| File name: | freetube-0.21.3-setup-x64.exe |
| Full analysis: | https://app.any.run/tasks/4eb525ab-d033-430f-b908-ac165935c866 |
| Verdict: | Malicious activity |
| Analysis date: | October 03, 2024, 07:49:53 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | 40AE42F6BEE1011C6878500A411ADE6F |
| SHA1: | E26F7CB399B886E9E6958EFF50C65B418877C06C |
| SHA256: | 79CE85EEF02C8514B05BDC692A89D4606CFD2F36554D4919A8666F4DAC07D82C |
| SSDEEP: | 786432:j8OLp1GzO2I2EFSXCnIhhJybIkIot13RHqS:j86p1hSpXGohsbIkpv3RKS |
MALICIOUS
No malicious indicators.SUSPICIOUS
The process creates files with name similar to system file names
- freetube-0.21.3-setup-x64.exe (PID: 5152)
Malware-specific behavior (creating "System.dll" in Temp)
- freetube-0.21.3-setup-x64.exe (PID: 5152)
Drops 7-zip archiver for unpacking
- freetube-0.21.3-setup-x64.exe (PID: 5152)
Executable content was dropped or overwritten
- freetube-0.21.3-setup-x64.exe (PID: 5152)
Process drops legitimate windows executable
- freetube-0.21.3-setup-x64.exe (PID: 5152)
Reads security settings of Internet Explorer
- freetube-0.21.3-setup-x64.exe (PID: 5152)
Creates a software uninstall entry
- freetube-0.21.3-setup-x64.exe (PID: 5152)
Application launched itself
- FreeTube.exe (PID: 3832)
INFO
Create files in a temporary directory
- freetube-0.21.3-setup-x64.exe (PID: 5152)
- FreeTube.exe (PID: 3832)
Reads the computer name
- freetube-0.21.3-setup-x64.exe (PID: 5152)
- FreeTube.exe (PID: 3832)
- FreeTube.exe (PID: 6988)
- FreeTube.exe (PID: 2128)
Checks supported languages
- freetube-0.21.3-setup-x64.exe (PID: 5152)
- FreeTube.exe (PID: 3832)
- FreeTube.exe (PID: 6988)
- FreeTube.exe (PID: 2128)
- FreeTube.exe (PID: 2036)
Creates files or folders in the user directory
- freetube-0.21.3-setup-x64.exe (PID: 5152)
- FreeTube.exe (PID: 3832)
- FreeTube.exe (PID: 2128)
Manual execution by a user
- FreeTube.exe (PID: 3832)
Checks proxy server information
- FreeTube.exe (PID: 3832)
Process checks computer location settings
- FreeTube.exe (PID: 3832)
- FreeTube.exe (PID: 2036)
Reads the machine GUID from the registry
- FreeTube.exe (PID: 3832)
Reads product name
- FreeTube.exe (PID: 3832)
Reads Environment values
- FreeTube.exe (PID: 3832)
Application launched itself
- msedge.exe (PID: 7016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2018:12:15 22:26:14+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 26624 |
| InitializedDataSize: | 473088 |
| UninitializedDataSize: | 16384 |
| EntryPoint: | 0x338f |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.21.3.0 |
| ProductVersionNumber: | 0.21.3.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | PrestonN |
| FileDescription: | A private YouTube client |
| FileVersion: | 0.21.3 |
| LegalCopyright: | Copyleft © 2020-2024 freetubeapp@protonmail.com |
| ProductName: | FreeTube |
| ProductVersion: | 0.21.3 |
Total processes
154
Monitored processes
37
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 68 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3748 --field-trial-handle=2444,i,9119867682836892924,4829148908369344025,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 304 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7272 --field-trial-handle=2444,i,9119867682836892924,4829148908369344025,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 488 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6940 --field-trial-handle=2444,i,9119867682836892924,4829148908369344025,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 640 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=1524 --field-trial-handle=2444,i,9119867682836892924,4829148908369344025,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 652 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2440 --field-trial-handle=2444,i,9119867682836892924,4829148908369344025,262144 --variations-seed-version /prefetch:2 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 772 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5952 --field-trial-handle=2444,i,9119867682836892924,4829148908369344025,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2020 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7096 --field-trial-handle=2444,i,9119867682836892924,4829148908369344025,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2036 | "C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\FreeTube" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --app-path="C:\Users\admin\AppData\Local\Programs\FreeTube\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2808,i,7645243186780939774,15024266970066591431,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:1 | C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe | — | FreeTube.exe | |||||||||||
User: admin Company: PrestonN Integrity Level: MEDIUM Description: FreeTube Version: 0.21.3 Modules
| |||||||||||||||
| 2128 | "C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\FreeTube" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --field-trial-handle=2016,i,7645243186780939774,15024266970066591431,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:3 | C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe | FreeTube.exe | ||||||||||||
User: admin Company: PrestonN Integrity Level: MEDIUM Description: FreeTube Version: 0.21.3 Modules
| |||||||||||||||
| 2144 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7248 --field-trial-handle=2444,i,9119867682836892924,4829148908369344025,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
Total events
5 928
Read events
5 858
Write events
52
Delete events
18
Modification events
| (PID) Process: | (5152) freetube-0.21.3-setup-x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\609c326f-6a5e-5cd1-9fc0-6e966fad073f |
| Operation: | write | Name: | InstallLocation |
Value: C:\Users\admin\AppData\Local\Programs\FreeTube | |||
| (PID) Process: | (5152) freetube-0.21.3-setup-x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\609c326f-6a5e-5cd1-9fc0-6e966fad073f |
| Operation: | write | Name: | KeepShortcuts |
Value: true | |||
| (PID) Process: | (5152) freetube-0.21.3-setup-x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\609c326f-6a5e-5cd1-9fc0-6e966fad073f |
| Operation: | write | Name: | ShortcutName |
Value: FreeTube | |||
| (PID) Process: | (5152) freetube-0.21.3-setup-x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f |
| Operation: | write | Name: | DisplayName |
Value: FreeTube 0.21.3 | |||
| (PID) Process: | (5152) freetube-0.21.3-setup-x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f |
| Operation: | write | Name: | UninstallString |
Value: "C:\Users\admin\AppData\Local\Programs\FreeTube\Uninstall FreeTube.exe" /currentuser | |||
| (PID) Process: | (5152) freetube-0.21.3-setup-x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f |
| Operation: | write | Name: | QuietUninstallString |
Value: "C:\Users\admin\AppData\Local\Programs\FreeTube\Uninstall FreeTube.exe" /currentuser /S | |||
| (PID) Process: | (5152) freetube-0.21.3-setup-x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f |
| Operation: | write | Name: | DisplayVersion |
Value: 0.21.3 | |||
| (PID) Process: | (5152) freetube-0.21.3-setup-x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe,0 | |||
| (PID) Process: | (5152) freetube-0.21.3-setup-x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f |
| Operation: | write | Name: | Publisher |
Value: PrestonN | |||
| (PID) Process: | (5152) freetube-0.21.3-setup-x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f |
| Operation: | write | Name: | NoModify |
Value: 1 | |||
Executable files
22
Suspicious files
236
Text files
63
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5152 | freetube-0.21.3-setup-x64.exe | C:\Users\admin\AppData\Local\Temp\nsgBD43.tmp\app-64.7z | — | |
MD5:— | SHA256:— | |||
| 5152 | freetube-0.21.3-setup-x64.exe | C:\Users\admin\AppData\Local\Temp\nsgBD43.tmp\7z-out\icudtl.dat | — | |
MD5:— | SHA256:— | |||
| 5152 | freetube-0.21.3-setup-x64.exe | C:\Users\admin\AppData\Local\Temp\nsgBD43.tmp\7z-out\LICENSES.chromium.html | — | |
MD5:— | SHA256:— | |||
| 5152 | freetube-0.21.3-setup-x64.exe | C:\Users\admin\AppData\Local\Temp\nsgBD43.tmp\nsis7z.dll | executable | |
MD5:80E44CE4895304C6A3A831310FBF8CD0 | SHA256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592 | |||
| 5152 | freetube-0.21.3-setup-x64.exe | C:\Users\admin\AppData\Local\Temp\nsgBD43.tmp\UAC.dll | executable | |
MD5:ADB29E6B186DAA765DC750128649B63D | SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08 | |||
| 5152 | freetube-0.21.3-setup-x64.exe | C:\Users\admin\AppData\Local\Temp\nsgBD43.tmp\nsDialogs.dll | executable | |
MD5:466179E1C8EE8A1FF5E4427DBB6C4A01 | SHA256:1E40211AF65923C2F4FD02CE021458A7745D28E2F383835E3015E96575632172 | |||
| 5152 | freetube-0.21.3-setup-x64.exe | C:\Users\admin\AppData\Local\Temp\nsgBD43.tmp\System.dll | executable | |
MD5:0D7AD4F45DC6F5AA87F606D0331C6901 | SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA | |||
| 5152 | freetube-0.21.3-setup-x64.exe | C:\Users\admin\AppData\Local\Temp\nsgBD43.tmp\7z-out\chrome_200_percent.pak | binary | |
MD5:E9C1423FE5D139A4C88BA8B107573536 | SHA256:2408969599D3953AAE2FB36008E4D0711E30D0BC86FB4D03F8B0577D43C649FA | |||
| 5152 | freetube-0.21.3-setup-x64.exe | C:\Users\admin\AppData\Local\Temp\nsgBD43.tmp\7z-out\LICENSE.electron.txt | text | |
MD5:4D42118D35941E0F664DDDBD83F633C5 | SHA256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D | |||
| 5152 | freetube-0.21.3-setup-x64.exe | C:\Users\admin\AppData\Local\Temp\nsgBD43.tmp\modern-wizard.bmp | image | |
MD5:52FF52EEE3B944B862C11C268A02C196 | SHA256:2079F7A3EBA60E0D9EE827A7208AA052A71B384873B641DE5E299AEB8E733109 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
115
TCP/UDP connections
111
DNS requests
54
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
8 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | DE | binary | 973 b | whitelisted |
2120 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | DE | binary | 973 b | whitelisted |
— | — | GET | 401 | 13.107.6.158:443 | https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox | US | — | — | unknown |
— | — | OPTIONS | 503 | 23.48.23.51:443 | https://bzib.nelreports.net/api/report?cat=bingbusiness | US | — | — | unknown |
— | — | POST | 200 | 50.56.249.138:443 | https://blog.freetubeapp.io/api/collections/freetube/posts/p2om9xgib872hkzo/stat | US | — | — | unknown |
— | — | GET | 200 | 174.143.201.50:443 | https://write.as/freetube/feed/ | US | xml | 262 Kb | whitelisted |
— | — | GET | 200 | 93.95.230.186:443 | https://api.invidious.io/instances.json | IS | text | 5.37 Kb | unknown |
— | — | POST | 200 | 104.208.16.91:443 | https://browser.pipe.aria.microsoft.com/Collector/3.0/?qsp=true&content-type=application%2Fbond-compact-binary&client-id=NO_AUTH&sdk-version=AWT-Web-CJS-1.2.0&x-apikey=33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176 | US | — | — | whitelisted |
— | — | GET | 200 | 13.107.246.64:443 | https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable | US | binary | 13.2 Kb | whitelisted |
— | — | GET | 200 | 65.9.95.77:443 | https://cdn.writeas.net/js/localdate.js | US | text | 697 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
8 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2120 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5336 | SearchApp.exe | 104.208.16.91:443 | browser.pipe.aria.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2128 | FreeTube.exe | 93.95.230.186:443 | api.invidious.io | 1984 ehf | IS | unknown |
2128 | FreeTube.exe | 174.143.201.50:443 | write.as | RMH-14 | US | whitelisted |
2128 | FreeTube.exe | 140.82.121.6:443 | api.github.com | GITHUB | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
browser.pipe.aria.microsoft.com |
| whitelisted |
api.invidious.io |
| unknown |
api.github.com |
| whitelisted |
write.as |
| whitelisted |
config.edge.skype.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
edge-mobile-static.azureedge.net |
| whitelisted |
Threats
1 ETPRO signatures available at the full report