babadeda | 88430144366f4833f7e71c205f09cc4d2ea08983a8a8b98122c1989a9712f622

Analysis

max time kernel
145s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d.msi
Size

17.1MB
MD5

eb64b1dbb38961bdb4c0f4b724b1ed3d
SHA1

a375bc847388cdddc6cffd57dc7f0c3d6be72cdf
SHA256

cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d
SHA512

5c56b478f88002e10b3bea6ed2151a8e89e1693270effaa6ded943b1325b0d1e1a4aa9fa66fd8b372f70da86feab6cee781518bb50514dfb341a9767a01d36a7
SSDEEP

393216:QnEbwdw5PBbXDqPiHNTS3ByWhGhz3iQw0FHufQMfh1GD6QGhNgqx9OPNQNI62vho:pbwdwnBtcFhG1w0MVZ1GD6QGhNpwsIne

Score

10^/10

babadeda crypter loader

Malware Config

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\tutorial.wav	family_babadeda

Executes dropped EXE 1 IoCs

Processes:

dsw.exe

pid process

2236 dsw.exe

Loads dropped DLL 23 IoCs

Processes:

dsw.exeWerFault.exe

pid	process
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
2236	dsw.exe
1356	WerFault.exe
1356	WerFault.exe
1356	WerFault.exe
1356	WerFault.exe
1356	WerFault.exe

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exemsiexec.exe

flow pid process

3 2204 msiexec.exe
5 2204 msiexec.exe
7 2064 msiexec.exe

flow	pid	process
3	2204	msiexec.exe
5	2204	msiexec.exe
7	2064	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\f768a46.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DA3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f768a46.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f768a45.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f768a45.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f768a48.msi	msiexec.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1356 2236 WerFault.exe dsw.exe

pid	pid_target	process	target process
1356	2236	WerFault.exe	dsw.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2064 msiexec.exe
2064 msiexec.exe

pid	process
2064	msiexec.exe
2064	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2204	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2064	msiexec.exe
Token: SeTakeOwnershipPrivilege	2064	msiexec.exe
Token: SeSecurityPrivilege	2064	msiexec.exe
Token: SeCreateTokenPrivilege	2204	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2204	msiexec.exe
Token: SeLockMemoryPrivilege	2204	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2204	msiexec.exe
Token: SeMachineAccountPrivilege	2204	msiexec.exe
Token: SeTcbPrivilege	2204	msiexec.exe
Token: SeSecurityPrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeLoadDriverPrivilege	2204	msiexec.exe
Token: SeSystemProfilePrivilege	2204	msiexec.exe
Token: SeSystemtimePrivilege	2204	msiexec.exe
Token: SeProfSingleProcessPrivilege	2204	msiexec.exe
Token: SeIncBasePriorityPrivilege	2204	msiexec.exe
Token: SeCreatePagefilePrivilege	2204	msiexec.exe
Token: SeCreatePermanentPrivilege	2204	msiexec.exe
Token: SeBackupPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeShutdownPrivilege	2204	msiexec.exe
Token: SeDebugPrivilege	2204	msiexec.exe
Token: SeAuditPrivilege	2204	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2204	msiexec.exe
Token: SeChangeNotifyPrivilege	2204	msiexec.exe
Token: SeRemoteShutdownPrivilege	2204	msiexec.exe
Token: SeUndockPrivilege	2204	msiexec.exe
Token: SeSyncAgentPrivilege	2204	msiexec.exe
Token: SeEnableDelegationPrivilege	2204	msiexec.exe
Token: SeManageVolumePrivilege	2204	msiexec.exe
Token: SeImpersonatePrivilege	2204	msiexec.exe
Token: SeCreateGlobalPrivilege	2204	msiexec.exe
Token: SeBackupPrivilege	2724	vssvc.exe
Token: SeRestorePrivilege	2724	vssvc.exe
Token: SeAuditPrivilege	2724	vssvc.exe
Token: SeBackupPrivilege	2064	msiexec.exe
Token: SeRestorePrivilege	2064	msiexec.exe
Token: SeRestorePrivilege	3040	DrvInst.exe
Token: SeRestorePrivilege	3040	DrvInst.exe
Token: SeRestorePrivilege	3040	DrvInst.exe
Token: SeRestorePrivilege	3040	DrvInst.exe
Token: SeRestorePrivilege	3040	DrvInst.exe
Token: SeRestorePrivilege	3040	DrvInst.exe
Token: SeRestorePrivilege	3040	DrvInst.exe
Token: SeLoadDriverPrivilege	3040	DrvInst.exe
Token: SeLoadDriverPrivilege	3040	DrvInst.exe
Token: SeLoadDriverPrivilege	3040	DrvInst.exe
Token: SeRestorePrivilege	2064	msiexec.exe
Token: SeTakeOwnershipPrivilege	2064	msiexec.exe
Token: SeRestorePrivilege	2064	msiexec.exe
Token: SeTakeOwnershipPrivilege	2064	msiexec.exe
Token: SeRestorePrivilege	2064	msiexec.exe
Token: SeTakeOwnershipPrivilege	2064	msiexec.exe
Token: SeRestorePrivilege	2064	msiexec.exe
Token: SeTakeOwnershipPrivilege	2064	msiexec.exe
Token: SeRestorePrivilege	2064	msiexec.exe
Token: SeTakeOwnershipPrivilege	2064	msiexec.exe
Token: SeRestorePrivilege	2064	msiexec.exe
Token: SeTakeOwnershipPrivilege	2064	msiexec.exe
Token: SeRestorePrivilege	2064	msiexec.exe
Token: SeTakeOwnershipPrivilege	2064	msiexec.exe
Token: SeRestorePrivilege	2064	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2204 msiexec.exe
2204 msiexec.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dsw.exe

pid process

2236 dsw.exe
2236 dsw.exe

pid	process
2204	msiexec.exe
2204	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

msiexec.exedsw.exe

description	pid	process	target process
PID 2064 wrote to memory of 2236	2064	msiexec.exe	dsw.exe
PID 2064 wrote to memory of 2236	2064	msiexec.exe	dsw.exe
PID 2064 wrote to memory of 2236	2064	msiexec.exe	dsw.exe
PID 2064 wrote to memory of 2236	2064	msiexec.exe	dsw.exe
PID 2236 wrote to memory of 1356	2236	dsw.exe	WerFault.exe
PID 2236 wrote to memory of 1356	2236	dsw.exe	WerFault.exe
PID 2236 wrote to memory of 1356	2236	dsw.exe	WerFault.exe
PID 2236 wrote to memory of 1356	2236	dsw.exe	WerFault.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2204

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
"C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 504
3⤵
- Loads dropped DLL
- Program crash
PID:1356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B4" "00000000000005C0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3040

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f768a47.rbs
Filesize
12KB

MD5
66163229eaa00d8a67668aacfcf63c12

SHA1
93df95d53bc32450d6a5245d9d096b8d81448711

SHA256
58c7f29a5efb580d34caa67e2b8760acec0abaedc5ac26c15507c2b0542c6094

SHA512
8471965ebeb8e5fefcb93aaf252b91f964e0efa9d3e87085ae5aac34de7f30659c456d96fe977cbb8087ff948ddbb3aa0bdfbab3f5e59247437fd7fcf64e05f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
771c23fe43fa540cbe539a60fbb15e67

SHA1
e68dc2440df9a984fab97a774bcefbaa464c9c34

SHA256
2d072d4cf645f4ea760cd206e2f3bbc74eba64194ec955c6c1ae91eadd60bc19

SHA512
44da85c718411ae042837d063f611bf30b9981cd0f693f56e0c370f8db566d5ae678b1b150110a71b3bbe6f07d3c828f748ef9cd018284f1786749f19176b20b

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\FilesystemDialogs.dll
Filesize
609KB

MD5
62295d2559907e61c7e74247b6a957ea

SHA1
4f4ac36435675ed38acd5bd82c73daa63342eeec

SHA256
a5860624257cf3efd51b7974e7caa0f1456380082b1199adcd8f5cf9a36495b0

SHA512
2b1bf890784e76b1504ee3ad5373faa3886dc5532484925e011f5c8f9c7aeaf1986ef2ef9491677682c678e205c22442e6415bcbde190ef06306ee111ee3f2eb

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\Fluent.dll
Filesize
379KB

MD5
e98f595caa5ee23e8a3e46d83211da9d

SHA1
a7ef9e7c3eddaa7b82acb7eba7a2c88a70bac017

SHA256
df12ced54ee1dd73b230be239fb2ffce141bbf4ff979fb33ebb153a0bda88a1a

SHA512
e777a5ace5ecef10ae051df02a443279af5f28a1e996905774f574ef8679363ae78db064ef6eb7c3f77dd87284cc0d070b1fe54b422f9ae0a2240286a9541938

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\FreeImage.dll
Filesize
1.2MB

MD5
bd7080f930113055740a2c6e6fc27432

SHA1
29b0255ba4f78840f7ebe99d40955b1de8c80cbd

SHA256
db91f4a79ea83a042002d5115e370e9716a08a38c155a9df1ca8adf1ff9d377c

SHA512
df94b402d858ad5c8a6f9b514ce9288b895885f84762527e662a0d600e02948946c7b846a737b8e656974f96cecf60d121617694ff829952e37c2c3951bee3ca

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\MediaInfo.dll
Filesize
485KB

MD5
00d6d60044b89817c3998c0bdb51cf05

SHA1
a576b444d65fca2a24541c7096c008afda26b614

SHA256
931b546cf07542ef5d631dfa270bace0dd9d104abdbad22cd6698c18f4c37b7a

SHA512
02aa66497299e16e19054ccd40e040b619e9914799f221286c94f80e3f4324a5146e42aff787d628c2678e465f756b623b2f7e50ffa395f08d9c837d4f126ad2

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\SampleDisplay.dll
Filesize
1.3MB

MD5
04adbbdcefa4318263b0d53fae0dd42a

SHA1
ee76babea22ff568f5c3f5d1868984b08785dfa9

SHA256
9dd105d58e96fc3536b1fb9802320da53931aad99f2d428634bedc783c1a70ce

SHA512
9a0e6ab10c16ad2ebf934766d7207032d3aaf1cf5eb522a9d06031cf1d06b5e54f42bf042768ab679c547eccf75539c074c5a90f3ca4221a4a8e7b83ad89c2f7

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\WinSparkle.dll
Filesize
1012KB

MD5
3e74f168ecfebd58cf6ccd53d44e2c36

SHA1
94b451195c161f087469025d208cf35989577169

SHA256
65340ef26c466ca3f76a475e8aae69eda403aa1bb8514d7f2218cfd629090679

SHA512
b5d18779345e553e34f59b9e451a4e083cef72bf13f2bb745ff143924b27a9c88765e97d172e67c091eebf373bd96671e4059030ba1761b6b3a9ca89f493cf15

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassasio.dll
Filesize
18KB

MD5
ff3d92fe7a1bf86cba27bec4523c2665

SHA1
c2184ec182c4c9686c732d9b27928bddac493b90

SHA256
9754a64a411e6b1314ae0b364e5e21ccfe2c15df2ed2e2dce2dc06fa10aa41e8

SHA512
6e0f021eb7317e021dccb8325bc42f51a0bf2b482521c05a3ff3ca9857035191f8b4b19cbe0d7130d5736f41f8f2efb2568561e9063fa55aaab9f2575afe23db

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc.dll
Filesize
31KB

MD5
a6f27196423a3d1c0caa4a0caf98893a

SHA1
58b97697fa349b40071df4272b4efbd1dd295595

SHA256
d3b9e4646f7b1cb9123914313cec23ec804bd81c4ff8b09b43c2cde5ee3e4222

SHA512
0a84cf847b80b0c2e6df9274a4199db8559757781faec508cd8999bea2c8fb5cd9bed1698144b82b86b2c6938fa8006c482a09c1b46d6bb8d2a2648a2011dea0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
Filesize
2.8MB

MD5
c968564ad07538c537b7f91960399a08

SHA1
70e63cf1a42deae9de3c6d2f89cb7ea4904e50f5

SHA256
102dd29dc62f93baa4f8f81455f7517263e98b3951771c43ff202e10c95be563

SHA512
3200fb10ae77ec2c9bde9be2685383cb5fddc560d2749e881d14d388873028069c34a0e8dc68cd6df1acbd085404c009a75cbe20402d4ce04c3ee2b75d4c8c9b

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\irender.dll
Filesize
576KB

MD5
ac1adace74866c7cf424644753de2c86

SHA1
dfb9a7ccb493120a393b004b3471d1ed8b83a5bf

SHA256
aa658f50d4d4788e598fc1da4c25731a6e7845649cfcd1707dae7253f71e1635

SHA512
6dab4e6e36942bc2231ec3e8d6895d199ecc299320f13790c4dee9626ab87b89ed9a3c5e44f7cbc37b33ccdcd1578194fd5a9c56f0c888b467a737d51184de80

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\tutorial.wav
Filesize
658KB

MD5
2681a8548eaff75b452695aa5fd5d10b

SHA1
55035741de83e4923deea71053bc1ad41b0b4850

SHA256
81c018dacc7bf03ace288c5f31845f28e90f44bf839c0752bfce383ea302800f

SHA512
2e48fcdb60bb34a21f5ba4073918912ea63f95ce90916bef5d558eb4eb7efb5a2be2c2d7789a09565b36add1989ca2c13b995c43ce6b94a21498eb012157de5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D60.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E7C.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Windows\Installer\f768a45.msi
Filesize
3.1MB

MD5
8b1fa194528093152f23290620ae2223

SHA1
abc994abdff3628208426ccc04a39f5b22af67db

SHA256
2536f899c82cb2492949e638aed2fa3420d669a6e3c6baf515cf0cf1beda3c71

SHA512
fe519b2f8309dd079d798e1c2e37f7511a4a30b6bea13bfca649669f7a21fbcd1e2e92fd75631a0af52444db61385765015c1aea2a0905516f151317ea4d28e1

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\FilesystemDialogs.dll
Filesize
670KB

MD5
ed28c75577f469c025bc335f6b932742

SHA1
00ea239d5b208a8258397f3478e827cc60ec8353

SHA256
45ee48060427db81c57adc64db581190c7cc1e25416293b6be43e72b8a03cbb3

SHA512
ccdc6143dcc76e1bf9903f1a52898fb7651b9bf7edfc8fa5a4b28b601d509e2d6b806569073536ee09c67a29932813391d025777cd05e46048c6da17af3068dd

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\FreeImage.dll
Filesize
849KB

MD5
5080bc1e4f5b88647b203a92bc55296b

SHA1
77f92daa787d2511381eb3c77f8b53779844d38c

SHA256
fef37f27d557848ee19d8b21065af566d3588c5f3f73ed26cedb57ebc85971f7

SHA512
feae5d03c431a47b3f22b3804bb494db5bd1a336a06e4f6e0f02e6344bae399be53f02da290b1f267f9034b7e2d21a8c2d229dcccaaa69ee8f1a4fcc32220f4f

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\MediaInfo.dll
Filesize
419KB

MD5
4fb7c041ea405ed0101725d959287968

SHA1
34e58a44c1f87b5328cd34b832cad1fa5eaf973e

SHA256
ba501733a9be30fa908d3c1c3c2ebb8b6b4f197d22bca710b5e714a84d94446d

SHA512
74121cc2018200b6e2fdf6f2ccfc87dc330b9d2cb922db91f73156171aec04bb59744a950c48b1f6f3c280f58463955d0d6ff678a8ba7cb529998426c6eda15c

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\SampleDisplay.dll
Filesize
1.0MB

MD5
54e0201723e628a6546eba18db743b78

SHA1
3cf90861b160bfb74d9dc3feef46b33bb8f26cce

SHA256
2af9d5843c6f35620ef5f414f6358cf601ccbc829facbca376b730645fe91702

SHA512
d6cbbcb037fbbde6fac5dd89655ab130156744b39fc4706a4c4753d89142517c1c0bef8c684185700204921be4a2f73f9533f7a358620c617289303c2fcbbd19

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\WinSparkle.dll
Filesize
710KB

MD5
3f445b05f46e32fdd6e432746972a9c7

SHA1
3708af1e027f97ca869910e26bff075b7a2354ca

SHA256
7c46bd332a90f66203b45b9fa9834b70cace371252202d427b48ac263f620dc4

SHA512
67da0f3627310c84d327496e95d5c222bf26d353b1646218496c6d37884361b0ed38392af523e172a2902300ab08719653ec58449201b28c7eb366674c15bab4

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bass.dll
Filesize
135KB

MD5
8e58fcc0672a66c827c6f90fa4b58538

SHA1
3e807dfd27259ae7548692a05af4fe54f8dd32ed

SHA256
6e1bf8ea63f9923687709f4e2f0dac7ff558b2ab923e8c8aa147384746e05b1d

SHA512
0e9faf457a278ad4c5dd171f65c24f6a027696d931a9a2a2edd4e467da8b8a9e4ab3b1fd2d758f5744bf84bece88c046cda5f7e4204bead14d7c36a46702b768

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bass_fx.dll
Filesize
67KB

MD5
d8ccb4b8235f31a3c73485fde18b0187

SHA1
723bd0f39b32aff806a7651ebc0cdbcea494c57e

SHA256
7bc733acc1d2b89e5a6546f4ebc321b1c2370e42354ea415bc5fcc6807275eba

SHA512
8edafd699f9fbec0db334b9bc96a73a9196895120f3406fff28406fd0565415ac98665c9837a5b1e0c5027162ff26bf3a316ecda6a0b51d92eb5d7002b814713

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bass_vst.dll
Filesize
27KB

MD5
5efb2702c0b3d8eeac563372a33a6ed0

SHA1
c7f969ea2e53b1bd5dbeba7dd56bff0cc4c9ea99

SHA256
40545a369fa7b72d23a58050d32dc524b6905e9b0229719022dbda0d2fa8765b

SHA512
8119526f8573ea6e5bed16a57d56084260afee511c9aad3d542388a783548e5b32ed8fb568d5b97deed791162bcd5577fcc3c76abf4d147ea13bea5c2a6ea794

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_flac.dll
Filesize
76KB

MD5
5199d6173a6deb45c275ef32af377c3c

SHA1
e8989859b917cfa106b4519fefe4655c4325875b

SHA256
a36f06cbe60fc1a305bd16cd30b35b9c026fd514df89cd88c9c83d22aefbe8c3

SHA512
80b96196f1b3d6640035e8b8632a25ecdb3e4e823e1b64fc658b31aae6c6799aa1d9fd1acffbef6ff9082e0433ac9ab9426d5400d3644db9958940b8bb13f6d8

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_mp3.dll
Filesize
75KB

MD5
46ede9ea58c0ac20baf444750311e3f8

SHA1
246c36050419602960fca4ec6d2079ea0d91f46e

SHA256
7ea1636182d7520e5d005f3f8c6c1818148824cee4f092e2d2fe4f47c1793236

SHA512
d9154430c72cbf78f4f49ec1eee888c0004f30a58a70cee49f5108ded0994ba299ba6bf552a55ffeedb2ab53107172324156e12e2fbae42f8f14f87ec37cc4e7

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_ogg.dll
Filesize
164KB

MD5
89e794bbd022ae1cafbf1516541d6ba5

SHA1
a69f496680045e5f30b636e9f17429e0b3dd653e

SHA256
7d7eb0bc188fc3a8e7af7e5325d4f5e5eb918c4138aea3de60d6b1afac6863f9

SHA512
16455e29a1beece663878e84d91c8e75c34b483b6ff3b5853ced97670a75a9c29cc7a7aa78b0c158eb760cda5d3e44541aae2cc89b57d290e39b427d4c770000

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_opus.dll
Filesize
141KB

MD5
b6022150de5aeab34849ade53a9ac397

SHA1
203d9458c92fc0628a84c483f17043ce468fa62f

SHA256
c53b12ebe8ea411d8215c1b81de09adc7f4cf1e84fd85a7afa13f1f4a41f8e9d

SHA512
2286399bd1f3576c6ce168e824f4d70c637485fae97d274597d045a894740519512f1865e20562656297072b5625bdd2a5ec4d4f5038176f764eb37e22451ade

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassmix.dll
Filesize
31KB

MD5
d31da7583083c1370f3c6b9c15f363cc

SHA1
1ebe7b1faf94c4fe135f34006e7e7cbbc0d8476c

SHA256
cff3edc109bc0d186ba8ddf60bc99e48ff3467771e741c7168adbdbe03379506

SHA512
a80364384eca446a378e3ae3420a0e3545e1d24426a9e43f3e27381cb09bb4cd1121b66c576e5a981b2e5d661f82590eb0c0fe8d8243ef872f84809ec906e266

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\basswasapi.dll
Filesize
21KB

MD5
cdfbe254cc64959fc0fc1200f41f34c0

SHA1
4e0919a8a5c4b23441e51965eaaa77f485584c01

SHA256
9513129c0bb417698a60c5e4dd232963605d1c84e01b9f883f63d03b453173a9

SHA512
63704a7a4d0cd8b53972e29fcbee71f2c3eb86a0411f90fc8375e67cb4b3bddb36c753f3f5b113c3ca333c381f86a19e2168218cc2074f05ad1143bc118cd610

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
Filesize
244KB

MD5
1019be25b415065bdcfdc9ef9c259f88

SHA1
8d59b5469443fce608468576c988b8d0c8bbd123

SHA256
8411cf45e3459f51dad91a9a6749dfdbfe98e2dd8669637b708204c8a1d7c66e

SHA512
077704b51682b404624221898720a2f873ecd717a3c6decfa304cc47b2658e9dc26399a85f1919c58bb4a671370ed2be6ba0ce762be40057db2f4c473a7a4d13

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
Filesize
111KB

MD5
189b1b9d6ec1677f8fb358e1ff22b766

SHA1
b3e9d1b09c53a512efd93ea79a1c155f5c0434c4

SHA256
f0328d7312ea741eb7860a00e3e387d3f0a4522bf9daa9dd51e740b83a8776ea

SHA512
35860534540ed5cdd4a1982f65ec9a51eadd9506fa9304390e57f854c57ec7cbcce86e71a292e76e6951fbaf21d185440acb4d9c1eaa0b78407b813d5992e39f

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
Filesize
56KB

MD5
36771fa50176424d423a259546d36fa9

SHA1
804c0c56ccfcc0cfdc6d80527f169358f422f57c

SHA256
ba0adcbc2440c006f52dd3e85b3936af3a252e43ccf2e83045945d2b21c8ecb5

SHA512
db34e48101b760cad4f5909845a4a3e724063a2decfb3bc4a075999a5c9df4727e7b70aa2df17e83e39f442e515664ff0cfb2d62e2f8c2d3236cec3e9f0f9733

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
Filesize
189KB

MD5
f3e9271da313414e07f0080d0f4b3d1c

SHA1
d3004f675eef214aabb7bfadca8cc1d665cfc08e

SHA256
727662fd649c3e0a3c3255b66fc635dce24af3da11b43ef93eef257b27d29e3a

SHA512
da8584e5ae43b2be14da0e99ba223f61b6ae98e94dca3b35ed782f69f2d4213aadcd17d0bd62ffdcb76802ee29957087e4745e66228c4355cd14c5c9f44567e1

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
Filesize
525KB

MD5
361144144302e903187328da4ab5e7dd

SHA1
cb5f7bf8a576dd636895ecd05807be4b0ef589d2

SHA256
0cdd9e5a49a0c9ce068d9888ac37ed765a9c8784b7f6df05adb415c0fbcad6f4

SHA512
2fbbe63c2a0c2ee1b2e47d7f0a2827f89a955ada77ca224ca71c4c9a9e7e9201c5fc7877d22d6a97bd7af9781f299f966fb9a7e171b04b3168b00d1473bfa792

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\irender.dll
Filesize
538KB

MD5
322d95e2c172ff8dd88f1f3af280d6c9

SHA1
2eaca7c9b870de1662f30c8995d2a2f5a4541773

SHA256
3ae47306d2bcc52c9aaaa8a88d279885a6ebef9563dcdbedb1e64bb9853b3204

SHA512
342c001e5e556244ba537a8e3bbc51dcf137e79aba55e154a0a40ce3024b14e34ee2b8dec44d55988fa89b7502aed460c938013aad3c52843fa1050797b42aa1

Download Submit
memory/2236-128-0x0000000074E80000-0x0000000074ECD000-memory.dmp

Filesize
308KB

Download
memory/2236-125-0x0000000000BB0000-0x0000000000E93000-memory.dmp

Filesize
2.9MB

Download
memory/2236-139-0x00000000003D0000-0x00000000003EE000-memory.dmp

Filesize
120KB

Download
memory/2236-133-0x0000000074DA0000-0x0000000074DC8000-memory.dmp

Filesize
160KB

Download
memory/2236-137-0x00000000003D0000-0x00000000003ED000-memory.dmp

Filesize
116KB

Download
memory/2236-135-0x00000000003D0000-0x00000000003ED000-memory.dmp

Filesize
116KB

Download
memory/2236-136-0x0000000074D00000-0x0000000074D9E000-memory.dmp

Filesize
632KB

Download
memory/2236-132-0x0000000074DD0000-0x0000000074DDE000-memory.dmp

Filesize
56KB

Download
memory/2236-160-0x00000000033A0000-0x000000000342B000-memory.dmp

Filesize
556KB

Download
memory/2236-163-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/2236-129-0x00000000003D0000-0x00000000003ED000-memory.dmp

Filesize
116KB

Download
memory/2236-159-0x0000000074330000-0x0000000074455000-memory.dmp

Filesize
1.1MB

Download
memory/2236-141-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/2236-149-0x0000000074AB0000-0x0000000074AD4000-memory.dmp

Filesize
144KB

Download
memory/2236-167-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/2236-146-0x0000000074AE0000-0x0000000074B16000-memory.dmp

Filesize
216KB

Download
memory/2236-150-0x00000000001C0000-0x00000000001CD000-memory.dmp

Filesize
52KB

Download
memory/2236-148-0x00000000003D0000-0x00000000003E7000-memory.dmp

Filesize
92KB

Download
memory/2236-145-0x00000000001C0000-0x00000000001C5000-memory.dmp

Filesize
20KB

Download
memory/2236-144-0x0000000074CF0000-0x0000000074CFE000-memory.dmp

Filesize
56KB

Download
memory/2236-140-0x0000000074BB0000-0x0000000074BE3000-memory.dmp

Filesize
204KB

Download
memory/2236-177-0x00000000003D0000-0x00000000003EE000-memory.dmp

Filesize
120KB

Download
memory/2236-176-0x00000000003D0000-0x00000000003ED000-memory.dmp

Filesize
116KB

Download
memory/2236-178-0x0000000000400000-0x0000000000BAB000-memory.dmp

Filesize
7.7MB

Download
memory/2236-179-0x0000000000BB0000-0x0000000000E93000-memory.dmp

Filesize
2.9MB

Download
memory/2236-180-0x0000000072B30000-0x0000000073853000-memory.dmp

Filesize
13.1MB

Download
memory/2236-181-0x00000000001C0000-0x00000000001C5000-memory.dmp

Filesize
20KB

Download
memory/2236-182-0x00000000003D0000-0x00000000003E7000-memory.dmp

Filesize
92KB

Download
memory/2236-183-0x00000000001C0000-0x00000000001CD000-memory.dmp

Filesize
52KB

Download
memory/2236-187-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads