Analysis
- max time kernel
19s - max time network
17s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
02/03/2024, 16:29
General
- Target [email protected]
- Size 396KB
- Sample240302-tzk8mafc83
- SHA256 cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Free YouTube Downloader.exe
memory/3180-32-0x00007FF952B20000-0x00007FF95350C000-memory.dmp
memory/3180-34-0x0000027D04190000-0x0000027D041A0000-memory.dmp
memory/3180-35-0x0000027D04190000-0x0000027D041A0000-memory.dmp
memory/3344-26-0x0000000000400000-0x000000000043C000-memory.dmp
memory/4064-27-0x0000026642AA0000-0x0000026642ACE000-memory.dmp
memory/4064-28-0x00007FF952B20000-0x00007FF95350C000-memory.dmp
memory/4064-29-0x00000266449A0000-0x00000266449B0000-memory.dmp
memory/4064-30-0x00000266449A0000-0x00000266449B0000-memory.dmp
memory/4064-33-0x00007FF952B20000-0x00007FF95350C000-memory.dmp
memory/4064-36-0x00000266449A0000-0x00000266449B0000-memory.dmp
memory/4064-37-0x00000266449A0000-0x00000266449B0000-memory.dmp