-
Filesize
184B
MD5cc46a0995713ba7cb577b4bbbedf83e8
SHA16cc50a0e444e33f65d42423195ed045a3a55daf8
SHA2565fe1ad802f68d7c47dbbd8e60162ba88abaed162da5d381c85d3e4935311962e
SHA51236f5b3acbc520504cfe56e5fe19de2a22ae3d2ddddb4c0eb3e441f884033077fb411e69976c3e250c3ef01189d0e48016bde67a73a0dbc950dd5d8ec7783fd2a
-
Filesize
310B
MD5ea2cb363e38635a29fc698b78d59019d
SHA17b2fd924efcf1595e8fccae40b6137a7c63506d6
SHA2560af6a21526ab47e7d53dbab649602e64bb5f2dafa27d9cc200572e6dbe22a030
SHA5125a525f264a915062def515f58e20d0c539b0f9ccd5d40585e074e2e7ae37f0d8205d40db278f7cbd98d61d816dcc9450d4d7084483602eb5b7d9c9a8bfa5551e
-
Filesize
37B
MD50a026d1d64eb8576241e8c4cfa642dc1
SHA126ae22c596114300041c676e27393f2bc5c1bc6c
SHA2569a2c5d55b344f88a35839c62f2dd4a58b8d17a027892947f137f52ec13cba422
SHA512d9100a8e0cca6c85d24fbe7b064fda68cae88e45e31df2bc21cb4d0a6b3694a50011db0da3eb4f9288557d278eb1b6b824213d73611601f429dd8eafc2d48e96