Analysis
-
max time kernel
83s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
05-01-2023 18:20
General
-
Target
clipgrab-3.9.7-dotinstaller.exe
-
Size
2.8MB
-
MD5
0f29445baa824f6729cbda3d90b15cec
-
SHA1
572195b4193529d842653e678eeec7dc3544ee2f
-
SHA256
f980e92af3341650819ca6c985294ebe0aa78d38bdfe249536d7ec7f2efc6ecf
-
SHA512
a05bb0cb18d3c7e0ce5795397beeaee90078c272afccf5211d911eae4bc39078bed7da22c528e77ed4daea1c1b4e736c2f361cdb6e525e4132ba4793e433cc81
-
SSDEEP
49152:9qe3f6PUk/4g+H98AHaCfu6rtWBu1SSmqOIzDamifOL9T9vEXv:MSiPUk/XE9vBugtL1SNaRLh9vEXv
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 11 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\clipgrab-3.9.7-dotinstaller.exe"C:\Users\Admin\AppData\Local\Temp\clipgrab-3.9.7-dotinstaller.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MTF9T.tmp\clipgrab-3.9.7-dotinstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-MTF9T.tmp\clipgrab-3.9.7-dotinstaller.tmp" /SL5="$A011C,1907617,1111552,C:\Users\Admin\AppData\Local\Temp\clipgrab-3.9.7-dotinstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E0Q7A.tmp\clipgrab-3.9.7-portable.exe"C:\Users\Admin\AppData\Local\Temp\is-E0Q7A.tmp\clipgrab-3.9.7-portable.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-G7N7E.tmp\clipgrab-3.9.7-portable.tmp"C:\Users\Admin\AppData\Local\Temp\is-G7N7E.tmp\clipgrab-3.9.7-portable.tmp" /SL5="$101AA,72952445,791040,C:\Users\Admin\AppData\Local\Temp\is-E0Q7A.tmp\clipgrab-3.9.7-portable.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-56A1R.tmp\vc_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-56A1R.tmp\vc_redist.x86.exe" /install /passive /silent /norestart5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{46F89460-7F93-4FF5-98D5-58452FCDF2FD}\.cr\vc_redist.x86.exe"C:\Windows\Temp\{46F89460-7F93-4FF5-98D5-58452FCDF2FD}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-56A1R.tmp\vc_redist.x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /passive /silent /norestart6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.0MB
MD5310f8aadd8055f8b8eba1a6528be7d10
SHA13ee9622151e4b50837fcdfac1b085430f0181f4e
SHA25654ad46ae80984aa48cae6361213692c96b3639e322730d28c7fb93b183c761da
SHA5122872a30939f7ee20b494806574cf5b8b5a0976f8fe69bdbd77dde2483ce2a9e5458ff3636147e49a449e941a44ca2d79239e3da62fddb69fc5bced8ee1004ee5
-
Filesize
14.0MB
MD5310f8aadd8055f8b8eba1a6528be7d10
SHA13ee9622151e4b50837fcdfac1b085430f0181f4e
SHA25654ad46ae80984aa48cae6361213692c96b3639e322730d28c7fb93b183c761da
SHA5122872a30939f7ee20b494806574cf5b8b5a0976f8fe69bdbd77dde2483ce2a9e5458ff3636147e49a449e941a44ca2d79239e3da62fddb69fc5bced8ee1004ee5
-
Filesize
70.3MB
MD5962d6f9e7331b8f3eb2fa4acb15f5f61
SHA12e1a7e9ec7159e564814a599657d42dc01ef9858
SHA2560ae8656f4c65673d75544cff54721cbfc586edd6e8b4b2a2070930684920411e
SHA512f8721fc68703d6a6ab9188bce1d64774447f02f378dd4b4d267f7fb4b01d42c4520feede2855ab426d92dfc538a1d272d7a88e65871015a95654c3d8f321d3be
-
Filesize
70.3MB
MD5962d6f9e7331b8f3eb2fa4acb15f5f61
SHA12e1a7e9ec7159e564814a599657d42dc01ef9858
SHA2560ae8656f4c65673d75544cff54721cbfc586edd6e8b4b2a2070930684920411e
SHA512f8721fc68703d6a6ab9188bce1d64774447f02f378dd4b4d267f7fb4b01d42c4520feede2855ab426d92dfc538a1d272d7a88e65871015a95654c3d8f321d3be
-
Filesize
2.5MB
MD5ae7b203e80eaa5afb50768049bb3de50
SHA1cc0b5d64c2af21a3b24e167352df8ae93acd30d3
SHA256ffe5d85efc5b75b4c99b07f5819d1fb3b9b1b42e67c903ef86f013bdedad7112
SHA512a94cc199a4fa8a67496169de972bef84dd0e411502c5f74438ec0e7d18626ef3278d9c3aae1b0d025776849dbed5ec8e06d714b4bd48a43e48e2a167f7d52748
-
Filesize
2.5MB
MD5ae7b203e80eaa5afb50768049bb3de50
SHA1cc0b5d64c2af21a3b24e167352df8ae93acd30d3
SHA256ffe5d85efc5b75b4c99b07f5819d1fb3b9b1b42e67c903ef86f013bdedad7112
SHA512a94cc199a4fa8a67496169de972bef84dd0e411502c5f74438ec0e7d18626ef3278d9c3aae1b0d025776849dbed5ec8e06d714b4bd48a43e48e2a167f7d52748
-
Filesize
3.2MB
MD5aadc16c8ad4312196df3aa1d9f6386d3
SHA1ff4d78923e0d957e6a66b3c06efecc435c396c7a
SHA25604fade43204ecbbb378114a023b3db4a3aebe8258ff3b3846156e80a9c5cf4a3
SHA51251621ec71d530d75e4a537381edf03bc48b234dd861547c950573febf5709a1716ee797368854512edf1950a4e1f4f8bbe292417a0dd238600338a39e2454e04
-
Filesize
881KB
MD59df0848b2753e9255f1a6b4cdc9a5a3e
SHA1051469cd9e786b720ef6b70c35a1e184a643f520
SHA25659089badd61acb47a07748c9018d3a959cf58f07de9902b0c45dffae3e566090
SHA512518a78e77515b2fb21c5f66a760473a1f8ab5050e9bc65a4715ab178e568079f11f65fc173db59dd021b69fe0b606c42e50bf5f09a34ba2009a7b71e88033452
-
Filesize
881KB
MD59df0848b2753e9255f1a6b4cdc9a5a3e
SHA1051469cd9e786b720ef6b70c35a1e184a643f520
SHA25659089badd61acb47a07748c9018d3a959cf58f07de9902b0c45dffae3e566090
SHA512518a78e77515b2fb21c5f66a760473a1f8ab5050e9bc65a4715ab178e568079f11f65fc173db59dd021b69fe0b606c42e50bf5f09a34ba2009a7b71e88033452
-
Filesize
1.1MB
MD557cdd2bc92aee7d3d213561188e565d4
SHA1fb34ba0178b5764b6ccc9d228796196ee172980e
SHA25610770da581cc85d55a286d42a0428accafe6c7910bc640cc4264da7fb26dafa4
SHA512ac00f5021cbc34b7ca160364cdde0a404353d8fc9e6a46866884268880c7b753e91741c48b413d6f7a5ff28a4e3d98bd7485550b46009a7c5b42dd0a877f3856
-
Filesize
1.1MB
MD557cdd2bc92aee7d3d213561188e565d4
SHA1fb34ba0178b5764b6ccc9d228796196ee172980e
SHA25610770da581cc85d55a286d42a0428accafe6c7910bc640cc4264da7fb26dafa4
SHA512ac00f5021cbc34b7ca160364cdde0a404353d8fc9e6a46866884268880c7b753e91741c48b413d6f7a5ff28a4e3d98bd7485550b46009a7c5b42dd0a877f3856
-
Filesize
2.5MB
MD5713651dc6a72f22021036563f4bfb3b9
SHA1a09bead30eaa159688bef41f86b5843e61b65f28
SHA25669605ea2bb1301ab9dc8b17523a013de325d02f5b35d47ab6cc0fb9a3855ca07
SHA512c66749b235273cb6872a7938ae55c4aaa809297aaa0e4c063b542690b4485e6f20fe5ac2da92068a926ec3beace10361c6868815e9fe0ac33fcfbf3b2138dc91
-
Filesize
14.0MB
MD5310f8aadd8055f8b8eba1a6528be7d10
SHA13ee9622151e4b50837fcdfac1b085430f0181f4e
SHA25654ad46ae80984aa48cae6361213692c96b3639e322730d28c7fb93b183c761da
SHA5122872a30939f7ee20b494806574cf5b8b5a0976f8fe69bdbd77dde2483ce2a9e5458ff3636147e49a449e941a44ca2d79239e3da62fddb69fc5bced8ee1004ee5
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
70.3MB
MD5962d6f9e7331b8f3eb2fa4acb15f5f61
SHA12e1a7e9ec7159e564814a599657d42dc01ef9858
SHA2560ae8656f4c65673d75544cff54721cbfc586edd6e8b4b2a2070930684920411e
SHA512f8721fc68703d6a6ab9188bce1d64774447f02f378dd4b4d267f7fb4b01d42c4520feede2855ab426d92dfc538a1d272d7a88e65871015a95654c3d8f321d3be
-
Filesize
2.0MB
MD5e1f18a22199c6f6aa5d87b24e5b39ef1
SHA10dcd8f90b575f6f1d10d6789fe769fa26daafd0e
SHA25662c56c8cf2ac6521ce047b73aa99b6d3952ca53f11d34b00e98d17674a2fc10d
SHA5125a10a2f096adce6e7db3a40bc3ea3fd44d602966e606706ee5a780703f211de7f77656c79c296390baee1e008dc3ce327eaaf5d78bbae20108670c5bc809a190
-
Filesize
2.5MB
MD5ae7b203e80eaa5afb50768049bb3de50
SHA1cc0b5d64c2af21a3b24e167352df8ae93acd30d3
SHA256ffe5d85efc5b75b4c99b07f5819d1fb3b9b1b42e67c903ef86f013bdedad7112
SHA512a94cc199a4fa8a67496169de972bef84dd0e411502c5f74438ec0e7d18626ef3278d9c3aae1b0d025776849dbed5ec8e06d714b4bd48a43e48e2a167f7d52748
-
Filesize
3.2MB
MD5aadc16c8ad4312196df3aa1d9f6386d3
SHA1ff4d78923e0d957e6a66b3c06efecc435c396c7a
SHA25604fade43204ecbbb378114a023b3db4a3aebe8258ff3b3846156e80a9c5cf4a3
SHA51251621ec71d530d75e4a537381edf03bc48b234dd861547c950573febf5709a1716ee797368854512edf1950a4e1f4f8bbe292417a0dd238600338a39e2454e04
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
881KB
MD59df0848b2753e9255f1a6b4cdc9a5a3e
SHA1051469cd9e786b720ef6b70c35a1e184a643f520
SHA25659089badd61acb47a07748c9018d3a959cf58f07de9902b0c45dffae3e566090
SHA512518a78e77515b2fb21c5f66a760473a1f8ab5050e9bc65a4715ab178e568079f11f65fc173db59dd021b69fe0b606c42e50bf5f09a34ba2009a7b71e88033452
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB