Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
22s -
max time network
22s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
22/08/2024, 04:31
General
-
Target
YoutubePlaylistDownloader.exe
-
Size
33.9MB
-
MD5
6cffc5f33542dcbe4c5e23a68155e856
-
SHA1
327dbe3a858de848624805e8549b2e32ca63e6a2
-
SHA256
49a3a54c97102079abe75283018ae2fbcb67525e9e82e154eb2eb47a7e69ab71
-
SHA512
74ccea5a8f0e3573ba091e06b4f8780f18702722ce0b30ad89b7581ff0132a984ff74411273c660a0b2597a27c6952e86676d304c7b7650b880c973e49be09af
-
SSDEEP
786432:c1IMd/U4lUbFFV9xhiLMyAr5Wo8z9CYY57DCuZO:RG/UIybD3+MyAoo8z93Y5Q
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\YoutubePlaylistDownloader.exe"C:\Users\Admin\AppData\Local\Temp\YoutubePlaylistDownloader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NA58Q.tmp\YoutubePlaylistDownloader.tmp"C:\Users\Admin\AppData\Local\Temp\is-NA58Q.tmp\YoutubePlaylistDownloader.tmp" /SL5="$50288,34675314,1146880,C:\Users\Admin\AppData\Local\Temp\YoutubePlaylistDownloader.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\YouTube Playlist Downloader\YoutubePlaylistDownloader.exe"C:\Program Files (x86)\YouTube Playlist Downloader\YoutubePlaylistDownloader.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD56def9baa2552c072cea16b155fed0668
SHA193c9c9a7bf892d102f75b7fbadcc997488b4ed34
SHA2563eceee9042e90da4a433007729778f72516f762599f7920839c751e180a47cb0
SHA51262ef6519d0aa5979acd11067ff129ebb85bf62df8e66e395423b0cf33e5aa1541f2a028d38f2f6647cc129f6cc8be381b9c4762928fd4d163a1614652f5984ac
-
Filesize
19KB
MD5f53bdeff3bf3261d76f67590f75978d5
SHA132d9598e205658bf0f54b9a0ac14801740ba8f9b
SHA25650ff62f374c37911e2c8d61f9adcdb19f566335359c2a3d215b05c08c4dbe30b
SHA512aeea279600fa23843a684903a8bfea055900b0352917c64b43ae35a839a7197adcb1b9c37ba86049985c634ef2bbaf70b72c66c7ff0ddb8affc9ca6238406ec8
-
Filesize
2.3MB
MD53299812da907195e616ceea991032cd5
SHA142c10db25f90c2c33d2be9bbf2f320c2cfa76638
SHA25658c1656997d7344b5f50e34daa745d0fd7c9f9e09d7c7be7482e99551b863051
SHA512d6bed57df44e110ed4e172486cefeabcd844eaa83be2c46d4ef808949c5470214b80ad0404934f46c04bd61561093b8cce0dbafe2cfa16539d4422f582736e1b
-
Filesize
3.4MB
MD50ff8bc2220c4378a832d9824d4e13491
SHA11857edb308913fa8e9cef6930146cdcd6be21a0b
SHA2568287fa1fe7e02d1d6bf38715276a3f5c71f2cd18f2a3ae4c8782ab722e6f90a4
SHA5127aff83860273740d3fbc7be6ed689fa9ea29a35e4fa38d6357dbf6c38b04f696f384df991dd447161fc565514d292c0f76d1a642785e8c7fc53e43183e52d152
-
Filesize
141KB
MD53add5efdb77ac86592db53b1a22d41c4
SHA105cce0b4888b8a4a9d0035a00da792ae2f2f52da
SHA25671e00e2b9ca3088132fc4d54a2076cb07127fe02a5fbc10df8d61cde55dfdbef
SHA512f766aab25e307c5dcca8ae09925e11fb2183e19b5936984c082eb794bd99256bfb0ae2441cc615cac5b358ba259033e397cd718aa63912ef2c9de2cd558d99aa
-
Filesize
695KB
MD5adf3e3eecde20b7c9661e9c47106a14a
SHA1f3130f7fd4b414b5aec04eb87ed800eb84dd2154
SHA25622c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
SHA5126a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
-
Filesize
223KB
MD57359d3b900cb72581bd757df6960bde8
SHA1dcf3fa274d5df96fedaa9cffe7eb27ce6014f171
SHA256f5865a530ed8ab1b4759415526521d2a3f242de2bceb342fb7a150f30b4017f1
SHA512125e869393f7c51fb6eb692ead9ad1dee44dc13edc68ac08ad4a6d1c948f212a93b2ea65c7794c3f2f4bb21122c9ddb8a2c5ce675399f955df0dffb36af69837
-
Filesize
57KB
MD52ca189aec58d95f749b21a92ffd59bca
SHA1b8384dbb5c4be0936a30ee2780f272e0e6824e3e
SHA256d18f6301eba375a73c625cb019eeb1c8ecaf0902129c094f52292ea7c98b5fb1
SHA5121fc7c3fe58d4a4079f98b76663fc157ea3377642fef6c65aa22cd008e6a09d6b5a8c5cd2d71dedab73182394929150f627d15395ed1496386f202ade0801a8a6
-
Filesize
3.1MB
MD5139c2c10ea78585f24f7d72a312841a3
SHA12ec38e48f5c93ef08445293b7875bb8d616ae167
SHA256223eb63b6ba3ab5b49d4b25d8a156d85e8b2e032d48d114594efec6886afcdf1
SHA512d1bc53e2322f530cb83a139676e74b6ae53330285338ef9b684ed6997da3de5d4151b1a5bba2359e1009e7b1d3bdd9af3738625c4ef9b7005d1c6c503bcbe37a
-
Filesize
3KB
MD534594291b554d2352d8cff8049857420
SHA117acaf3ef74bf461b5a8416c9a98645010b6ad9c
SHA256746e4215ebaf38a6f1ecb621f2aad56a593073570800c6c85aaf2e2a904dbf12
SHA51267d6a337216e7791cfe9991e2837c27589ac54f60a816cac9ab3d5e3511cd2e10565c8f32d6d85dfe07e49e62996fd7b817376f7272ff0d482fd46eef69bb592
-
Filesize
501KB
MD5483e622853fd61acc2af941f267f003e
SHA13e3dc784b51e4388688343dd2f9bcfeef127cb6d
SHA25601b7b10045ce8fbedab09335c76f2fcd13bdd8da9029abdb82f14ec90996d772
SHA51250e45ca0a63d95e07f9384b5241e3d387046445197c4abd7785b39b0741fa94115fa72c9aa49fb39d830a2bee3f1f98d9b08f714f6efd4fd5b7fff890edcfdfe
-
Filesize
458B
MD507b9a30265ca4e69c7016a1b6e3ffc27
SHA13a4af82a2695b1423aedd8b60a5c86793c011b02
SHA256c71152bf25e40d647b2440c5b39be157a3d356106be9d5b678ab97bb87b4e782
SHA512efd582f8edcdba5ef48d02eee5f73d83ff35071af99b49e08e0213928568d728d0856e3b903bfcccb9237f786846cf94da83139f99e9bee86287aff2071c3f1c
-
Filesize
3.3MB
MD522d59de01f6992d864847f174e8f6f66
SHA1033e058dfe3b2620b6093f9b9036d7e29956ec55
SHA2560e45b66753d93419cb1701c5be8fae5cc5878abce68af6465ae4430a8e7d26a1
SHA512c232a24e9bae9cb17ab18a6eed4a5e70527d2ca6d70d4d2f36d39e29cdbc0965fb881cd7635b22a4cad5d0e099cbaa0e27c42872c4183bc7ed7ec62988358beb
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
728KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB