Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31-01-2024 18:51

General

  • Target

    ClipPlusCommunitySetup_ns.msi

  • Size

    17.1MB

  • MD5

    b82ada91e8742234257d9cad38deebfe

  • SHA1

    d1278efa9729f955de1dbfcfe53550e67212ff9b

  • SHA256

    3c8a05c5e2b599db85700ff9334a778efd2a99f6b4a1852aa0c129ba6039f834

  • SHA512

    676d29697382b1375c7da26fcd6af20a7c5fb9f0f506c951c7280c7da12778d40fcfb1ef50653628123edf6cba8308d43a4945489a5f6b58e67dcc61d6fd373b

  • SSDEEP

    393216:bnEbwdw5PBbXDqPiHNTS3ByWhGhz3iQw0FHufQMfh1GD6QGhNgqx9OPNQNI62vhp:wbwdwnBtcFhG1w0MVZ1GD6QGhNpwsIn/

Score
10/10

Malware Config

Signatures

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

  • Babadeda Crypter 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ClipPlusCommunitySetup_ns.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2352
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
      "C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1932
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1704
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B4" "0000000000000554"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2800

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f761b40.rbs
    Filesize

    12KB

    MD5

    00051be04d5c14f13578807582e404f9

    SHA1

    fce85a9e1239029e79f822d02f10c9ae30414455

    SHA256

    c10f816c392ce376e616f75f87bb504a9ddd3a73a989b6b0c59ffe5b60821797

    SHA512

    453ccf1e135b8e0b208eea8f0814aafc9e9f36037e42b18014a581b2ced04278abfa74f53c6e14719dd6f23b7add44dfa1920bcc04e119a6a25c51097e2b0d83

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\FilesystemDialogs.dll
    Filesize

    1006KB

    MD5

    f9911a4d1a056c621dbbdc1d36771198

    SHA1

    d59d48ece6cfb711e8904f3b7ab6563cfb64af3e

    SHA256

    5370189b2ad314de53c154882bd15483abf538f7e75f5433d2eb8e813c8f53a7

    SHA512

    dfe42799bc49649591045d7695be6ae2ec21402317e93cbb3cc73f392aca808b957a661af4baa7d362ec92a1820c43d39054f3fa46a9ac8c7099a21e3da83c15

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\FreeImage.dll
    Filesize

    1.1MB

    MD5

    7f9fe032400155aaacea1b4af6c46e07

    SHA1

    af38169b29c1071b60db456aa7e96d302e12a6df

    SHA256

    8b1512696095e1e1d29f2d91a2d79d32b1be50899baf56ede3a6aa5c2a79810a

    SHA512

    4d4dd63d5604467f58d59ea260eb10719acf05980c9c29ce339085502ee21e6e9b804c486106b1d119fb19190b1246acbb87b280c0f83aae0ffdfd1c6e1bc038

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\MediaInfo.dll
    Filesize

    1.4MB

    MD5

    27eccfac916724fde89be05cbcac9d88

    SHA1

    da75266a674627cc9a5cac6b9c371ebc20c9bdce

    SHA256

    29627dc6709e5f53fd63392ed946ce7d0d569f636226c09330755d9a1a3109fc

    SHA512

    259bc2b047953d360b35368ba8014e356f72e33d37610548c77224139a2a84715d95fec8cdb4366665934f24613a4993c8f858b34302a828cb1ad71596445d24

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\SampleDisplay.dll
    Filesize

    1004KB

    MD5

    12a366b12ca1c0cad3ea3ba51c973f37

    SHA1

    5293a879d2cbfbcf10bce052125b51a31f647ae1

    SHA256

    be010427aca3f13f48d62c788c236fd9a7f81eaa4cb7e19798b51fae78006b37

    SHA512

    3906b584143d146ebba17ec3d8971410496c7e0ad4d698fb9af1733ac23c27bca40422243035f4126eb6aee8ef8dd810b37e26316889ed18d9c05bac6d149f10

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\bass.dll
    Filesize

    135KB

    MD5

    8e58fcc0672a66c827c6f90fa4b58538

    SHA1

    3e807dfd27259ae7548692a05af4fe54f8dd32ed

    SHA256

    6e1bf8ea63f9923687709f4e2f0dac7ff558b2ab923e8c8aa147384746e05b1d

    SHA512

    0e9faf457a278ad4c5dd171f65c24f6a027696d931a9a2a2edd4e467da8b8a9e4ab3b1fd2d758f5744bf84bece88c046cda5f7e4204bead14d7c36a46702b768

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\bass_vst.dll
    Filesize

    27KB

    MD5

    5efb2702c0b3d8eeac563372a33a6ed0

    SHA1

    c7f969ea2e53b1bd5dbeba7dd56bff0cc4c9ea99

    SHA256

    40545a369fa7b72d23a58050d32dc524b6905e9b0229719022dbda0d2fa8765b

    SHA512

    8119526f8573ea6e5bed16a57d56084260afee511c9aad3d542388a783548e5b32ed8fb568d5b97deed791162bcd5577fcc3c76abf4d147ea13bea5c2a6ea794

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
    Filesize

    1.4MB

    MD5

    5ef8c4d3d856e99b366155ac40dbf0ce

    SHA1

    9373200841a4ccbb96cac41b33a36997eb2d252b

    SHA256

    189120484b8ba64a3405f8ce693e109c54cfaab8e9e8e854848cfe7900560d26

    SHA512

    a29e7b20051ea64f0ba2cceb743d9ba04c89b30ac73dc0bb1ffd65231ab82a7d0f18a8d5925fa3e7ef3ba625807bb68cbba1469306996b527606ff5002737bfb

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\irender.dll
    Filesize

    909KB

    MD5

    d28239a4095f7866dde5cbf630d15e41

    SHA1

    2564f81c8e806009c23ef08b9cd802396ea71d58

    SHA256

    9ec35f0b24e8c7b1ee08d86fd250e3e1a9c94e6e83986c85defafdc565153fcb

    SHA512

    99af8c22c745ab6814dba97e3c22cc8fe3dd0984b759ee90dd02a3837604d6e9bb11368cebdf25a33784221236b73af77f8fcbf4b78becb134cacf24ebb1184f

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\tutorial.wav
    Filesize

    1.4MB

    MD5

    1898e8f139af3c37c7cb695ebba30dca

    SHA1

    4ff0c9a3da840f12ea5479a0ec92f6fe0a01d0f6

    SHA256

    21f44ed011011a676dcc5fbde05580b64153764ebd07a9cc73fef6f35e7d0ee1

    SHA512

    e2ca27b9849e411ff5276b969b29f571149e68e7046745a7acb2c2a666b7dedd0622916867ce4efa3268e5bbb7c408df02a22393f847303f5928da6f4589d413

  • C:\Windows\Installer\f761b3e.msi
    Filesize

    1.4MB

    MD5

    7f6db664f58c19e922c3481cfd742b52

    SHA1

    ac286c6a59e109138c0403f3654328d3c2b022b5

    SHA256

    69e1ce56f3990e42ad6b45f86f9c56a822535b7bf73317e566b98367d82ebc68

    SHA512

    f6f29abd4cc5c8becacc411c939116069bf49bb3bc87cda50fd2a9912610987b8202f700742f36d603f4028032f9871975424809b8b8764277e34fa06bfdf95d

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\FilesystemDialogs.dll
    Filesize

    1.2MB

    MD5

    985196b3967c1940a047ddeb59bafbda

    SHA1

    ea55a92256dfe1631f90fc34b75dbff6b817037d

    SHA256

    642c52c3fa5973b0ce8f6177b5fe0292e7c9335af258df47c174d88473af9770

    SHA512

    60fe0d4c45b194d89b9f36ae54334f5d878e5c25aaeb1fe04c85419f5f97b0d4fb1d15c0c47d4846c1f96eb45273f9a912f1d83393675a1a577f49df7d412b35

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\Fluent.dll
    Filesize

    379KB

    MD5

    e98f595caa5ee23e8a3e46d83211da9d

    SHA1

    a7ef9e7c3eddaa7b82acb7eba7a2c88a70bac017

    SHA256

    df12ced54ee1dd73b230be239fb2ffce141bbf4ff979fb33ebb153a0bda88a1a

    SHA512

    e777a5ace5ecef10ae051df02a443279af5f28a1e996905774f574ef8679363ae78db064ef6eb7c3f77dd87284cc0d070b1fe54b422f9ae0a2240286a9541938

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\FreeImage.dll
    Filesize

    1.8MB

    MD5

    91b965948bfa25ec7f732d794d8a85e6

    SHA1

    a526be7e7886ef0501c05ab6d7ab20b68e91fc45

    SHA256

    2cd80261c21d29ab2b1f911b34f29603eeec9d55580ba02f140454d50244f414

    SHA512

    55346802503d04600966ec34927ea3dc9fd483351a6353c78e2347747fe92f380667743f0a6f389e35f7a0b5dc2671fd290649a6d575b7c26b04590ebbe46d44

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\MediaInfo.dll
    Filesize

    1.2MB

    MD5

    57229daf7268b85089f61e22760de6cb

    SHA1

    0202ee5cb4ad4da9dc5135c8a5fd959cdaecdab2

    SHA256

    373bd73b6742b1415e82a8d20436f4109136d406e6ab2ac6a10a22e17466d98b

    SHA512

    05e6ec80c4d7fd5606afd61e7206a2f46488494bda330d1a4fe9c2057da1a5f59b5a256d61a0da4d1640fb0f75a745c35bce6c5ef44a0a1e182e916bf0a11778

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\SampleDisplay.dll
    Filesize

    1.9MB

    MD5

    3ef733c8a41234ac5a79c43f4474df34

    SHA1

    ac076f0a2f24d460ee6aafd931096be69dcf1c6e

    SHA256

    365e8a6c352c8d39e685e220244f8a6d5cd536e04a175e2dc0c8c54426af6efc

    SHA512

    699f173619c00a6790c4896efa4dcb9e124d4b26973a9e288c4ecb5a22ec92ff56117e00726c085c37c30d51011286a1512a9b46782333e811926d491fdd68c7

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\WinSparkle.dll
    Filesize

    1.1MB

    MD5

    658276a6bf6c17511f54254d56cd9022

    SHA1

    b9af3a23d41aa2bc2bf1f269e0deb8749896c584

    SHA256

    19b5b1a7be78f20a509b6283d89498f038a74337b803369cb37077e1ebb5fa2a

    SHA512

    4de906a5637512b40f91d49c798d2c2cea429077b53a7ed6e8eceaa6f0a1f56dbea1085c1a5afeeb689fd0c049d9041064c3d262a43b513f2288967292222fae

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bass_fx.dll
    Filesize

    67KB

    MD5

    d8ccb4b8235f31a3c73485fde18b0187

    SHA1

    723bd0f39b32aff806a7651ebc0cdbcea494c57e

    SHA256

    7bc733acc1d2b89e5a6546f4ebc321b1c2370e42354ea415bc5fcc6807275eba

    SHA512

    8edafd699f9fbec0db334b9bc96a73a9196895120f3406fff28406fd0565415ac98665c9837a5b1e0c5027162ff26bf3a316ecda6a0b51d92eb5d7002b814713

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassasio.dll
    Filesize

    18KB

    MD5

    ff3d92fe7a1bf86cba27bec4523c2665

    SHA1

    c2184ec182c4c9686c732d9b27928bddac493b90

    SHA256

    9754a64a411e6b1314ae0b364e5e21ccfe2c15df2ed2e2dce2dc06fa10aa41e8

    SHA512

    6e0f021eb7317e021dccb8325bc42f51a0bf2b482521c05a3ff3ca9857035191f8b4b19cbe0d7130d5736f41f8f2efb2568561e9063fa55aaab9f2575afe23db

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc.dll
    Filesize

    31KB

    MD5

    a6f27196423a3d1c0caa4a0caf98893a

    SHA1

    58b97697fa349b40071df4272b4efbd1dd295595

    SHA256

    d3b9e4646f7b1cb9123914313cec23ec804bd81c4ff8b09b43c2cde5ee3e4222

    SHA512

    0a84cf847b80b0c2e6df9274a4199db8559757781faec508cd8999bea2c8fb5cd9bed1698144b82b86b2c6938fa8006c482a09c1b46d6bb8d2a2648a2011dea0

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_flac.dll
    Filesize

    76KB

    MD5

    5199d6173a6deb45c275ef32af377c3c

    SHA1

    e8989859b917cfa106b4519fefe4655c4325875b

    SHA256

    a36f06cbe60fc1a305bd16cd30b35b9c026fd514df89cd88c9c83d22aefbe8c3

    SHA512

    80b96196f1b3d6640035e8b8632a25ecdb3e4e823e1b64fc658b31aae6c6799aa1d9fd1acffbef6ff9082e0433ac9ab9426d5400d3644db9958940b8bb13f6d8

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_mp3.dll
    Filesize

    75KB

    MD5

    46ede9ea58c0ac20baf444750311e3f8

    SHA1

    246c36050419602960fca4ec6d2079ea0d91f46e

    SHA256

    7ea1636182d7520e5d005f3f8c6c1818148824cee4f092e2d2fe4f47c1793236

    SHA512

    d9154430c72cbf78f4f49ec1eee888c0004f30a58a70cee49f5108ded0994ba299ba6bf552a55ffeedb2ab53107172324156e12e2fbae42f8f14f87ec37cc4e7

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_ogg.dll
    Filesize

    164KB

    MD5

    89e794bbd022ae1cafbf1516541d6ba5

    SHA1

    a69f496680045e5f30b636e9f17429e0b3dd653e

    SHA256

    7d7eb0bc188fc3a8e7af7e5325d4f5e5eb918c4138aea3de60d6b1afac6863f9

    SHA512

    16455e29a1beece663878e84d91c8e75c34b483b6ff3b5853ced97670a75a9c29cc7a7aa78b0c158eb760cda5d3e44541aae2cc89b57d290e39b427d4c770000

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_opus.dll
    Filesize

    141KB

    MD5

    b6022150de5aeab34849ade53a9ac397

    SHA1

    203d9458c92fc0628a84c483f17043ce468fa62f

    SHA256

    c53b12ebe8ea411d8215c1b81de09adc7f4cf1e84fd85a7afa13f1f4a41f8e9d

    SHA512

    2286399bd1f3576c6ce168e824f4d70c637485fae97d274597d045a894740519512f1865e20562656297072b5625bdd2a5ec4d4f5038176f764eb37e22451ade

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassmix.dll
    Filesize

    31KB

    MD5

    d31da7583083c1370f3c6b9c15f363cc

    SHA1

    1ebe7b1faf94c4fe135f34006e7e7cbbc0d8476c

    SHA256

    cff3edc109bc0d186ba8ddf60bc99e48ff3467771e741c7168adbdbe03379506

    SHA512

    a80364384eca446a378e3ae3420a0e3545e1d24426a9e43f3e27381cb09bb4cd1121b66c576e5a981b2e5d661f82590eb0c0fe8d8243ef872f84809ec906e266

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\basswasapi.dll
    Filesize

    21KB

    MD5

    cdfbe254cc64959fc0fc1200f41f34c0

    SHA1

    4e0919a8a5c4b23441e51965eaaa77f485584c01

    SHA256

    9513129c0bb417698a60c5e4dd232963605d1c84e01b9f883f63d03b453173a9

    SHA512

    63704a7a4d0cd8b53972e29fcbee71f2c3eb86a0411f90fc8375e67cb4b3bddb36c753f3f5b113c3ca333c381f86a19e2168218cc2074f05ad1143bc118cd610

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\irender.dll
    Filesize

    1.2MB

    MD5

    eeb2c9f79926c1074703c378fb27215c

    SHA1

    df632ea453d0986aebb5961a7874c25426e5885b

    SHA256

    ba71994c06091dfdc0f1c51eda9e41be888224d165fc0d62d7d882384569600c

    SHA512

    0ffb563a20b1bf6659ae78d79fe28379e9560c91e4a258dd12046c4659aaf30772b1dcbd426466fee513f42711bc55c70f3f8c8f9ebfc533173b5e9cc3b80406

  • memory/1932-80-0x00000000001C0000-0x00000000001C5000-memory.dmp
    Filesize

    20KB

  • memory/1932-121-0x00000000732E0000-0x0000000074003000-memory.dmp
    Filesize

    13.1MB

  • memory/1932-111-0x0000000000F20000-0x0000000000F21000-memory.dmp
    Filesize

    4KB

  • memory/1932-79-0x0000000075140000-0x000000007514E000-memory.dmp
    Filesize

    56KB

  • memory/1932-113-0x0000000003860000-0x00000000038EB000-memory.dmp
    Filesize

    556KB

  • memory/1932-118-0x0000000000400000-0x0000000000BAB000-memory.dmp
    Filesize

    7.7MB

  • memory/1932-120-0x0000000000BB0000-0x0000000000E93000-memory.dmp
    Filesize

    2.9MB

  • memory/1932-119-0x0000000004490000-0x0000000004491000-memory.dmp
    Filesize

    4KB

  • memory/1932-81-0x0000000075110000-0x0000000075138000-memory.dmp
    Filesize

    160KB

  • memory/1932-99-0x00000000001C0000-0x00000000001CD000-memory.dmp
    Filesize

    52KB

  • memory/1932-124-0x0000000074940000-0x0000000074A65000-memory.dmp
    Filesize

    1.1MB

  • memory/1932-123-0x00000000001C0000-0x00000000001C5000-memory.dmp
    Filesize

    20KB

  • memory/1932-122-0x00000000001C0000-0x00000000001C4000-memory.dmp
    Filesize

    16KB

  • memory/1932-108-0x0000000074940000-0x0000000074A65000-memory.dmp
    Filesize

    1.1MB

  • memory/1932-98-0x00000000003D0000-0x00000000003D2000-memory.dmp
    Filesize

    8KB

  • memory/1932-97-0x00000000001C0000-0x00000000001C3000-memory.dmp
    Filesize

    12KB

  • memory/1932-95-0x0000000074F20000-0x0000000074F44000-memory.dmp
    Filesize

    144KB

  • memory/1932-93-0x0000000074F50000-0x0000000074F86000-memory.dmp
    Filesize

    216KB

  • memory/1932-92-0x00000000001C0000-0x00000000001C5000-memory.dmp
    Filesize

    20KB

  • memory/1932-91-0x0000000075020000-0x000000007502E000-memory.dmp
    Filesize

    56KB

  • memory/1932-86-0x00000000001C0000-0x00000000001C4000-memory.dmp
    Filesize

    16KB

  • memory/1932-88-0x00000000001C0000-0x00000000001CE000-memory.dmp
    Filesize

    56KB

  • memory/1932-87-0x0000000075030000-0x0000000075063000-memory.dmp
    Filesize

    204KB

  • memory/1932-84-0x0000000075070000-0x000000007510E000-memory.dmp
    Filesize

    632KB

  • memory/1932-82-0x00000000001C0000-0x00000000001C4000-memory.dmp
    Filesize

    16KB

  • memory/1932-78-0x00000000003D0000-0x00000000003ED000-memory.dmp
    Filesize

    116KB

  • memory/1932-75-0x0000000075390000-0x00000000753DD000-memory.dmp
    Filesize

    308KB

  • memory/1932-72-0x0000000000BB0000-0x0000000000E93000-memory.dmp
    Filesize

    2.9MB