734403a96fad68cb2ef2b340adddd9cadd5894007aac703dcdb4a4cb8326c538

max time kernel
1774s
max time network
1804s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/FakeActivation/[email protected]
Size

396KB
MD5

13f4b868603cf0dd6c32702d1bd858c9
SHA1

a595ab75e134f5616679be5f11deefdfaae1de15
SHA256

cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
SHA512

e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24
SSDEEP

12288:jANwRo+mv8QD4+0V16nkFkkk2kyW9EArjaccoH0qzh4:jAT8QE+kHW9EAr+fr4i

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	[email protected]
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	Free YouTube Downloader.exe

Executes dropped EXE 15 IoCs

pid	Process
3688	Free YouTube Downloader.exe
716	Box.exe
2816	Box.exe
3680	Box.exe
1412	Box.exe
3116	Box.exe
3244	Box.exe
3100	Box.exe
1776	Box.exe
4640	Box.exe
3196	Box.exe
4568	Box.exe
2296	Box.exe
3628	Box.exe
4864	Box.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	[email protected]

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	[email protected]
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	[email protected]
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	[email protected]
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3744	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3688	Free YouTube Downloader.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3688	Free YouTube Downloader.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 3688	1844	[email protected]	97
PID 1844 wrote to memory of 3688	1844	[email protected]	97
PID 3688 wrote to memory of 716	3688	Free YouTube Downloader.exe	116
PID 3688 wrote to memory of 716	3688	Free YouTube Downloader.exe	116
PID 3688 wrote to memory of 716	3688	Free YouTube Downloader.exe	116
PID 3688 wrote to memory of 2816	3688	Free YouTube Downloader.exe	123
PID 3688 wrote to memory of 2816	3688	Free YouTube Downloader.exe	123
PID 3688 wrote to memory of 2816	3688	Free YouTube Downloader.exe	123
PID 3688 wrote to memory of 3680	3688	Free YouTube Downloader.exe	126
PID 3688 wrote to memory of 3680	3688	Free YouTube Downloader.exe	126
PID 3688 wrote to memory of 3680	3688	Free YouTube Downloader.exe	126
PID 3688 wrote to memory of 1412	3688	Free YouTube Downloader.exe	137
PID 3688 wrote to memory of 1412	3688	Free YouTube Downloader.exe	137
PID 3688 wrote to memory of 1412	3688	Free YouTube Downloader.exe	137
PID 3688 wrote to memory of 3116	3688	Free YouTube Downloader.exe	138
PID 3688 wrote to memory of 3116	3688	Free YouTube Downloader.exe	138
PID 3688 wrote to memory of 3116	3688	Free YouTube Downloader.exe	138
PID 3688 wrote to memory of 3244	3688	Free YouTube Downloader.exe	139
PID 3688 wrote to memory of 3244	3688	Free YouTube Downloader.exe	139
PID 3688 wrote to memory of 3244	3688	Free YouTube Downloader.exe	139
PID 3688 wrote to memory of 3100	3688	Free YouTube Downloader.exe	141
PID 3688 wrote to memory of 3100	3688	Free YouTube Downloader.exe	141
PID 3688 wrote to memory of 3100	3688	Free YouTube Downloader.exe	141
PID 3688 wrote to memory of 1776	3688	Free YouTube Downloader.exe	142
PID 3688 wrote to memory of 1776	3688	Free YouTube Downloader.exe	142
PID 3688 wrote to memory of 1776	3688	Free YouTube Downloader.exe	142
PID 3688 wrote to memory of 4640	3688	Free YouTube Downloader.exe	143
PID 3688 wrote to memory of 4640	3688	Free YouTube Downloader.exe	143
PID 3688 wrote to memory of 4640	3688	Free YouTube Downloader.exe	143
PID 3688 wrote to memory of 3196	3688	Free YouTube Downloader.exe	144
PID 3688 wrote to memory of 3196	3688	Free YouTube Downloader.exe	144
PID 3688 wrote to memory of 3196	3688	Free YouTube Downloader.exe	144
PID 3688 wrote to memory of 4568	3688	Free YouTube Downloader.exe	150
PID 3688 wrote to memory of 4568	3688	Free YouTube Downloader.exe	150
PID 3688 wrote to memory of 4568	3688	Free YouTube Downloader.exe	150
PID 3688 wrote to memory of 2296	3688	Free YouTube Downloader.exe	152
PID 3688 wrote to memory of 2296	3688	Free YouTube Downloader.exe	152
PID 3688 wrote to memory of 2296	3688	Free YouTube Downloader.exe	152
PID 3688 wrote to memory of 3628	3688	Free YouTube Downloader.exe	153
PID 3688 wrote to memory of 3628	3688	Free YouTube Downloader.exe	153
PID 3688 wrote to memory of 3628	3688	Free YouTube Downloader.exe	153
PID 3688 wrote to memory of 4864	3688	Free YouTube Downloader.exe	155
PID 3688 wrote to memory of 4864	3688	Free YouTube Downloader.exe	155
PID 3688 wrote to memory of 4864	3688	Free YouTube Downloader.exe	155

C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\FakeActivation\[email protected]
"C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\FakeActivation\[email protected]"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:716
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:2816
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:3680
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:1412
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:3116
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:3244
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:3100
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:1776
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:4640
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:3196
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:4568
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:2296
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:3628
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1668 --field-trial-handle=2272,i,17338911640954948469,1637568328132129119,262144 --variations-seed-version /prefetch:8
1⤵
PID:3116

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2272,i,17338911640954948469,1637568328132129119,262144 --variations-seed-version /prefetch:8
1⤵
PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe

Filesize
438KB

MD5
1bb4dd43a8aebc8f3b53acd05e31d5b5

SHA1
54cd1a4a505b301df636903b2293d995d560887e

SHA256
a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02

SHA512
94c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
memory/716-44-0x0000000005800000-0x0000000005DA4000-memory.dmp

Filesize
5.6MB

Download
memory/716-51-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/716-50-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/716-49-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/716-48-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/716-47-0x00000000051D0000-0x00000000051DA000-memory.dmp

Filesize
40KB

Download
memory/716-46-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/716-45-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/716-42-0x0000000000750000-0x00000000007C4000-memory.dmp

Filesize
464KB

Download
memory/716-43-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/1412-104-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download
memory/1412-106-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/1412-107-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download
memory/1412-103-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/1412-105-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download
memory/1776-128-0x00000000054E0000-0x00000000054F0000-memory.dmp

Filesize
64KB

Download
memory/1776-127-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/1776-126-0x00000000054E0000-0x00000000054F0000-memory.dmp

Filesize
64KB

Download
memory/1776-125-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/1844-33-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2296-146-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/2296-145-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/2296-147-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/2816-54-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/2816-58-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/2816-57-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/2816-56-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/2816-55-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/2816-53-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3100-122-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3100-120-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3100-121-0x0000000005B30000-0x0000000005B40000-memory.dmp

Filesize
64KB

Download
memory/3100-123-0x0000000005B30000-0x0000000005B40000-memory.dmp

Filesize
64KB

Download
memory/3116-113-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/3116-112-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/3116-109-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3116-110-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/3116-111-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3196-138-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

Filesize
64KB

Download
memory/3196-137-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3196-135-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3196-136-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

Filesize
64KB

Download
memory/3244-115-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3244-116-0x0000000005730000-0x0000000005740000-memory.dmp

Filesize
64KB

Download
memory/3244-117-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3244-118-0x0000000005730000-0x0000000005740000-memory.dmp

Filesize
64KB

Download
memory/3680-61-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/3680-100-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/3680-99-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3680-60-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3688-39-0x0000017768850000-0x0000017768860000-memory.dmp

Filesize
64KB

Download
memory/3688-32-0x0000017766C10000-0x0000017766C3E000-memory.dmp

Filesize
184KB

Download
memory/3688-34-0x00007FF97E8A0000-0x00007FF97F361000-memory.dmp

Filesize
10.8MB

Download
memory/3688-35-0x0000017768850000-0x0000017768860000-memory.dmp

Filesize
64KB

Download
memory/3688-36-0x0000017768850000-0x0000017768860000-memory.dmp

Filesize
64KB

Download
memory/3688-37-0x00007FF97E8A0000-0x00007FF97F361000-memory.dmp

Filesize
10.8MB

Download
memory/3688-38-0x0000017768850000-0x0000017768860000-memory.dmp

Filesize
64KB

Download
memory/3744-62-0x0000023443A40000-0x0000023443A50000-memory.dmp

Filesize
64KB

Download
memory/3744-97-0x000002344BE90000-0x000002344BE91000-memory.dmp

Filesize
4KB

Download
memory/3744-78-0x0000023443B40000-0x0000023443B50000-memory.dmp

Filesize
64KB

Download
memory/3744-94-0x000002344BE60000-0x000002344BE61000-memory.dmp

Filesize
4KB

Download
memory/3744-96-0x000002344BE90000-0x000002344BE91000-memory.dmp

Filesize
4KB

Download
memory/3744-98-0x000002344BFA0000-0x000002344BFA1000-memory.dmp

Filesize
4KB

Download
memory/4568-143-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/4568-140-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4568-141-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/4568-142-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4640-132-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4640-130-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4640-131-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/4640-133-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads