4e33a786d312df1b6977fef14c66e9780c33c0deadb1e4c771f4380febefb002

General

Target

clearplaytube_eu_1121.exe
Size

4.4MB
MD5

e1cd31073de60b3b4b4722e0bc92553c
SHA1

19d44afcf856755888135851734c84f6d8d68869
SHA256

4e33a786d312df1b6977fef14c66e9780c33c0deadb1e4c771f4380febefb002
SHA512

d7b9ac6107e239532b5c102a8a51dfa7757a2a7e8630081261f5f15be21bab32195d06ef3cdd6123043fa5bd2d62ca77b0b675673f2054284fbbcf2674e9125b
SSDEEP

98304:dkLN6L+r/lw5WrkbiYruCrjwxsZs+tXmATLR8PBiW:uwqDu5ZicvyGs+BRiBiW

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5076	clearplaytube_eu_1121.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\shlwapi_p.dll	clearplaytube_eu_1121.tmp

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest	clearplaytube_eu_1121.tmp
File created	C:\Program Files\Google\Chrome\Application\dlls\Shlwapi.dll	clearplaytube_eu_1121.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\app.crx	clearplaytube_eu_1121.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\updates.xml	clearplaytube_eu_1121.tmp
File created	C:\Program Files\Clear Play Tube\unins000.dat	clearplaytube_eu_1121.tmp
File created	C:\Program Files\Clear Play Tube\is-DIOT5.tmp	clearplaytube_eu_1121.tmp
File opened for modification	C:\Program Files\Clear Play Tube\unins000.dat	clearplaytube_eu_1121.tmp
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.manifest	clearplaytube_eu_1121.tmp
File opened for modification	C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest	clearplaytube_eu_1121.tmp
File created	C:\Program Files\Google\Chrome\Application\Extensions\app.crx	clearplaytube_eu_1121.tmp
File created	C:\Program Files\Google\Chrome\Application\Extensions\updates.xml	clearplaytube_eu_1121.tmp

Kills process with taskkill 2 IoCs

evasion

pid	Process
2384	taskkill.exe
672	taskkill.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	59	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	672	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5076	clearplaytube_eu_1121.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 5076	4940	clearplaytube_eu_1121.exe	89
PID 4940 wrote to memory of 5076	4940	clearplaytube_eu_1121.exe	89
PID 4940 wrote to memory of 5076	4940	clearplaytube_eu_1121.exe	89
PID 5076 wrote to memory of 2384	5076	clearplaytube_eu_1121.tmp	98
PID 5076 wrote to memory of 2384	5076	clearplaytube_eu_1121.tmp	98
PID 5076 wrote to memory of 672	5076	clearplaytube_eu_1121.tmp	101
PID 5076 wrote to memory of 672	5076	clearplaytube_eu_1121.tmp	101

C:\Users\Admin\AppData\Local\Temp\clearplaytube_eu_1121.exe
"C:\Users\Admin\AppData\Local\Temp\clearplaytube_eu_1121.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\is-TR97L.tmp\clearplaytube_eu_1121.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TR97L.tmp\clearplaytube_eu_1121.tmp" /SL5="$E004E,3757788,1102336,C:\Users\Admin\AppData\Local\Temp\clearplaytube_eu_1121.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill.exe" /f /im "msedge.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill.exe" /f /im "chrome.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-IG1N3.tmp\dlls.manifest

Filesize
208B

MD5
963fb7657217be957d7d4732d892e55c

SHA1
593578a69d1044a896eb8ec2da856e94d359ef6b

SHA256
1d4a8c5e18d7a189036f1074ffae7927b0450864f5c8622a44205e04ef13ce12

SHA512
f875fa56bcda6299681d2ca2852d5ae04504b1df8d8824170215d4c136a568fc2548ada88ea75178ce23b4649f1713a863926c4d02125cb29475251bf5781fdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TR97L.tmp\clearplaytube_eu_1121.tmp

Filesize
3.3MB

MD5
eecede149990d5e0f606bceb308f8786

SHA1
f443401c4be2cf50f34a5823146c7754a3834a8c

SHA256
99a3a28c9b44afa86f8d7dc8a374f855c6a7d8b932e2512e4f7ebc72da95343a

SHA512
2a8ecaf9f493074d05b90362e57d920f2f06a2f5f86381839adae6ca4fec271c4dcf67fe479ad488d0c82455d34fef157071806cd1c1ab330baa51bf40a28046

Download Submit
memory/4940-0-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/4940-7-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/4940-75-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/5076-5-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/5076-8-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/5076-11-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/5076-66-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/5076-74-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing