Overview
overview
10Static
static
10freetube-0...64.exe
windows7-x64
7freetube-0...64.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3FreeTube.exe
windows10-2004-x64
7LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/app.js
windows7-x64
3resources/app.js
windows10-2004-x64
3resources/elevate.exe
windows7-x64
3resources/elevate.exe
windows10-2004-x64
3vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$R0/Uninst...be.exe
windows7-x64
7$R0/Uninst...be.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 18:20
Behavioral task
behavioral1
Sample
freetube-0.21.3-setup-x64.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
freetube-0.21.3-setup-x64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
FreeTube.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/elevate.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/elevate.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
vk_swiftshader.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
vulkan-1.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$R0/Uninstall FreeTube.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral31
Sample
$R0/Uninstall FreeTube.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
FreeTube.exe
-
Size
172.4MB
-
MD5
2da1d5d9f765d14532a1e5c99922556f
-
SHA1
4f36a8b6a8b675f6e1067d103f882693ad3ba380
-
SHA256
b3f9fd69f95bd8dd7995966cf5b517ca3a7258a20f543a91d61189b2c089e59e
-
SHA512
d1c9fccc398da6ff949bae425c57b3c206dcea31bb914f28fcf7fc874aa3ba3c4ba33fe7063f678e739bb384ae5d22684f7ae893a9e6a7fccc9c37a9c958eb1e
-
SSDEEP
1572864:RSl+fyef/Uzaajg8s20fFbu2/zi9Gd7ePKro1yjrWR5xWVFYxNxOLh:rexNoL
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation FreeTube.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation FreeTube.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\freetube FreeTube.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\freetube\URL Protocol FreeTube.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\freetube\ = "URL:freetube" FreeTube.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\freetube\shell\open\command FreeTube.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\freetube\shell FreeTube.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\freetube\shell\open FreeTube.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\freetube\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\FreeTube.exe\" \"%1\"" FreeTube.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1488 FreeTube.exe 1488 FreeTube.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe Token: SeShutdownPrivilege 2556 FreeTube.exe Token: SeCreatePagefilePrivilege 2556 FreeTube.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 2564 2556 FreeTube.exe 81 PID 2556 wrote to memory of 1344 2556 FreeTube.exe 82 PID 2556 wrote to memory of 1344 2556 FreeTube.exe 82 PID 2556 wrote to memory of 4492 2556 FreeTube.exe 83 PID 2556 wrote to memory of 4492 2556 FreeTube.exe 83 PID 2556 wrote to memory of 1488 2556 FreeTube.exe 93 PID 2556 wrote to memory of 1488 2556 FreeTube.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"C:\Users\Admin\AppData\Local\Temp\FreeTube.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\FreeTube" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,13609227404214577729,12623960935318545502,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:22⤵PID:2564
-
-
C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"C:\Users\Admin\AppData\Local\Temp\FreeTube.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\FreeTube" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --field-trial-handle=1936,i,13609227404214577729,12623960935318545502,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:32⤵PID:1344
-
-
C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"C:\Users\Admin\AppData\Local\Temp\FreeTube.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\FreeTube" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2876,i,13609227404214577729,12623960935318545502,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:12⤵
- Checks computer location settings
PID:4492
-
-
C:\Users\Admin\AppData\Local\Temp\FreeTube.exe"C:\Users\Admin\AppData\Local\Temp\FreeTube.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\FreeTube" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2864,i,13609227404214577729,12623960935318545502,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
454B
MD524c97c032c2be2b02fd49ca074eca043
SHA1424fdfc5774cf6b9d7b5d021ecd85d573e60b493
SHA256eba0fe15d043bac5c4664c5d26958365d3204f61e0543709fe43ee55f3fa910a
SHA512390c0a4b9c006291fde0ff41c2ccebe30c7bdd34aa646ad3b9bd73957bf8d3db5dab6a91166fe4c118d42051118c013e2dfacc4c1c15a0aa5bfccfa9304f0cbf
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84