Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
355589f0ba3...49.exe
windows7-x64
755589f0ba3...49.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/Mp3T...le.exe
windows7-x64
7$TEMP/Mp3T...le.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/mp3t...up.exe
windows7-x64
7$TEMP/mp3t...up.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Mp3TubeDownloader.exe
windows7-x64
1Mp3TubeDownloader.exe
windows10-2004-x64
1Mp3TubeDow...vc.exe
windows7-x64
1Mp3TubeDow...vc.exe
windows10-2004-x64
1mp3tubedow...tb.dll
windows7-x64
1mp3tubedow...tb.dll
windows10-2004-x64
1uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3xpi/chrome...nts.js
windows7-x64
1xpi/chrome...nts.js
windows10-2004-x64
1xpi/chrome...deo.js
windows7-x64
1xpi/chrome...deo.js
windows10-2004-x64
1xpi/chrome...dlg.js
windows7-x64
1xpi/chrome...dlg.js
windows10-2004-x64
1Analysis
-
max time kernel
0s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
55589f0ba31caeb1506b805768840749.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
55589f0ba31caeb1506b805768840749.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$TEMP/Mp3TubeDownloaderBundle.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$TEMP/Mp3TubeDownloaderBundle.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
$TEMP/mp3tubedownloader-tb-setup.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
$TEMP/mp3tubedownloader-tb-setup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
Mp3TubeDownloader.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
Mp3TubeDownloader.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
Mp3TubeDownloaderSvc.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
Mp3TubeDownloaderSvc.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
mp3tubedownloadertb.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
mp3tubedownloadertb.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
uninstall.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
uninstall.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
xpi/chrome/content/constants.js
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
xpi/chrome/content/constants.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
xpi/chrome/content/convertvideo.js
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
xpi/chrome/content/convertvideo.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
xpi/chrome/content/convertvideodlg.js
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
xpi/chrome/content/convertvideodlg.js
Resource
win10v2004-20231222-en
General
-
Target
55589f0ba31caeb1506b805768840749.exe
-
Size
1.5MB
-
MD5
55589f0ba31caeb1506b805768840749
-
SHA1
be7a0fa20dec57b9b94efb533e23a513547e3981
-
SHA256
aec7d3254663753493cc816f6064fd39c6eaa477e9fe1af715480c4c2aee8112
-
SHA512
a6484eeb0eeadd1e16f1ddd33e130f7a8194da2a68236d6178f5bb404fdc45b2e2fc6c615e045d10c013d9d9a745beebc1cfe70d78b3c9724d397849cbe47078
-
SSDEEP
49152:68Gl0svU8HLuBX2sdu7c/WJdHhZZ39MT4Xq:68Y0svHLuBX2SuY/WJ5t3924Xq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2708 dnt-firstlook-sntb.exe -
Loads dropped DLL 3 IoCs
pid Process 712 55589f0ba31caeb1506b805768840749.exe 712 55589f0ba31caeb1506b805768840749.exe 712 55589f0ba31caeb1506b805768840749.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x00060000000231e8-16.dat nsis_installer_1 behavioral2/files/0x00060000000231e8-16.dat nsis_installer_2 behavioral2/files/0x00060000000231e8-15.dat nsis_installer_1 behavioral2/files/0x00060000000231e8-15.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 712 wrote to memory of 2708 712 55589f0ba31caeb1506b805768840749.exe 30 PID 712 wrote to memory of 2708 712 55589f0ba31caeb1506b805768840749.exe 30 PID 712 wrote to memory of 2708 712 55589f0ba31caeb1506b805768840749.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\55589f0ba31caeb1506b805768840749.exe"C:\Users\Admin\AppData\Local\Temp\55589f0ba31caeb1506b805768840749.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe"dnt-firstlook-sntb.exe" /RETURNSTATUS /CHANNEL=US728 /TOOLBAR /DEFAULTSEARCH /DEFAULTSTART2⤵PID:3348
-
C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe" --install3⤵PID:4908
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /i /s "C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll"3⤵PID:3372
-
-
C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe" --start3⤵PID:3320
-
-
-
C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe"dnt-firstlook-sntb.exe" /CHANNEL=US728 /OFFERED /TOOLBAR /DEFAULTSTART /DEFAULTSEARCH2⤵
- Executes dropped EXE
PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\ispassistant-bho-setup.exe"ispassistant-bho-setup.exe" -d 52⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pornclips69.com/?tmp=adultvideo2⤵PID:1548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:83⤵PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:33⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:13⤵PID:556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:13⤵PID:2932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:13⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:23⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:13⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:83⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:83⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:13⤵PID:3576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:13⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:13⤵PID:5272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:13⤵PID:5380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:13⤵PID:5468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:13⤵PID:6072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:23⤵PID:5260
-
-
-
C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"1⤵PID:4344
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:816
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵PID:2812
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:17410 /prefetch:22⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95dba46f8,0x7ff95dba4708,0x7ff95dba47181⤵PID:1940
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2536
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
712KB
MD54251d8d58a61737cabc32bee6ad94845
SHA1a7dd476767117ddb8bf04588976735ce9b3757e2
SHA256f168a3d9048460ade8e9a99570e04b7298b51d733cfdaa815c7114897ef43edf
SHA512506aa2ae112bcfed60b3b0b8936d53f6b4ef0954030e65003706ddfa95db28080cdea92fd4f617caae31a47e2ebe6c22e023041d2d7d939956e44e9f6d259238
-
Filesize
64KB
MD515ae86d7e718db607ced309f37a8b50e
SHA12247aaa689b752cfa26833f04b9dc5200ab7f040
SHA2568b5c4de6d6d07d4e6018d34533ef871060bad5b21bb5726deb655e87171c5a6a
SHA5128c58348e85d83a67241dd658ec39ba31733aef73630d3a49ff0fdaa7d727800360c4894da692545c5a5d18f25bf07783df3581c9db4448c5cc316f35c606c6c0
-
Filesize
66KB
MD5b140459077c7c39be4bef249c2f84535
SHA1c56498241c2ddafb01961596da16d08d1b11cd35
SHA2560598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
SHA512fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
20KB
MD5009dbbdd1ef470dd752c2b73835da3e7
SHA1f97da6556b24302df8201a092eaa32a80d49064b
SHA256c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c
SHA512dbffa0eb830b292e5550eb3f3cfce90f881282652afb0463672ece7eb0946c34a8f75c4852f77b1db3604f0f346d0ed9d9babbad40b41de109e9f5119d555ec5
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3