Overview
overview
7Static
static
355589f0ba3...49.exe
windows7-x64
755589f0ba3...49.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/Mp3T...le.exe
windows7-x64
7$TEMP/Mp3T...le.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/mp3t...up.exe
windows7-x64
7$TEMP/mp3t...up.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Mp3TubeDownloader.exe
windows7-x64
1Mp3TubeDownloader.exe
windows10-2004-x64
1Mp3TubeDow...vc.exe
windows7-x64
1Mp3TubeDow...vc.exe
windows10-2004-x64
1mp3tubedow...tb.dll
windows7-x64
1mp3tubedow...tb.dll
windows10-2004-x64
1uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3xpi/chrome...nts.js
windows7-x64
1xpi/chrome...nts.js
windows10-2004-x64
1xpi/chrome...deo.js
windows7-x64
1xpi/chrome...deo.js
windows10-2004-x64
1xpi/chrome...dlg.js
windows7-x64
1xpi/chrome...dlg.js
windows10-2004-x64
1Analysis
- max time kernel
1s - max time network
124s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
12/01/2024, 03:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
55589f0ba31caeb1506b805768840749.exe
Resource
win7-20231215-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
55589f0ba31caeb1506b805768840749.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$TEMP/Mp3TubeDownloaderBundle.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
$TEMP/Mp3TubeDownloaderBundle.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
$TEMP/mp3tubedownloader-tb-setup.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral14
Sample
$TEMP/mp3tubedownloader-tb-setup.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
Mp3TubeDownloader.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Mp3TubeDownloader.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Mp3TubeDownloaderSvc.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Mp3TubeDownloaderSvc.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
mp3tubedownloadertb.dll
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
mp3tubedownloadertb.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
uninstall.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
uninstall.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
xpi/chrome/content/constants.js
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
xpi/chrome/content/constants.js
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
xpi/chrome/content/convertvideo.js
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
xpi/chrome/content/convertvideo.js
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
xpi/chrome/content/convertvideodlg.js
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
xpi/chrome/content/convertvideodlg.js
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target $TEMP/Mp3TubeDownloaderBundle.exe
- Size 572KB
- Sample240112-dv16aadffq
- SHA256 bf6511cbeba8f982d61ada3bc262ddec737ea484eb6734108df71d2881d346c4
- MD5 98a4cfde210e294d92fcdc2e5d9aae07
- SHA1 4fe27e06393258b9beaf333ecc641aa43c822d08
- SHA512 653e229efbe872fe929c7c429f629446cc362ec45b56c90b7dcd4e002b9f9d35047a8073f47b7736bc2d2a15c4dbde5382fec02054807cdb28ecb90ada9eeacd
- SSDEEP 12288:UyZxV60PFOBUq/DV4IIw0SzIOFCE0cBBRtPF1sh6h2480KRzRK9:UP0CxDKw0jE0cBBRlTh248hzRK9
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2088 mp3tubedownloader-tb-setup.exe - Loads dropped DLL 6 IoCs
pid Process 2480 Mp3TubeDownloaderBundle.exe 2480 Mp3TubeDownloaderBundle.exe 2480 Mp3TubeDownloaderBundle.exe 2480 Mp3TubeDownloaderBundle.exe 2088 mp3tubedownloader-tb-setup.exe 2088 mp3tubedownloader-tb-setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 61 IoCs
description ioc Process File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\toolbar.css mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\popup-bg.png mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome.manifest mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\convertvideodlg.xul mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\divider.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\savemp3popup-musicicon.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\mp3button-dialog.css mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\toolbar.xul mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\btn_close.png mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\divider.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\savetomp3popup.xul mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\convertvideodlg.js mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\savemp3_disabled.png mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\savemp3popup.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\arrow.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\arrow_big.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome.manifest mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\constants.js mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\mp3tube-button-bg.png mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\popup-bg.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\savemp3.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\install.rdf mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloader.exe mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\convertvideo.js mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\savetomp3popup.xul mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\arrow_big.png mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\icon-RSS.png mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\install.rdf mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\convertvideo.js mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\ mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\mp3tube-button-bg.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\savemp3popup.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\convertvideodlg.xul mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\savemp3_disabled.png mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\events.js mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\savetomp3popup.js mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\mp3button-intro.css mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloaderSvc.exe mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\ mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\arrow.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\icon-RSS.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\ mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\uninstall.exe mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\plainbutton.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\constants.js mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\convertvideodlg.js mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\toolbar.css mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\tbcore.js mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\savemp3popup-musicicon.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\tbcore.js mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\btn_close.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\events.js mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\savetomp3popup.js mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\plainbutton.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\ mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\ mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\mp3tubedownloadertb.dll mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\mp3button-dialog.css mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\mp3button-intro.css mp3tubedownloader-tb-setup.exe File created C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\skin\buttons\savemp3.png mp3tubedownloader-tb-setup.exe File opened for modification C:\Program Files (x86)\Mp3TubeDownloader Toolbar\xpi\chrome\content\toolbar.xul mp3tubedownloader-tb-setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 3 IoCs
resource yara_rule behavioral7/files/0x0030000000015c51-14.dat nsis_installer_1 behavioral7/files/0x0030000000015c51-17.dat nsis_installer_1 behavioral7/files/0x0030000000015c51-18.dat nsis_installer_1 -
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar mp3tubedownloader-tb-setup.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{8F16A166-C166-49b7-AE74-8CC7ED4196EF} mp3tubedownloader-tb-setup.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91E6BFA1-B0F9-11EE-9569-6A53A263E8F2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F16A166-C166-49b7-AE74-8CC7ED4196EF}\ = "Mp3TubeDownloader" mp3tubedownloader-tb-setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F16A166-C166-49b7-AE74-8CC7ED4196EF}\InProcServer32 mp3tubedownloader-tb-setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F16A166-C166-49b7-AE74-8CC7ED4196EF}\InProcServer32\ = "\"C:\\Program Files (x86)\\Mp3TubeDownloader Toolbar\\mp3tubedownloadertb.DLL\"" mp3tubedownloader-tb-setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F16A166-C166-49b7-AE74-8CC7ED4196EF}\InProcServer32\ThreadingModel = "Apartment" mp3tubedownloader-tb-setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F16A166-C166-49b7-AE74-8CC7ED4196EF} mp3tubedownloader-tb-setup.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2664 iexplore.exe 2664 iexplore.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2088 2480 Mp3TubeDownloaderBundle.exe 17 PID 2480 wrote to memory of 2088 2480 Mp3TubeDownloaderBundle.exe 17 PID 2480 wrote to memory of 2088 2480 Mp3TubeDownloaderBundle.exe 17 PID 2480 wrote to memory of 2088 2480 Mp3TubeDownloaderBundle.exe 17 PID 2480 wrote to memory of 2088 2480 Mp3TubeDownloaderBundle.exe 17 PID 2480 wrote to memory of 2088 2480 Mp3TubeDownloaderBundle.exe 17 PID 2480 wrote to memory of 2088 2480 Mp3TubeDownloaderBundle.exe 17 PID 2664 wrote to memory of 288 2664 iexplore.exe 30 PID 2664 wrote to memory of 288 2664 iexplore.exe 30 PID 2664 wrote to memory of 288 2664 iexplore.exe 30 PID 2664 wrote to memory of 288 2664 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\Mp3TubeDownloaderBundle.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\Mp3TubeDownloaderBundle.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\mp3tubedownloader-tb-setup.exe"C:\Users\Admin\AppData\Local\Temp\mp3tubedownloader-tb-setup.exe" -i 995f12a66d7a41e89ec8992baf70d06f -p mp3tubeporntb -d "y"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:2088 -
C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloaderSvc.exe"Mp3TubeDownloaderSvc.exe" -i3⤵PID:2928
-
-
C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloaderSvc.exe"Mp3TubeDownloaderSvc.exe" -r3⤵PID:1632
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:22⤵PID:288
-
-
C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloader.exe"C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloader.exe" 8ea61f6331159b5e9a4c290d1dfc4bcb1⤵PID:1628
-
C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloaderSvc.exe"C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloaderSvc.exe"1⤵PID:2972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloader.exe
- Size 17KB
- SHA256 363015a1b64393b049d8807451412ed6c9641732cc497c6eb9d01357d5942c94
- MD5 bfb3dffbd05b8ad6118d37fd43b1402f
- SHA1 0c3ed0ae71a4dea3785d071196bcf5906b3f2740
- SHA512 0bc8ed5838bd0a8876412f55194fea0cca218c5d712248651ab23cd64a32dd5f0b789ba14c612806c5e8e9deebde45e5980e54c2d91df87778b113ac60034b97
- SSDEEP 384:os/ky5s5EpcsCE+BKpgWn3uUiQKp6RMOtIK:F3pcbY6NpSp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloader.exe
- Size 97KB
- SHA256 2fefb1c7e82a751bb3c5f72c0f85dd39812581c45530e1624376774f2f13d58f
- MD5 132524a42e4ceacf15caf61b691c6231
- SHA1 f711884567b2e292a44db332ffa2dbd1bafcc221
- SHA512 92024daf9c50b95d3ca31ff7c8ed985135fe4c037d56a6f670bef7aa28bd4814469b58206b1d2fc438ab19ea855ed0ccdc6bffe061700c29d503a34304e727d6
- SSDEEP 1536:F5cFxVTGI06uOLCxjnYrhj+YghNb/LeKEs/F/O81bz:FOxVGXJxD1h9RU81bz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloaderSvc.exe
- Size 156KB
- SHA256 41d8e857e83a4c2d4ecbf75f3b759bf7cef858362dca0558f3b65262aa89eb30
- MD5 ecaf84c10b0f4e12a3f2108b83ae8557
- SHA1 4f42ed7e1db1610f886385ec82147e5e2eaccb4b
- SHA512 e5c56216be01696519cb058158276d671066bf6fd445faa83b6b26fa2b7b710a4c3675daea716e05660fc7adc469fc7df07edcf9a309cfa7c87412b33622fe09
- SSDEEP 3072:ByiemTBX4fpgtysBLFYH08wZEVxA52zb5:0ielfivLF6wWfzt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloaderSvc.exe
- Size 131KB
- SHA256 7b36cdc03289f73897bee2eb5ae314996757d8ab52113e2f03e22867356bed75
- MD5 ec8f2c2b641ac3eafc4b877709f21fa7
- SHA1 b2bddd2fdbbeb820234111fedac07f338a8a6525
- SHA512 edcdab447103212c8b60852506d4cc2fe6b803ac956566215eb436f0e57d0ba468d2efc78ab5a27b8d015533ddbfeeedb08e60cee530647c61d1ad60586e1796
- SSDEEP 1536:LEkqKyiXuipweBPiMXd2JagpO39j4+Gnb97ZZWLngORNFYHwD1WwZ9:ByiemTBX4fpgtysBLFYH08wZ9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloaderSvc.exe
- Size 35KB
- SHA256 2e6cc94236172d56a9ba05e872ba0f73b14b10d5b0d2bc4ba5bb1207881a4ae4
- MD5 a1704a5f407c63fb7c3f1f6d050bc8c5
- SHA1 0733be6ffa6ac3a43b4728c11469e407001c835e
- SHA512 b4f63576065a536c3de9e0e53beb2814ebe2635f98fce1c3b94c02b6d0fb5dfc459c9ac7fc1727d1ac66547f75cfa875538068e002a0cc5f31f6be46b401056c
- SSDEEP 768:LDMfkqq95oXN6KcqkNEYcT/6BDJVO29kVoYFwXpwN:LEkqKyiXuipwN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\mp3tubedownloader-tb-setup.exe
- Size 265KB
- SHA256 c1b8ff091fecb593a6fa8b425a624956a79631daab5e4c6b3a870dfcc536ad9c
- MD5 adaab4d4e1bf199c76b5ec08e1f14baf
- SHA1 f0410c564f9444f486b515defcab0b13eed5a414
- SHA512 d6eb3dfcaae72e4b2786d6ec848eec59c09cc1c855f7db273aded848ac0fffe829b9a6d55e697ad099680453605b1156ad43277cc31ea87848d92a886ace32c4
- SSDEEP 6144:MeUTjONJJnz6KOgFATLgqSTTmqd/N+RR2jJ8C4:ITjIznvFsLpsTreHcJ8C4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\mp3tubedownloader-tb-setup.exe
- Size 197KB
- SHA256 7032ee83f1e2d3512b10dd8a174fe8fd93c473d68ee5ae1c275e28b528571ead
- MD5 820ba8d41c2c76a8ce389874b698cca3
- SHA1 bce69ef3b6106bec405a20c14e8fe3e82cca4102
- SHA512 1417841733803374c83e30b1b8408ecd49ef12249df653fd90fe33dc8f8bd32eaa1fdde7d9d9385d53ed4cc8a438fb5962c5ced5857421e4f84cdee118976d48
- SSDEEP 3072:M42U65mXkJyU4nWBjqtJBXVHJbyOnz6KOgFRGTvjgqSToWyefJK0mMwulIKz:MeUTjONJJnz6KOgFATLgqSTTmqdz
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Mp3TubeDownloader Toolbar\Mp3TubeDownloader.exe
- Size 41KB
- SHA256 70de7680fa786c2c960b1cfc3ddf8d593c2649d5ddcb0064a303fde7dbab856d
- MD5 b50d0e5472a78172f7cce7e429fe39f4
- SHA1 72d78aed3808bb511fe74d0fc00d5a206468e42a
- SHA512 b753ad76749015053d94b06800f911df49c0e986aeba8deaa523eb19b56970020720cb53b11508524645fa9c9ff3d10cc969983e3fbc3f5bd1a34d18cfa11ed7
- SSDEEP 768:F3pcbY6NpS6j1owVGe4LxZbQ0/Sqhqza82Kpyk:F5cFxVTGI06uOLh
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Mp3TubeDownloader Toolbar\mp3tubedownloadertb.dll
- Size 46KB
- SHA256 08879cbc02b1fd9db65272a948a014c8f31a628ce1807dd822838e51dfefc09a
- MD5 e4cec8bd5529f04160f32263bdc37241
- SHA1 c9953c21f1ad2ee0818102be7023f9b1be4cd4b7
- SHA512 6df650ba4ee64aa19058d2dbdffec52921a5c1ebc18c642190287dbe9b962e113392d193ba745164749c6260f76f9b8f999032eb5154c9988fd880533fa7f1e9
- SSDEEP 768:v77CcWij6x63UMxJuwSB4J36F46w/nkFQCHnyQyTXrW8jUWZVFjb1eJ9pW4PW/yA:tK63txJXS0imnMQCHyvfW8jU8V91eJ9k
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\mp3tubedownloader-tb-setup.exe
- Size 245KB
- SHA256 abbbd88b68bce3fec3d1952a8b7b1c0d23b741cc37b8e90605944eedbde3dc6f
- MD5 f9c828afb5bb051a3ed10630601a88a3
- SHA1 6c5c8e524c9747c83504489cdf9bce93c8aa6967
- SHA512 e74be5486a9e66347b96224da69678d58236a9e523e5d46bd128c3c02a49f06431de2f9eac00c9f17729e32ff9c818aee5fa3efe17066cf0468f1cfccb33dfd6
- SSDEEP 6144:MeUTjONJJnz6KOgFATLgqSTTmqd/N+RR2jJ8B:ITjIznvFsLpsTreHcJ8B
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsy4240.tmp\System.dll
- Size 10KB
- SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
- MD5 fe24766ba314f620d57d0cf7339103c0
- SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
- SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
- SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
- MD5 SHA1 SHA512 SSDEEP