Overview

overview

10

Static

static

7eb1b46c43...9e.msi

windows7_x64

10

7eb1b46c43...9e.msi

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    28-02-2022 18:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7eb1b46c43a2290eb2631ea061da7258591e37da9f784e9dc890f1a27d292d9e.msi

  • Size

    5.8MB

  • MD5

    114daaf4ec2fa86c801300439044d946

  • SHA1

    9da80d1bed43da4c74f4a0957a580d4e7839f434

  • SHA256

    7eb1b46c43a2290eb2631ea061da7258591e37da9f784e9dc890f1a27d292d9e

  • SHA512

    ec9333ab61e3e61b4c373dc349d8ecff7145c6bc59b409b658ea2bd2c45ad441ce1a121ac9515764c8c2d2642c5175b8ca6d40328cf84f700dd156e2fbaeb8e0

Score
10/10
babadedaphoboscrypterevasionloaderpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda
  • Babadeda Crypter 3 IoCs
  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Executes dropped EXE 3 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops startup file 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 15 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Detects BABADEDA Crypter 3 IoCs

    Detects BABADEDA Crypter.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\7eb1b46c43a2290eb2631ea061da7258591e37da9f784e9dc890f1a27d292d9e.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2248
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 87A3FBA63D56B09EF807ED235AEEF3F2
      2⤵
      • Loads dropped DLL
      PID:3064
    • C:\Users\Admin\AppData\Roaming\AlfaReader\lfaReader Install\AAMCustomHook.exe
      "C:\Users\Admin\AppData\Roaming\AlfaReader\lfaReader Install\AAMCustomHook.exe"
      2⤵
      • Executes dropped EXE
      PID:3620
    • C:\Users\Admin\AppData\Roaming\AlfaReader\lfaReader Install\PDapp.exe
      "C:\Users\Admin\AppData\Roaming\AlfaReader\lfaReader Install\PDapp.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Users\Admin\AppData\Roaming\AlfaReader\lfaReader Install\PDapp.exe
        "C:\Users\Admin\AppData\Roaming\AlfaReader\lfaReader Install\PDapp.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2644
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set currentprofile state off
          4⤵
            PID:2736
          • C:\Windows\system32\netsh.exe
            netsh firewall set opmode mode=disable
            4⤵
              PID:624
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1932
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:3064
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic shadowcopy delete
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3596
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:1904
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled no
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:1188
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              4⤵
              • Deletes backup catalog
              PID:1548
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x4e8 0x510
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3320
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:968
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
          PID:2988
        • C:\Windows\System32\vdsldr.exe
          C:\Windows\System32\vdsldr.exe -Embedding
          1⤵
            PID:3580
          • C:\Windows\System32\vds.exe
            C:\Windows\System32\vds.exe
            1⤵
            • Checks SCSI registry key(s)
            PID:3724

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2396-166-0x0000000002D40000-0x0000000002D53000-memory.dmp

            Filesize

            76KB

            Download

          • memory/2396-184-0x0000000004BB0000-0x0000000008DB0000-memory.dmp

            Filesize

            66.0MB

            Download

          • memory/2644-179-0x0000000002FB0000-0x0000000002FC3000-memory.dmp

            Filesize

            76KB

            Download

          • memory/2644-183-0x0000000004EE0000-0x00000000090E0000-memory.dmp

            Filesize

            66.0MB

            Download