Overview
overview
7Static
static
10freetube-0...64.exe
windows7-x64
7freetube-0...64.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3FreeTube.exe
windows10-2004-x64
7LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/app.js
windows7-x64
3resources/app.js
windows10-2004-x64
3resources/elevate.exe
windows7-x64
3resources/elevate.exe
windows10-2004-x64
3vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$R0/Uninst...be.exe
windows7-x64
7$R0/Uninst...be.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
submitted
03-10-2024 07:49
Behavioral task
behavioral1
Sample
freetube-0.21.3-setup-x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
freetube-0.21.3-setup-x64.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
FreeTube.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.js
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/elevate.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/elevate.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
vk_swiftshader.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
vulkan-1.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$R0/Uninstall FreeTube.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
$R0/Uninstall FreeTube.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
FreeTube.exe
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation FreeTube.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation FreeTube.exe -
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\freetube\ = "URL:freetube" FreeTube.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\freetube\shell\open\command FreeTube.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\freetube\shell FreeTube.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\freetube\shell\open FreeTube.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\freetube\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\FreeTube.exe\" \"%1\"" FreeTube.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\freetube FreeTube.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\freetube\URL Protocol FreeTube.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3208 FreeTube.exe 3208 FreeTube.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe Token: SeShutdownPrivilege 1504 FreeTube.exe Token: SeCreatePagefilePrivilege 1504 FreeTube.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3628 1504 FreeTube.exe 81 PID 1504 wrote to memory of 3112 1504 FreeTube.exe 82 PID 1504 wrote to memory of 3112 1504 FreeTube.exe 82 PID 1504 wrote to memory of 3544 1504 FreeTube.exe 83 PID 1504 wrote to memory of 3544 1504 FreeTube.exe 83 PID 1504 wrote to memory of 3208 1504 FreeTube.exe 93 PID 1504 wrote to memory of 3208 1504 FreeTube.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"C:\Users\Admin\AppData\Local\Temp\FreeTube.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\FreeTube" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,16959354699950456562,15367271183999927206,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:22⤵PID:3628
-
-
C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"C:\Users\Admin\AppData\Local\Temp\FreeTube.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\FreeTube" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --field-trial-handle=2124,i,16959354699950456562,15367271183999927206,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:32⤵PID:3112
-
-
C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"C:\Users\Admin\AppData\Local\Temp\FreeTube.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\FreeTube" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2972,i,16959354699950456562,15367271183999927206,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:12⤵
- Checks computer location settings
PID:3544
-
-
C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"C:\Users\Admin\AppData\Local\Temp\FreeTube.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\FreeTube" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3312,i,16959354699950456562,15367271183999927206,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
454B
MD58ea6b783854edb6ade09db5240cbc46e
SHA168df660f85be3f851ead32ec695f674d33f62fe4
SHA2563d39949d36e23403e8ceedeca5cca00dbfeb193443d88dc555b5a383bc24bd52
SHA5122da835ce48bcbb030be7ea9db7bf811bc5b114fdd63948fb6ec08754a3445a953c2abc0912f678e20cc9aa5b362c7c23ca9d1bbb4dd8e22ecb2a0f3df2b7b681
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84