Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31-01-2024 18:51

General

  • Target

    ClipPlusCommunitySetup_ns.msi

  • Size

    17.1MB

  • MD5

    b82ada91e8742234257d9cad38deebfe

  • SHA1

    d1278efa9729f955de1dbfcfe53550e67212ff9b

  • SHA256

    3c8a05c5e2b599db85700ff9334a778efd2a99f6b4a1852aa0c129ba6039f834

  • SHA512

    676d29697382b1375c7da26fcd6af20a7c5fb9f0f506c951c7280c7da12778d40fcfb1ef50653628123edf6cba8308d43a4945489a5f6b58e67dcc61d6fd373b

  • SSDEEP

    393216:bnEbwdw5PBbXDqPiHNTS3ByWhGhz3iQw0FHufQMfh1GD6QGhNgqx9OPNQNI62vhp:wbwdwnBtcFhG1w0MVZ1GD6QGhNpwsIn/

Score
10/10

Malware Config

Signatures

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

  • Babadeda Crypter 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ClipPlusCommunitySetup_ns.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2352
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
      "C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1932
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1704
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B4" "0000000000000554"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f761b40.rbs

    Filesize

    12KB

    MD5

    00051be04d5c14f13578807582e404f9

    SHA1

    fce85a9e1239029e79f822d02f10c9ae30414455

    SHA256

    c10f816c392ce376e616f75f87bb504a9ddd3a73a989b6b0c59ffe5b60821797

    SHA512

    453ccf1e135b8e0b208eea8f0814aafc9e9f36037e42b18014a581b2ced04278abfa74f53c6e14719dd6f23b7add44dfa1920bcc04e119a6a25c51097e2b0d83

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\FilesystemDialogs.dll

    Filesize

    1006KB

    MD5

    f9911a4d1a056c621dbbdc1d36771198

    SHA1

    d59d48ece6cfb711e8904f3b7ab6563cfb64af3e

    SHA256

    5370189b2ad314de53c154882bd15483abf538f7e75f5433d2eb8e813c8f53a7

    SHA512

    dfe42799bc49649591045d7695be6ae2ec21402317e93cbb3cc73f392aca808b957a661af4baa7d362ec92a1820c43d39054f3fa46a9ac8c7099a21e3da83c15

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\FreeImage.dll

    Filesize

    1.1MB

    MD5

    7f9fe032400155aaacea1b4af6c46e07

    SHA1

    af38169b29c1071b60db456aa7e96d302e12a6df

    SHA256

    8b1512696095e1e1d29f2d91a2d79d32b1be50899baf56ede3a6aa5c2a79810a

    SHA512

    4d4dd63d5604467f58d59ea260eb10719acf05980c9c29ce339085502ee21e6e9b804c486106b1d119fb19190b1246acbb87b280c0f83aae0ffdfd1c6e1bc038

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\MediaInfo.dll

    Filesize

    1.4MB

    MD5

    27eccfac916724fde89be05cbcac9d88

    SHA1

    da75266a674627cc9a5cac6b9c371ebc20c9bdce

    SHA256

    29627dc6709e5f53fd63392ed946ce7d0d569f636226c09330755d9a1a3109fc

    SHA512

    259bc2b047953d360b35368ba8014e356f72e33d37610548c77224139a2a84715d95fec8cdb4366665934f24613a4993c8f858b34302a828cb1ad71596445d24

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\SampleDisplay.dll

    Filesize

    1004KB

    MD5

    12a366b12ca1c0cad3ea3ba51c973f37

    SHA1

    5293a879d2cbfbcf10bce052125b51a31f647ae1

    SHA256

    be010427aca3f13f48d62c788c236fd9a7f81eaa4cb7e19798b51fae78006b37

    SHA512

    3906b584143d146ebba17ec3d8971410496c7e0ad4d698fb9af1733ac23c27bca40422243035f4126eb6aee8ef8dd810b37e26316889ed18d9c05bac6d149f10

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\bass.dll

    Filesize

    135KB

    MD5

    8e58fcc0672a66c827c6f90fa4b58538

    SHA1

    3e807dfd27259ae7548692a05af4fe54f8dd32ed

    SHA256

    6e1bf8ea63f9923687709f4e2f0dac7ff558b2ab923e8c8aa147384746e05b1d

    SHA512

    0e9faf457a278ad4c5dd171f65c24f6a027696d931a9a2a2edd4e467da8b8a9e4ab3b1fd2d758f5744bf84bece88c046cda5f7e4204bead14d7c36a46702b768

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\bass_vst.dll

    Filesize

    27KB

    MD5

    5efb2702c0b3d8eeac563372a33a6ed0

    SHA1

    c7f969ea2e53b1bd5dbeba7dd56bff0cc4c9ea99

    SHA256

    40545a369fa7b72d23a58050d32dc524b6905e9b0229719022dbda0d2fa8765b

    SHA512

    8119526f8573ea6e5bed16a57d56084260afee511c9aad3d542388a783548e5b32ed8fb568d5b97deed791162bcd5577fcc3c76abf4d147ea13bea5c2a6ea794

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe

    Filesize

    1.4MB

    MD5

    5ef8c4d3d856e99b366155ac40dbf0ce

    SHA1

    9373200841a4ccbb96cac41b33a36997eb2d252b

    SHA256

    189120484b8ba64a3405f8ce693e109c54cfaab8e9e8e854848cfe7900560d26

    SHA512

    a29e7b20051ea64f0ba2cceb743d9ba04c89b30ac73dc0bb1ffd65231ab82a7d0f18a8d5925fa3e7ef3ba625807bb68cbba1469306996b527606ff5002737bfb

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\irender.dll

    Filesize

    909KB

    MD5

    d28239a4095f7866dde5cbf630d15e41

    SHA1

    2564f81c8e806009c23ef08b9cd802396ea71d58

    SHA256

    9ec35f0b24e8c7b1ee08d86fd250e3e1a9c94e6e83986c85defafdc565153fcb

    SHA512

    99af8c22c745ab6814dba97e3c22cc8fe3dd0984b759ee90dd02a3837604d6e9bb11368cebdf25a33784221236b73af77f8fcbf4b78becb134cacf24ebb1184f

  • C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\tutorial.wav

    Filesize

    1.4MB

    MD5

    1898e8f139af3c37c7cb695ebba30dca

    SHA1

    4ff0c9a3da840f12ea5479a0ec92f6fe0a01d0f6

    SHA256

    21f44ed011011a676dcc5fbde05580b64153764ebd07a9cc73fef6f35e7d0ee1

    SHA512

    e2ca27b9849e411ff5276b969b29f571149e68e7046745a7acb2c2a666b7dedd0622916867ce4efa3268e5bbb7c408df02a22393f847303f5928da6f4589d413

  • C:\Windows\Installer\f761b3e.msi

    Filesize

    1.4MB

    MD5

    7f6db664f58c19e922c3481cfd742b52

    SHA1

    ac286c6a59e109138c0403f3654328d3c2b022b5

    SHA256

    69e1ce56f3990e42ad6b45f86f9c56a822535b7bf73317e566b98367d82ebc68

    SHA512

    f6f29abd4cc5c8becacc411c939116069bf49bb3bc87cda50fd2a9912610987b8202f700742f36d603f4028032f9871975424809b8b8764277e34fa06bfdf95d

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\FilesystemDialogs.dll

    Filesize

    1.2MB

    MD5

    985196b3967c1940a047ddeb59bafbda

    SHA1

    ea55a92256dfe1631f90fc34b75dbff6b817037d

    SHA256

    642c52c3fa5973b0ce8f6177b5fe0292e7c9335af258df47c174d88473af9770

    SHA512

    60fe0d4c45b194d89b9f36ae54334f5d878e5c25aaeb1fe04c85419f5f97b0d4fb1d15c0c47d4846c1f96eb45273f9a912f1d83393675a1a577f49df7d412b35

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\Fluent.dll

    Filesize

    379KB

    MD5

    e98f595caa5ee23e8a3e46d83211da9d

    SHA1

    a7ef9e7c3eddaa7b82acb7eba7a2c88a70bac017

    SHA256

    df12ced54ee1dd73b230be239fb2ffce141bbf4ff979fb33ebb153a0bda88a1a

    SHA512

    e777a5ace5ecef10ae051df02a443279af5f28a1e996905774f574ef8679363ae78db064ef6eb7c3f77dd87284cc0d070b1fe54b422f9ae0a2240286a9541938

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\FreeImage.dll

    Filesize

    1.8MB

    MD5

    91b965948bfa25ec7f732d794d8a85e6

    SHA1

    a526be7e7886ef0501c05ab6d7ab20b68e91fc45

    SHA256

    2cd80261c21d29ab2b1f911b34f29603eeec9d55580ba02f140454d50244f414

    SHA512

    55346802503d04600966ec34927ea3dc9fd483351a6353c78e2347747fe92f380667743f0a6f389e35f7a0b5dc2671fd290649a6d575b7c26b04590ebbe46d44

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\MediaInfo.dll

    Filesize

    1.2MB

    MD5

    57229daf7268b85089f61e22760de6cb

    SHA1

    0202ee5cb4ad4da9dc5135c8a5fd959cdaecdab2

    SHA256

    373bd73b6742b1415e82a8d20436f4109136d406e6ab2ac6a10a22e17466d98b

    SHA512

    05e6ec80c4d7fd5606afd61e7206a2f46488494bda330d1a4fe9c2057da1a5f59b5a256d61a0da4d1640fb0f75a745c35bce6c5ef44a0a1e182e916bf0a11778

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\SampleDisplay.dll

    Filesize

    1.9MB

    MD5

    3ef733c8a41234ac5a79c43f4474df34

    SHA1

    ac076f0a2f24d460ee6aafd931096be69dcf1c6e

    SHA256

    365e8a6c352c8d39e685e220244f8a6d5cd536e04a175e2dc0c8c54426af6efc

    SHA512

    699f173619c00a6790c4896efa4dcb9e124d4b26973a9e288c4ecb5a22ec92ff56117e00726c085c37c30d51011286a1512a9b46782333e811926d491fdd68c7

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\WinSparkle.dll

    Filesize

    1.1MB

    MD5

    658276a6bf6c17511f54254d56cd9022

    SHA1

    b9af3a23d41aa2bc2bf1f269e0deb8749896c584

    SHA256

    19b5b1a7be78f20a509b6283d89498f038a74337b803369cb37077e1ebb5fa2a

    SHA512

    4de906a5637512b40f91d49c798d2c2cea429077b53a7ed6e8eceaa6f0a1f56dbea1085c1a5afeeb689fd0c049d9041064c3d262a43b513f2288967292222fae

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bass_fx.dll

    Filesize

    67KB

    MD5

    d8ccb4b8235f31a3c73485fde18b0187

    SHA1

    723bd0f39b32aff806a7651ebc0cdbcea494c57e

    SHA256

    7bc733acc1d2b89e5a6546f4ebc321b1c2370e42354ea415bc5fcc6807275eba

    SHA512

    8edafd699f9fbec0db334b9bc96a73a9196895120f3406fff28406fd0565415ac98665c9837a5b1e0c5027162ff26bf3a316ecda6a0b51d92eb5d7002b814713

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassasio.dll

    Filesize

    18KB

    MD5

    ff3d92fe7a1bf86cba27bec4523c2665

    SHA1

    c2184ec182c4c9686c732d9b27928bddac493b90

    SHA256

    9754a64a411e6b1314ae0b364e5e21ccfe2c15df2ed2e2dce2dc06fa10aa41e8

    SHA512

    6e0f021eb7317e021dccb8325bc42f51a0bf2b482521c05a3ff3ca9857035191f8b4b19cbe0d7130d5736f41f8f2efb2568561e9063fa55aaab9f2575afe23db

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc.dll

    Filesize

    31KB

    MD5

    a6f27196423a3d1c0caa4a0caf98893a

    SHA1

    58b97697fa349b40071df4272b4efbd1dd295595

    SHA256

    d3b9e4646f7b1cb9123914313cec23ec804bd81c4ff8b09b43c2cde5ee3e4222

    SHA512

    0a84cf847b80b0c2e6df9274a4199db8559757781faec508cd8999bea2c8fb5cd9bed1698144b82b86b2c6938fa8006c482a09c1b46d6bb8d2a2648a2011dea0

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_flac.dll

    Filesize

    76KB

    MD5

    5199d6173a6deb45c275ef32af377c3c

    SHA1

    e8989859b917cfa106b4519fefe4655c4325875b

    SHA256

    a36f06cbe60fc1a305bd16cd30b35b9c026fd514df89cd88c9c83d22aefbe8c3

    SHA512

    80b96196f1b3d6640035e8b8632a25ecdb3e4e823e1b64fc658b31aae6c6799aa1d9fd1acffbef6ff9082e0433ac9ab9426d5400d3644db9958940b8bb13f6d8

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_mp3.dll

    Filesize

    75KB

    MD5

    46ede9ea58c0ac20baf444750311e3f8

    SHA1

    246c36050419602960fca4ec6d2079ea0d91f46e

    SHA256

    7ea1636182d7520e5d005f3f8c6c1818148824cee4f092e2d2fe4f47c1793236

    SHA512

    d9154430c72cbf78f4f49ec1eee888c0004f30a58a70cee49f5108ded0994ba299ba6bf552a55ffeedb2ab53107172324156e12e2fbae42f8f14f87ec37cc4e7

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_ogg.dll

    Filesize

    164KB

    MD5

    89e794bbd022ae1cafbf1516541d6ba5

    SHA1

    a69f496680045e5f30b636e9f17429e0b3dd653e

    SHA256

    7d7eb0bc188fc3a8e7af7e5325d4f5e5eb918c4138aea3de60d6b1afac6863f9

    SHA512

    16455e29a1beece663878e84d91c8e75c34b483b6ff3b5853ced97670a75a9c29cc7a7aa78b0c158eb760cda5d3e44541aae2cc89b57d290e39b427d4c770000

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_opus.dll

    Filesize

    141KB

    MD5

    b6022150de5aeab34849ade53a9ac397

    SHA1

    203d9458c92fc0628a84c483f17043ce468fa62f

    SHA256

    c53b12ebe8ea411d8215c1b81de09adc7f4cf1e84fd85a7afa13f1f4a41f8e9d

    SHA512

    2286399bd1f3576c6ce168e824f4d70c637485fae97d274597d045a894740519512f1865e20562656297072b5625bdd2a5ec4d4f5038176f764eb37e22451ade

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\bassmix.dll

    Filesize

    31KB

    MD5

    d31da7583083c1370f3c6b9c15f363cc

    SHA1

    1ebe7b1faf94c4fe135f34006e7e7cbbc0d8476c

    SHA256

    cff3edc109bc0d186ba8ddf60bc99e48ff3467771e741c7168adbdbe03379506

    SHA512

    a80364384eca446a378e3ae3420a0e3545e1d24426a9e43f3e27381cb09bb4cd1121b66c576e5a981b2e5d661f82590eb0c0fe8d8243ef872f84809ec906e266

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\basswasapi.dll

    Filesize

    21KB

    MD5

    cdfbe254cc64959fc0fc1200f41f34c0

    SHA1

    4e0919a8a5c4b23441e51965eaaa77f485584c01

    SHA256

    9513129c0bb417698a60c5e4dd232963605d1c84e01b9f883f63d03b453173a9

    SHA512

    63704a7a4d0cd8b53972e29fcbee71f2c3eb86a0411f90fc8375e67cb4b3bddb36c753f3f5b113c3ca333c381f86a19e2168218cc2074f05ad1143bc118cd610

  • \Users\Admin\AppData\Local\Programs\Clip Plus Community\irender.dll

    Filesize

    1.2MB

    MD5

    eeb2c9f79926c1074703c378fb27215c

    SHA1

    df632ea453d0986aebb5961a7874c25426e5885b

    SHA256

    ba71994c06091dfdc0f1c51eda9e41be888224d165fc0d62d7d882384569600c

    SHA512

    0ffb563a20b1bf6659ae78d79fe28379e9560c91e4a258dd12046c4659aaf30772b1dcbd426466fee513f42711bc55c70f3f8c8f9ebfc533173b5e9cc3b80406

  • memory/1932-80-0x00000000001C0000-0x00000000001C5000-memory.dmp

    Filesize

    20KB

  • memory/1932-121-0x00000000732E0000-0x0000000074003000-memory.dmp

    Filesize

    13.1MB

  • memory/1932-111-0x0000000000F20000-0x0000000000F21000-memory.dmp

    Filesize

    4KB

  • memory/1932-79-0x0000000075140000-0x000000007514E000-memory.dmp

    Filesize

    56KB

  • memory/1932-113-0x0000000003860000-0x00000000038EB000-memory.dmp

    Filesize

    556KB

  • memory/1932-118-0x0000000000400000-0x0000000000BAB000-memory.dmp

    Filesize

    7.7MB

  • memory/1932-120-0x0000000000BB0000-0x0000000000E93000-memory.dmp

    Filesize

    2.9MB

  • memory/1932-119-0x0000000004490000-0x0000000004491000-memory.dmp

    Filesize

    4KB

  • memory/1932-81-0x0000000075110000-0x0000000075138000-memory.dmp

    Filesize

    160KB

  • memory/1932-99-0x00000000001C0000-0x00000000001CD000-memory.dmp

    Filesize

    52KB

  • memory/1932-124-0x0000000074940000-0x0000000074A65000-memory.dmp

    Filesize

    1.1MB

  • memory/1932-123-0x00000000001C0000-0x00000000001C5000-memory.dmp

    Filesize

    20KB

  • memory/1932-122-0x00000000001C0000-0x00000000001C4000-memory.dmp

    Filesize

    16KB

  • memory/1932-108-0x0000000074940000-0x0000000074A65000-memory.dmp

    Filesize

    1.1MB

  • memory/1932-98-0x00000000003D0000-0x00000000003D2000-memory.dmp

    Filesize

    8KB

  • memory/1932-97-0x00000000001C0000-0x00000000001C3000-memory.dmp

    Filesize

    12KB

  • memory/1932-95-0x0000000074F20000-0x0000000074F44000-memory.dmp

    Filesize

    144KB

  • memory/1932-93-0x0000000074F50000-0x0000000074F86000-memory.dmp

    Filesize

    216KB

  • memory/1932-92-0x00000000001C0000-0x00000000001C5000-memory.dmp

    Filesize

    20KB

  • memory/1932-91-0x0000000075020000-0x000000007502E000-memory.dmp

    Filesize

    56KB

  • memory/1932-86-0x00000000001C0000-0x00000000001C4000-memory.dmp

    Filesize

    16KB

  • memory/1932-88-0x00000000001C0000-0x00000000001CE000-memory.dmp

    Filesize

    56KB

  • memory/1932-87-0x0000000075030000-0x0000000075063000-memory.dmp

    Filesize

    204KB

  • memory/1932-84-0x0000000075070000-0x000000007510E000-memory.dmp

    Filesize

    632KB

  • memory/1932-82-0x00000000001C0000-0x00000000001C4000-memory.dmp

    Filesize

    16KB

  • memory/1932-78-0x00000000003D0000-0x00000000003ED000-memory.dmp

    Filesize

    116KB

  • memory/1932-75-0x0000000075390000-0x00000000753DD000-memory.dmp

    Filesize

    308KB

  • memory/1932-72-0x0000000000BB0000-0x0000000000E93000-memory.dmp

    Filesize

    2.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.