Analysis
-
max time kernel
163s -
max time network
177s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
18-02-2022 08:14
Static task
static1
Behavioral task
behavioral1
Sample
42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe
-
Size
122.5MB
-
MD5
c893af41e33ca5da0a8acf8ac623c2ae
-
SHA1
65412f1aa3839e41a00adc2ebc7162880c258be7
-
SHA256
42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778
-
SHA512
20474b4ab6e85a7b33d544a5f8cdb5d6b03b86ee67b07a54a17ee6358d51abdcd0711a78999fceb83f971590707c62941f0d2c5d18abc1c091694ea29ceb517f
Malware Config
Signatures
-
Babadeda Crypter 1 IoCs
resource yara_rule behavioral1/memory/1752-124-0x0000000003D00000-0x0000000008E00000-memory.dmp family_babadeda -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1872 msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1752 iisexpress.exe -
Loads dropped DLL 64 IoCs
pid Process 1576 MsiExec.exe 1576 MsiExec.exe 1576 MsiExec.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe 1752 iisexpress.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIE58A.tmp msiexec.exe File created C:\Windows\Installer\f76da4a.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIE78F.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76da4a.ipi msiexec.exe File created C:\Windows\Installer\f76da48.msi msiexec.exe File opened for modification C:\Windows\Installer\f76da48.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE451.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE5D9.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Detects BABADEDA Crypter 1 IoCs
Detects BABADEDA Crypter.
resource yara_rule behavioral1/memory/1752-124-0x0000000003D00000-0x0000000008E00000-memory.dmp BABADEDA_Crypter -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1872 msiexec.exe 1872 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1752 iisexpress.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 960 msiexec.exe Token: SeIncreaseQuotaPrivilege 960 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeSecurityPrivilege 1872 msiexec.exe Token: SeCreateTokenPrivilege 960 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 960 msiexec.exe Token: SeLockMemoryPrivilege 960 msiexec.exe Token: SeIncreaseQuotaPrivilege 960 msiexec.exe Token: SeMachineAccountPrivilege 960 msiexec.exe Token: SeTcbPrivilege 960 msiexec.exe Token: SeSecurityPrivilege 960 msiexec.exe Token: SeTakeOwnershipPrivilege 960 msiexec.exe Token: SeLoadDriverPrivilege 960 msiexec.exe Token: SeSystemProfilePrivilege 960 msiexec.exe Token: SeSystemtimePrivilege 960 msiexec.exe Token: SeProfSingleProcessPrivilege 960 msiexec.exe Token: SeIncBasePriorityPrivilege 960 msiexec.exe Token: SeCreatePagefilePrivilege 960 msiexec.exe Token: SeCreatePermanentPrivilege 960 msiexec.exe Token: SeBackupPrivilege 960 msiexec.exe Token: SeRestorePrivilege 960 msiexec.exe Token: SeShutdownPrivilege 960 msiexec.exe Token: SeDebugPrivilege 960 msiexec.exe Token: SeAuditPrivilege 960 msiexec.exe Token: SeSystemEnvironmentPrivilege 960 msiexec.exe Token: SeChangeNotifyPrivilege 960 msiexec.exe Token: SeRemoteShutdownPrivilege 960 msiexec.exe Token: SeUndockPrivilege 960 msiexec.exe Token: SeSyncAgentPrivilege 960 msiexec.exe Token: SeEnableDelegationPrivilege 960 msiexec.exe Token: SeManageVolumePrivilege 960 msiexec.exe Token: SeImpersonatePrivilege 960 msiexec.exe Token: SeCreateGlobalPrivilege 960 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1752 iisexpress.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1276 wrote to memory of 960 1276 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe 27 PID 1276 wrote to memory of 960 1276 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe 27 PID 1276 wrote to memory of 960 1276 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe 27 PID 1276 wrote to memory of 960 1276 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe 27 PID 1276 wrote to memory of 960 1276 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe 27 PID 1276 wrote to memory of 960 1276 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe 27 PID 1276 wrote to memory of 960 1276 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe 27 PID 1872 wrote to memory of 1576 1872 msiexec.exe 29 PID 1872 wrote to memory of 1576 1872 msiexec.exe 29 PID 1872 wrote to memory of 1576 1872 msiexec.exe 29 PID 1872 wrote to memory of 1576 1872 msiexec.exe 29 PID 1872 wrote to memory of 1576 1872 msiexec.exe 29 PID 1872 wrote to memory of 1576 1872 msiexec.exe 29 PID 1872 wrote to memory of 1576 1872 msiexec.exe 29 PID 1872 wrote to memory of 1752 1872 msiexec.exe 30 PID 1872 wrote to memory of 1752 1872 msiexec.exe 30 PID 1872 wrote to memory of 1752 1872 msiexec.exe 30 PID 1872 wrote to memory of 1752 1872 msiexec.exe 30 PID 1872 wrote to memory of 1752 1872 msiexec.exe 30 PID 1872 wrote to memory of 1752 1872 msiexec.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe"C:\Users\Admin\AppData\Local\Temp\42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi" /q2⤵
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89C051B2DDA7F5B6B63173E918FC29B72⤵
- Loads dropped DLL
PID:1576
-
-
C:\Users\Admin\AppData\Roaming\Plex, Inc\Plex Media Server DLNA\iisexpress.exe"C:\Users\Admin\AppData\Roaming\Plex, Inc\Plex Media Server DLNA\iisexpress.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1752
-