Overview
overview
10Static
static
10Payload/Yo...lderis
windows7-x64
1Payload/Yo...strate
windows7-x64
1Payload/Yo...elp.js
windows7-x64
1Payload/Yo...mework
windows7-x64
1Payload/Yo...ler.js
windows7-x64
1Payload/Yo...t.html
windows7-x64
1Payload/Yo...t.html
windows7-x64
1Payload/Yo...ser.js
windows7-x64
1Payload/Yo...ser.js
windows7-x64
1Payload/Yo...ent.js
windows7-x64
1Payload/Yo....dylib
windows7-x64
3Payload/Yo....dylib
windows7-x64
3Payload/Yo....dylib
windows7-x64
3Payload/Yo....dylib
windows7-x64
3Payload/Yo....dylib
windows7-x64
3Payload/Yo....dylib
windows7-x64
3Payload/Yo....dylib
windows7-x64
3Payload/Yo....dylib
windows7-x64
3Payload/Yo....dylib
windows7-x64
3Payload/Yo...ed_ios
windows7-x64
1Payload/Yo...fo.xml
windows7-x64
1Payload/Yo...ension
windows7-x64
1Payload/Yo...ension
windows7-x64
1Payload/Yo...ension
windows7-x64
1Payload/Yo...ension
windows7-x64
1Payload/Yo...ension
windows7-x64
1Payload/Yo...ouTube
windows7-x64
1Payload/Yo...fig.js
windows7-x64
1Payload/Yo...fig.js
windows7-x64
1Payload/Yo...fig.js
windows7-x64
1Payload/Yo...to_.js
windows7-x64
1Payload/Yo...237.js
windows7-x64
1Analysis
-
max time kernel
1596s -
max time network
1615s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 15:57
Behavioral task
behavioral1
Sample
Payload/YouTube.app/Frameworks/Alderis.framework/Alderis
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Payload/YouTube.app/Frameworks/CydiaSubstrate.framework/CydiaSubstrate
Resource
win7-20221111-en
Behavioral task
behavioral3
Sample
Payload/YouTube.app/Frameworks/Module_Framework.framework/GHKContactUsResources.bundle/get_help.js
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Payload/YouTube.app/Frameworks/Module_Framework.framework/Module_Framework
Resource
win7-20221111-en
Behavioral task
behavioral5
Sample
Payload/YouTube.app/Frameworks/Module_Framework.framework/RedirectLandingMessageHandler.js
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
Payload/YouTube.app/Frameworks/Module_Framework.framework/SUPSupportContentResources.bundle/ColorThemedCSSFormat.html
Resource
win7-20221111-en
Behavioral task
behavioral7
Sample
Payload/YouTube.app/Frameworks/Module_Framework.framework/SUPSupportContentResources.bundle/RenderedContentFormat.html
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Payload/YouTube.app/Frameworks/Module_Framework.framework/SUPSupportContentResources.bundle/SearchResultsParser.js
Resource
win7-20220812-en
Behavioral task
behavioral9
Sample
Payload/YouTube.app/Frameworks/Module_Framework.framework/SUPSupportContentResources.bundle/SurveyContactFormParser.js
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
Payload/YouTube.app/Frameworks/Module_Framework.framework/WebViewComponent.js
Resource
win7-20220812-en
Behavioral task
behavioral11
Sample
Payload/YouTube.app/Frameworks/YTABGoodies.dylib
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
Payload/YouTube.app/Frameworks/YTReExplore.dylib
Resource
win7-20221111-en
Behavioral task
behavioral13
Sample
Payload/YouTube.app/Frameworks/YTShortsProgress.dylib
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Payload/YouTube.app/Frameworks/YTUHD.dylib
Resource
win7-20221111-en
Behavioral task
behavioral15
Sample
Payload/YouTube.app/Frameworks/YouTubeDislikesReturn.dylib
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Payload/YouTube.app/Frameworks/YouTubeReborn.dylib
Resource
win7-20220901-en
Behavioral task
behavioral17
Sample
Payload/YouTube.app/Frameworks/fixYouTubeLogin.dylib
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
Payload/YouTube.app/Frameworks/iSponsorBlock.dylib
Resource
win7-20221111-en
Behavioral task
behavioral19
Sample
Payload/YouTube.app/Frameworks/libcolorpicker.dylib
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
Payload/YouTube.app/Frameworks/widevine_cdm_secured_ios.framework/widevine_cdm_secured_ios
Resource
win7-20220812-en
Behavioral task
behavioral21
Sample
Payload/YouTube.app/Info.xml
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
Payload/YouTube.app/PlugIns/BroadcastUIExtension.appex/BroadcastUIExtension
Resource
win7-20220901-en
Behavioral task
behavioral23
Sample
Payload/YouTube.app/PlugIns/BroadcastUploadExtension.appex/BroadcastUploadExtension
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
Payload/YouTube.app/PlugIns/MessagesExtension.appex/MessagesExtension
Resource
win7-20221111-en
Behavioral task
behavioral25
Sample
Payload/YouTube.app/PlugIns/NotificationContentExtension.appex/NotificationContentExtension
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
Payload/YouTube.app/PlugIns/NotificationServiceExtension.appex/NotificationServiceExtension
Resource
win7-20220812-en
Behavioral task
behavioral27
Sample
Payload/YouTube.app/YouTube
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
Payload/YouTube.app/mainapp_filegroup/392940140_js_module_config.js
Resource
win7-20221111-en
Behavioral task
behavioral29
Sample
Payload/YouTube.app/mainapp_filegroup/427043361_js_module_config.js
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
Payload/YouTube.app/mainapp_filegroup/42_js_module_config.js
Resource
win7-20220812-en
Behavioral task
behavioral31
Sample
Payload/YouTube.app/mainapp_filegroup/_srs_resources_main_app_eml_bundle_-819589501/playlist_add_to_.js
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
Payload/YouTube.app/mainapp_filegroup/_srs_resources_main_app_eml_bundle_-819589501/root_d5415560901eb237.js
Resource
win7-20221111-en
General
-
Target
Payload/YouTube.app/Info.xml
-
Size
9KB
-
MD5
46c5e3b6032dd31b5570b442de3f2afc
-
SHA1
87ed60f5fd2982db86a1cc340a6d2e21f0a2a32f
-
SHA256
c35e2ac5da9952e07f6180970368f1e8f099c014f57cffcba4617db26fbd4c8b
-
SHA512
36139097e3872447b665d413751a712367c9c70d126202ecbabf1db3a31f88ec7ca8fa955c5a446498dc926973bfe8c5c6fec93faaa8702ba9adab3dc61d3c9c
-
SSDEEP
96:Cyh2GxzrUnHc9y3HgOAOdlcxfqUvYYUJ1oPFac9c3s02LuRIhMh1v4C16MBC8Cf0:XaHJ1cK8v+cgz5q3khvx1
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb800000000020000000000106600000001000020000000acb66703c840e7613343e11fbb7c873165842eedb930f90ff0b3ac318f85fde4000000000e8000000002000020000000631d68e2dfc80f9644ca905e56e6c8122e7dca5c512980d2b70f23d492cc34279000000063122adb792e8e5c49cce0cee37bc3c1ff6691b70aafdd1e8f03f36097b4dad19901a5dce79d765b30bf5c9ab3df39503ea9e61a2c5b8e38512ad255a8deb0f46cbcc1f87ee129ffb486699b2c5a8a5b5820178b96b74f49e225ad01402ef120133795bd2adcc9d13389e2566c73d866f7f59ba56ad63444d8895a13585fa10b3b1645e0b20e5f2bb385adaf4c46cb094000000096118b51eab664eda54e6ba3ba9f590eec7f153219718b9d0d37ff74c6328e44b9123d4a87b20886d5eeb6f34b4c7ac352a4949cef084b75f6e8be8bb841810d IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0689F681-A640-11ED-B76D-4EFAD8A2B6A5} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb800000000020000000000106600000001000020000000e673d26d4c160b757123a1dd2d2a0ec16452b73e9029f56ad01e8f1d75e021e4000000000e80000000020000200000007de3aab0460901f0e38469cc05f15a7dd8e6cae14d0cf57dbdfb6a9d63fd91d420000000f7dd7707f3ccbe9d03d01fbe44bf48bcce2ce5cd5169316e658c94686546a1ee40000000432704924b868bcdf4cb3e0a6e56e5be47a2ec883114c321490ca1697cdf604279f881261bb6ccf55f4db08457860817679c245440300af4ce9a04c0bfc22482 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201a00dc4c3ad901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382467918" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IEXPLORE.EXEpid process 1320 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1320 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1320 IEXPLORE.EXE 1320 IEXPLORE.EXE 636 IEXPLORE.EXE 636 IEXPLORE.EXE 636 IEXPLORE.EXE 636 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 880 wrote to memory of 564 880 MSOXMLED.EXE iexplore.exe PID 880 wrote to memory of 564 880 MSOXMLED.EXE iexplore.exe PID 880 wrote to memory of 564 880 MSOXMLED.EXE iexplore.exe PID 880 wrote to memory of 564 880 MSOXMLED.EXE iexplore.exe PID 564 wrote to memory of 1320 564 iexplore.exe IEXPLORE.EXE PID 564 wrote to memory of 1320 564 iexplore.exe IEXPLORE.EXE PID 564 wrote to memory of 1320 564 iexplore.exe IEXPLORE.EXE PID 564 wrote to memory of 1320 564 iexplore.exe IEXPLORE.EXE PID 1320 wrote to memory of 636 1320 IEXPLORE.EXE IEXPLORE.EXE PID 1320 wrote to memory of 636 1320 IEXPLORE.EXE IEXPLORE.EXE PID 1320 wrote to memory of 636 1320 IEXPLORE.EXE IEXPLORE.EXE PID 1320 wrote to memory of 636 1320 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Payload\YouTube.app\Info.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1320 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MCQ3B10D.txtFilesize
605B
MD504120e9c026eb7b660bc0555ab78484b
SHA173469c52b308fa86891225df3f02e9ed5e98d4f4
SHA25684bb0faa25df1450fdfb27def5d2b7bdaea09daaef001201f406aaa855129095
SHA51277d69ffc03b46d79ce636896858fcfcec4e6d71c497be253aa86da0502cb58bc4d833ba9ca01de2f66e1968c3bc3352a4c361189a741eec909efb7bb9737700c
-
memory/880-54-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB