Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4kvideodow...ck.exe

windows7_x64

10

4kvideodow...ck.exe

windows10_x64

10

Analysis

  • max time kernel
    118s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    30/12/2021, 15:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4kvideodownloader_4.18_x64Crack.exe

  • Size

    24.3MB

  • MD5

    346b3c83128f1918b162694eec15963d

  • SHA1

    8c363d01e47d6dffd66044b1a34a78c5a1aac59c

  • SHA256

    d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a

  • SHA512

    d69ec8e35d293f0b78543ddef48d9a4e2e2b4c372336ddb70a5aa4438611c8517b84d344fb250f7a3b14b1cde0d5eb963a9145c82b72f2e1ef807ded385cba6c

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\README.txt

Ransom Note
Do not close this message !!! Hi, don't worry. All of your files have been encrypted. To return your files, you need to send 0.003 bitcoin to the address 1NNLcGozxxNmFypZB4rgnmvuCju2pxfAQQ if within 10 hours there is no payment, all your files will be deleted ... You can pay through various crypto-exchanges (Binance, Coinbase and others), crypto exchanges or from your personal bitcoin wallet. After payment you will receive a decoder and an unlock key and all your files will be unlocked. Do not try to unlock it yourself, you will only waste time, and after 10 hours all files will be deleted. A strong encryption method is used for encryption. Communication after payment telegram: @crypto_support_id_43274
Wallets

1NNLcGozxxNmFypZB4rgnmvuCju2pxfAQQ

Signatures

  • Drops file in Drivers directory 27 IoCs
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 2 IoCs
  • Loads dropped DLL 35 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4kvideodownloader_4.18_x64Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\4kvideodownloader_4.18_x64Crack.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\Users\Admin\AppData\Local\Temp\4kvideodownloader_4.18_x64Crack.exe
      "C:\Users\Admin\AppData\Local\Temp\4kvideodownloader_4.18_x64Crack.exe"
      2⤵
      • Drops file in Drivers directory
      • Modifies extensions of user files
      • Drops startup file
      • Loads dropped DLL
      • Drops desktop.ini file(s)
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:1312
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1372
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1636
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\README.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:676
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\README.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:240

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/944-53-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

      Filesize

      8KB

      Download