Analysis
-
max time kernel
142s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
15-12-2023 16:43
General
-
Target
entry_1_0/clipgrab-3.9.7-dotinstaller.exe
-
Size
2.8MB
-
MD5
0f29445baa824f6729cbda3d90b15cec
-
SHA1
572195b4193529d842653e678eeec7dc3544ee2f
-
SHA256
f980e92af3341650819ca6c985294ebe0aa78d38bdfe249536d7ec7f2efc6ecf
-
SHA512
a05bb0cb18d3c7e0ce5795397beeaee90078c272afccf5211d911eae4bc39078bed7da22c528e77ed4daea1c1b4e736c2f361cdb6e525e4132ba4793e433cc81
-
SSDEEP
49152:9qe3f6PUk/4g+H98AHaCfu6rtWBu1SSmqOIzDamifOL9T9vEXv:MSiPUk/XE9vBugtL1SNaRLh9vEXv
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 11 IoCs
-
Checks for any installed AV software in registry 1 TTPs 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\entry_1_0\clipgrab-3.9.7-dotinstaller.exe"C:\Users\Admin\AppData\Local\Temp\entry_1_0\clipgrab-3.9.7-dotinstaller.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JE1E3.tmp\clipgrab-3.9.7-dotinstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-JE1E3.tmp\clipgrab-3.9.7-dotinstaller.tmp" /SL5="$30150,1907617,1111552,C:\Users\Admin\AppData\Local\Temp\entry_1_0\clipgrab-3.9.7-dotinstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1K1S3.tmp\clipgrab-3.9.7-portable.exe"C:\Users\Admin\AppData\Local\Temp\is-1K1S3.tmp\clipgrab-3.9.7-portable.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SL5OD.tmp\clipgrab-3.9.7-portable.tmp"C:\Users\Admin\AppData\Local\Temp\is-SL5OD.tmp\clipgrab-3.9.7-portable.tmp" /SL5="$5015A,72952445,791040,C:\Users\Admin\AppData\Local\Temp\is-1K1S3.tmp\clipgrab-3.9.7-portable.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VJEBK.tmp\vc_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-VJEBK.tmp\vc_redist.x86.exe" /install /passive /silent /norestart5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{008F1837-C741-466E-B304-42A2A1270384}\.cr\vc_redist.x86.exe"C:\Windows\Temp\{008F1837-C741-466E-B304-42A2A1270384}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-VJEBK.tmp\vc_redist.x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /passive /silent /norestart6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD5a50ed0dab22768932c2a546d960345f7
SHA1c6147cff0a3275a736c5188dba9e2027fd05ce32
SHA256a504fc903a922b9c966423854e086657777cf718c6646773e40a1822adce82f1
SHA5120c70e0bfcf441d2b6c0bc336e479f014e4324fc756fcc4a98d558be869b1ba0ec79a22bd175cfb102555cdaf10f7278cd3d557918882be58915a8246d2c349a2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
344B
MD5c7b64ba2815d6c065f552cc6ef1fd8d2
SHA154aa6c52feab999d1643f0e7ca94a2833368f49c
SHA25624e159c0c07fb42a90d45db39f5f7e977c97155dbf6022d5287b1848baccbc32
SHA5129a191ed8c8d3ab98bd0d3aad4b224bd6725accd2cf76e31dd05ebe8b432be58c1241ea580daebf659a76b0acc5c24850c39c99b1f73dc07f9265c8f9ef66d273
-
Filesize
242B
MD536f25b4dc67ee31baf971507e0883447
SHA1bfca7429a21ef3f334e8549fe0959bc2da197643
SHA25608e7b0e171c72829a2096f416083ad92e20c95435feb16d813a9230c0b4f9ecb
SHA512809c0e3286b31ae62a868454a103e41f61df9faa5a7808cc244ee0fd70ad92ba8023f63581007a373c62ee87961f5ec7d3cccd05c25de9c03a41e7ffa01c23b4
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
114KB
MD55ef5291810c454a35f76d976105f37cc
SHA18ce0cc65ae1786cef1c545d40d081eda13239fa6
SHA25603e69e8c87732c625df2f628ac63bd145268f9dea9c5f3dd3670b1cf349a995c
SHA5123bec461bb3cbbbdb3c05171fcc5ab7e648b2b60d7b811261662f14d35c3836148b14cda1a3f2be127c89cc732de8cf1644d2e55e049eeeb2da8e397c58cc919e
-
Filesize
33KB
MD5db6c259cd7b58f2f7a3cca0c38834d0e
SHA1046fd119fe163298324ddcd47df62fa8abcae169
SHA256494169cdd9c79eb4668378f770bfa55d4b140f23a682ff424441427dfab0ced2
SHA512a5e8bb6dc4cae51d4ebbe5454d1b11bc511c69031db64eff089fb2f8f68665f4004f0f215b503f7630a56c995bbe9cf72e8744177e92447901773cc7e2d9fdbb
-
Filesize
1.7MB
MD57e480db1eaec0e2371ab3ca53286052e
SHA175188bbb3aa88aad59cdc73af01d03b09c86c9a5
SHA2567efaa65f8c8b92d93c162784f3d4c06c639f4d269e973268abf2c9b59c3f3e43
SHA5128487621224a3d92dfa0627022f1128be103d4d5f89a39dd1f18bcdbbec3824167056a71c38796c30df93461117726d7a597cfa926fe9f1ddbac74ce79c72baa1
-
Filesize
1.3MB
MD58cef710958aa258c28b46c3817ba97c5
SHA1296270a6439d2bd056c363970b0835c80af5fa36
SHA256263d6814be3a6fae8536c851344d03dd735c78e77228c6c98840c6c590bfe6d4
SHA512eadf6d28b1873f1668ce091945ace4c40f21470c840b6b6a7151754bcdf4951718058b2bc1c262b28486bc22074894df3a0a2ec47faf24d3e33f5f8464790250
-
Filesize
1.3MB
MD5d2b266e23437336ec142c0b7332fe793
SHA18f938f7375c867b3a0b2b0df66fdd43368c19deb
SHA256f3ea8404867f4a8fd315167a104e79133d9fde311d015393ba09ce2d85f89f40
SHA51288fa14a64759de2568892ec0c9891163d0588e283d07ebddef8bb012f0bad8dbb657ac339a044f53a29632e043b5f24b3b242d486515f7fbe49a17f0ef724b29
-
Filesize
2KB
MD57afaf9e0e99fd80fa1023a77524f5587
SHA1e20c9c27691810b388c73d2ca3e67e109c2b69b6
SHA256760b70612bb9bd967c2d15a5133a50ccce8c0bd46a6464d76875298dcc45dea0
SHA512a090626e7b7f67fb5aa207aae0cf65c3a27e1b85e22c9728eee7475bd9bb7375ca93baaecc662473f9a427b4f505d55f2c61ba36bda460e4e6947fe22eedb044
-
Filesize
10KB
MD5f23a523b82ad9103a9ac1dcc33eca72f
SHA15363bb6b51923441ef56638576307cc252f05a71
SHA25659853c413b0813ded6f1e557959768d6662f010f49884d36b62c13038fac739c
SHA512514ec63f7ed80d0708f7e2355fad8a558b4dcf2d0122ff98fe7c3ca1f40e7cd04e8869ca7a3b95622c0848c0d99306d7e791b86ca69b9e240beae959ca6285be
-
Filesize
9KB
MD52c050a55ade91ca10c94c41fdceaa8cb
SHA1178fd0ee1c184fe681d89bff0ff8b89392723a67
SHA25643262c9cc6328d67007b97a8eb36c924d05d45a383349e61b067f35677e1ad6e
SHA512425825cbe2a417f10832c37fc0e571ca3e3f9b940f93f9f8ec8fcff2df896a52ff753386c30e03836d588b6bf355323dbea2e3a0cbf756f8f3c7065335cbfeac
-
Filesize
1.3MB
MD528fb2cbef1e3bd4a6ba898022837f530
SHA10c2b10b96bb89da50f7e628da9429f0804eb5e58
SHA2566f135a5da1425917d69171ef07119f9a255ae53273b41b9042679b985d399330
SHA51220eb882226895325f85ab26f60538132af6e281cfc0ece0675b3e043e6aa86bedfd5eed14c723bfbb4a6c0c443f2ed20935484fcce2a6283fadda8422e67d07f
-
Filesize
1.5MB
MD56136de0958d870f432d76dadd9031a62
SHA1de85ca5d1b79a2addbdb7cf1f4f977c368abd658
SHA256da2d29175f9ab34f22d15824ae239a154684eface3caa65045772023b2855e77
SHA512bafcddd1729246004153b07192f5a4cacea70d3aadfdfab936dcd271b5f96adcbd537a06da7aba477eb0b5f63def2854a992ddd501c0566baca9e11622258bfa
-
Filesize
247KB
MD50ae4caa40023ebd58dbcbcc24887eb77
SHA1583bbb84c1d1bd6e695bbd239f3c46588e89fde8
SHA25657df803c2039a47ff5a363412ea4d1fd21286ce227e68c5e30ba1762a6629765
SHA5120bbe80db178ffa319199f68a4c0877cadd0e07e579d01cdc2b07c191580769e7abdc33212132cc1088ae1058ce0f457bc35db378b256ee546256e64be614e7ed
-
Filesize
183KB
MD531d32a97b517e77d725b308b867cd715
SHA173c85060e4021f6c4cd312c86db2ef29449822d1
SHA256dcb9ea7c905dea7cbc80a82187432b332395590d23b24e17da8c1af88161b3fb
SHA512b88c4e04cc766f5b8524c3226cf17cd9f60b24d9700939c46bb75f2ea040475470db25102c89135b776ccaff8202c762e50cbd7e27b274e972c5a938f9dc3cb3
-
Filesize
97KB
MD51852b654e8bf7f9f9706b0dcd9510a90
SHA1961a7143a4756cf2b3da37a4842a10a895a59ad5
SHA256408f9ef7d7b4ba3f9df4b0a30241d5df014823805fdf2794be99c835effce339
SHA512ea71909eef4643dcdd9f5d01776b4c608aa502f18a056737d93c63090abe13f4e01cabb590f108cf6e540c42e63da4106a0736c0582280a59165c9c82d466000
-
Filesize
93KB
MD59ef7a3f928636896988e3d85a4b33ae9
SHA12670ce7653979a9efa651461ebe583e3fecfae42
SHA2569359b7b9ed8895b527d8f905edb9bd87649bdce8bb80373f3fc2047927d6d94e
SHA51231869187bdc51410460ae620fda9ee642f3ba11b5d326109846b474e891e36fb730b754f7186b738e6a4838237aad37c0033a1436542c93f180a9d3444d0b2c3
-
Filesize
177KB
MD5f1a281f74d3e91d16dd26d1f313cd8a9
SHA1ddb2ca9032c5a9c091eac53b679f6ba428077b00
SHA256f79108a254f876e0f6bbcb05a9effbe25dc252e7ea256bfe3fd28ceb79737f25
SHA512484c5ca26275427e1fb74d3217a22a0e4aac409aba973e78d7ad68834e7ad1d86c7855d34b227925200f941d288dfc09477b2d7dfe0856810c6c847297b8d625
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
231KB
MD581991fc04e89e1ca1b31c33beea181e9
SHA1a6b08d0f8818e2491d9768efdccf07a2176c592a
SHA2566adff56c4a02e2ac2fc07bedcbb76dfb79805fe54ea98f539ad22d812c93487d
SHA5128d56a6a0fc23862f8822172e569b51fe24ed0f9c9adcc4132cbf2ce32181debc7d2206699510e9b057d6478dc14121505213f7eff4f81cdbb19d4c312457c807
-
Filesize
134KB
MD5e78376b0fd8fcaf22e7da03558033f8e
SHA1d6cb81e20a86f4bab7aae49a9f5a6d84effcec9e
SHA256455fd57aa59985a6c4fe7d69c3d05d8962cb571c043dc0540456ac2a2b413428
SHA512de5e1729fb9719a7863968a8232ff8622c9ed8fd26c49b956e3b8b57cbaba1aa031b663f8e5b4367d1cbbe7ab1f808057a22eaf563569e642a20414e0306aa63
-
Filesize
254KB
MD53deb3baedf329ccf213da831ce5518a6
SHA199051026110a76ceecdceeef8f3fc067ccfe1287
SHA2563d3a66d243445e0cddf8aa2b2ec81a0812f8855fa211854ae766e9879f60634d
SHA512513a2f5c7081e5f63883e37620578967c68ce7128fedc48c3a760a213cc40a0540792638e90f6be6f063ed94a4f242a2cc3fa0df3a05ce561188c0dc6db2c515
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
1.4MB
MD5b263545c65f9fed11f71c7683de2ab18
SHA12b86f46f500ccb8401ac0a5213a9f58d6f890dfb
SHA256cee84df64c7b90b2d535a5f6da840aa35e131d4d491261915f1c10db83abb809
SHA512b9fa9f04ec2fa7e5f976a5c087c03152edcb88b5db1417102851014482d5703ec68d43e56d089ed331b9cf7079bc298b96a9f0376662848028f3c259009eb946
-
Filesize
2.0MB
MD5e1f18a22199c6f6aa5d87b24e5b39ef1
SHA10dcd8f90b575f6f1d10d6789fe769fa26daafd0e
SHA25662c56c8cf2ac6521ce047b73aa99b6d3952ca53f11d34b00e98d17674a2fc10d
SHA5125a10a2f096adce6e7db3a40bc3ea3fd44d602966e606706ee5a780703f211de7f77656c79c296390baee1e008dc3ce327eaaf5d78bbae20108670c5bc809a190
-
Filesize
3.2MB
MD5aadc16c8ad4312196df3aa1d9f6386d3
SHA1ff4d78923e0d957e6a66b3c06efecc435c396c7a
SHA25604fade43204ecbbb378114a023b3db4a3aebe8258ff3b3846156e80a9c5cf4a3
SHA51251621ec71d530d75e4a537381edf03bc48b234dd861547c950573febf5709a1716ee797368854512edf1950a4e1f4f8bbe292417a0dd238600338a39e2454e04
-
Filesize
1.3MB
MD5f55a6e245fd6a0b4bb48d7d21e41cfe8
SHA16f798e7b2ae584acdd32932cd02135b1f0ea0816
SHA25635e613f02c09ea8b1f69ad264e383c7fc8ebcdaed28fa75cfdfc9e485de26cd4
SHA512e214ac8e8a750b6ebd766e6a0d1b9e69e078caf133814cb3effc6bd15f3bc79b034fe23af6b4899596d1e6d155bfd3d3a52008e70d4681e60b27861312db9320
-
Filesize
309KB
MD5cc79518473ea9bbb8a2d1e9af37ef071
SHA1f6d143249c61c9d9e8b38a8ca2b812ee019f0e1c
SHA25695e7f08cb42ae41af55acebe0ca872b69f51109d1592a7b6f9294bd8232cd9e7
SHA512c0fcda429e85c30e437ffe9cab08cf76e7f2f68a5afcbf81cea244a014a2091f7c195aa3bc4ef9c346e8c5d231591337a349ea5282d75d17030384a5a629aa06
-
Filesize
86KB
MD58b34714dffd44e71a810cf68e3688b6f
SHA1ffdf8d8fdfedefaf1262a6fae5d3146b2a43bb7e
SHA2560a93d5e878c4d51b24835430b669f7a662579cf1c6a68618fa569ebc616e7eae
SHA512128dc0e8359905cb93e07eb8f9ba90d5fc7b502642e30070ffdd3f22990ad16b2e62624700eb13b6b70d54160d1df5356bf7bfcc3cf5fdd95a714cc7328371de
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
4KB
-
Filesize
60KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
60KB
-
Filesize
3.2MB
-
Filesize
60KB
-
Filesize
3.2MB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
3.2MB
