babadeda | 75f193ede0c901a7898b88ec92096f151bd1dd4f5bcd45e80047d5e35fb38a55

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ClipPlusCommunitySetup_ns.msi
Size

17.1MB
MD5

b82ada91e8742234257d9cad38deebfe
SHA1

d1278efa9729f955de1dbfcfe53550e67212ff9b
SHA256

3c8a05c5e2b599db85700ff9334a778efd2a99f6b4a1852aa0c129ba6039f834
SHA512

676d29697382b1375c7da26fcd6af20a7c5fb9f0f506c951c7280c7da12778d40fcfb1ef50653628123edf6cba8308d43a4945489a5f6b58e67dcc61d6fd373b
SSDEEP

393216:bnEbwdw5PBbXDqPiHNTS3ByWhGhz3iQw0FHufQMfh1GD6QGhNgqx9OPNQNI62vhp:wbwdwnBtcFhG1w0MVZ1GD6QGhNpwsIn/

Score

10^/10

babadeda crypter loader

Malware Config

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\tutorial.wav	family_babadeda

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\f762a4b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f762a4b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f762a4c.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f762a4c.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B06.tmp	msiexec.exe
File created	C:\Windows\Installer\f762a4e.msi	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

dsw.exe

pid process

2644 dsw.exe

Loads dropped DLL 18 IoCs

Processes:

dsw.exe

pid	process
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe
2644	dsw.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2056 msiexec.exe
2056 msiexec.exe

pid	process
2056	msiexec.exe
2056	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	1212	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1212	msiexec.exe
Token: SeRestorePrivilege	2056	msiexec.exe
Token: SeTakeOwnershipPrivilege	2056	msiexec.exe
Token: SeSecurityPrivilege	2056	msiexec.exe
Token: SeCreateTokenPrivilege	1212	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1212	msiexec.exe
Token: SeLockMemoryPrivilege	1212	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1212	msiexec.exe
Token: SeMachineAccountPrivilege	1212	msiexec.exe
Token: SeTcbPrivilege	1212	msiexec.exe
Token: SeSecurityPrivilege	1212	msiexec.exe
Token: SeTakeOwnershipPrivilege	1212	msiexec.exe
Token: SeLoadDriverPrivilege	1212	msiexec.exe
Token: SeSystemProfilePrivilege	1212	msiexec.exe
Token: SeSystemtimePrivilege	1212	msiexec.exe
Token: SeProfSingleProcessPrivilege	1212	msiexec.exe
Token: SeIncBasePriorityPrivilege	1212	msiexec.exe
Token: SeCreatePagefilePrivilege	1212	msiexec.exe
Token: SeCreatePermanentPrivilege	1212	msiexec.exe
Token: SeBackupPrivilege	1212	msiexec.exe
Token: SeRestorePrivilege	1212	msiexec.exe
Token: SeShutdownPrivilege	1212	msiexec.exe
Token: SeDebugPrivilege	1212	msiexec.exe
Token: SeAuditPrivilege	1212	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1212	msiexec.exe
Token: SeChangeNotifyPrivilege	1212	msiexec.exe
Token: SeRemoteShutdownPrivilege	1212	msiexec.exe
Token: SeUndockPrivilege	1212	msiexec.exe
Token: SeSyncAgentPrivilege	1212	msiexec.exe
Token: SeEnableDelegationPrivilege	1212	msiexec.exe
Token: SeManageVolumePrivilege	1212	msiexec.exe
Token: SeImpersonatePrivilege	1212	msiexec.exe
Token: SeCreateGlobalPrivilege	1212	msiexec.exe
Token: SeBackupPrivilege	2864	vssvc.exe
Token: SeRestorePrivilege	2864	vssvc.exe
Token: SeAuditPrivilege	2864	vssvc.exe
Token: SeBackupPrivilege	2056	msiexec.exe
Token: SeRestorePrivilege	2056	msiexec.exe
Token: SeRestorePrivilege	2752	DrvInst.exe
Token: SeRestorePrivilege	2752	DrvInst.exe
Token: SeRestorePrivilege	2752	DrvInst.exe
Token: SeRestorePrivilege	2752	DrvInst.exe
Token: SeRestorePrivilege	2752	DrvInst.exe
Token: SeRestorePrivilege	2752	DrvInst.exe
Token: SeRestorePrivilege	2752	DrvInst.exe
Token: SeLoadDriverPrivilege	2752	DrvInst.exe
Token: SeLoadDriverPrivilege	2752	DrvInst.exe
Token: SeLoadDriverPrivilege	2752	DrvInst.exe
Token: SeRestorePrivilege	2056	msiexec.exe
Token: SeTakeOwnershipPrivilege	2056	msiexec.exe
Token: SeRestorePrivilege	2056	msiexec.exe
Token: SeTakeOwnershipPrivilege	2056	msiexec.exe
Token: SeRestorePrivilege	2056	msiexec.exe
Token: SeTakeOwnershipPrivilege	2056	msiexec.exe
Token: SeRestorePrivilege	2056	msiexec.exe
Token: SeTakeOwnershipPrivilege	2056	msiexec.exe
Token: SeRestorePrivilege	2056	msiexec.exe
Token: SeTakeOwnershipPrivilege	2056	msiexec.exe
Token: SeRestorePrivilege	2056	msiexec.exe
Token: SeTakeOwnershipPrivilege	2056	msiexec.exe
Token: SeRestorePrivilege	2056	msiexec.exe
Token: SeTakeOwnershipPrivilege	2056	msiexec.exe
Token: SeRestorePrivilege	2056	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1212 msiexec.exe
1212 msiexec.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dsw.exe

pid process

2644 dsw.exe
2644 dsw.exe

pid	process
1212	msiexec.exe
1212	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 2056 wrote to memory of 2644	2056	msiexec.exe	dsw.exe
PID 2056 wrote to memory of 2644	2056	msiexec.exe	dsw.exe
PID 2056 wrote to memory of 2644	2056	msiexec.exe	dsw.exe
PID 2056 wrote to memory of 2644	2056	msiexec.exe	dsw.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ClipPlusCommunitySetup_ns.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056

C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
"C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005BC" "000000000000055C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2752

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f762a4d.rbs
Filesize
12KB

MD5
bfd88a74dda85618213e19ce6d80b2e2

SHA1
78aac4ad59f8abe75c91d0f7b512360c30992229

SHA256
87b7592f5e112fc0cb95811e3797b3dc9ead95ac6c9e3fb36677927fcc6c5c28

SHA512
47596ae3e0eb729734300f17639247ab2d12ce9653b4847b5d1b6e85c5af8eebbcbef47afd6e637950bf67d7932252436a0be10ed26d5bf3f045d646fb661afc

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\FilesystemDialogs.dll
Filesize
93KB

MD5
290f2720961e73fd2335eecd7266256e

SHA1
d36959ef5b433f430336da17b1662d145d483b36

SHA256
fe073449d29745d2755022feb0d7e366e18cb8dc4f09c1ad57776974fd1d7930

SHA512
19d1b3ab8d6ebffd44b2cacd8c95be53ebd2d115903ced219f5a89b610a5df09af483aa6f1e04aa2bcf57cd3020d0e41a520fc757bd9f680afc19f30ec57e41a

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\Fluent.dll
Filesize
100KB

MD5
c2c069dfca0017a8c66a1d2b508bc139

SHA1
6b6e91396d1ec99106e632a1447491f4d7d2264d

SHA256
6225cccbc8ed767909eb0c637f9b066ead3ff692dec625bc04a921fb0b8ebdab

SHA512
9d073733b8ebaac71f3433df79f3e04f7f068b0925f150fc48c3460dd7d3c1e25076667a1e9e47e71cc7de66b5190120e909646e67fe28dc5c56a9e3c96ea086

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\FreeImage.dll
Filesize
186KB

MD5
377752cd24ac17669a2604f69febdba1

SHA1
5c3a132270b87a04c533a30ec7700cee69c1a9e3

SHA256
314a4fd29b291a0d6155248ca2d3c2dd320d41d6544f70db3a442de1e312cae1

SHA512
d61b962ce0a5460a0b1847e826c35be7e471dfdb1008a066a4fa1243f140c222cb26ab556f0dd4f4207389632410461e4cadf2a834cf2a4bd16d36185b5fe492

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\MediaInfo.dll
Filesize
140KB

MD5
ac2f0fe88ecba8cb3ae56b8be3601648

SHA1
942a79027fc9535d19d54a6a6c4442b041752368

SHA256
9e227d35510cc6b4ed2f396e2a8856ec710b50b4fffe288c3e91057501a38a38

SHA512
53fe5c737d618f666667d6ee42d45e556e6497ccd3e120f88b6c7a3decbec66f16844f14bb566f034358937fa693de4f4a221c423a42990d5adfb2a24faaeb6c

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\SampleDisplay.dll
Filesize
254KB

MD5
d3a84dfa3ab1f689988a70b5e8005bf9

SHA1
9b53991fb2902004264a96d392de7dd84e203db0

SHA256
67b5ad943611870c27d59db705c179f882b3dd0ffc431f727d50fa5953341037

SHA512
4dae2855644e9c1715ef4afc2326439fcac88fa73982bcb406cced6f56ba00582acfd53f8b7b411f8610cc3c423bba76715504a80990e6e1111d5694ffaadc0f

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\WinSparkle.dll
Filesize
121KB

MD5
3621a8d82b5fd9540a8301d8ee551b68

SHA1
eed2053d6a6ea8b3f11326dabed953b63bfedc9f

SHA256
ea2b626cbfb644328a190d8371306f9a63322bda263a09dcec6e6af1ead77992

SHA512
0124177003d0ac6849d67446bf2c7b869c87f99cc3e11c481fa3d16624a585352e6587f5280656db716af735e5f228bb50ac7dc888498de8f790c865ed67090e

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\bass_vst.dll
Filesize
27KB

MD5
5efb2702c0b3d8eeac563372a33a6ed0

SHA1
c7f969ea2e53b1bd5dbeba7dd56bff0cc4c9ea99

SHA256
40545a369fa7b72d23a58050d32dc524b6905e9b0229719022dbda0d2fa8765b

SHA512
8119526f8573ea6e5bed16a57d56084260afee511c9aad3d542388a783548e5b32ed8fb568d5b97deed791162bcd5577fcc3c76abf4d147ea13bea5c2a6ea794

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe
Filesize
1.3MB

MD5
cefd423df7a299b9cf378a8995dd5ad9

SHA1
abc8dea81cf74783bd6d016a3e2feb3839390dc4

SHA256
27944c044a4dcd975420e8b15560016602f83f4069520789628f81caa14a6dce

SHA512
4104609d770fdc3cc581b4699d86203ac3004989870d3a782eb400a012ce5bb2e4fb3ef8bbe3d48d551083b1530fcb7179bad8839c17d8c843a645cd75367473

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\irender.dll
Filesize
365KB

MD5
a56c36a7dd238d72672a57573bdb1833

SHA1
2a7db7c8e4b80e1bc9b384159d056c6b5cfc9a38

SHA256
c6138784ca37688e93932f4cdaeebac98522b974fed2d5109844e3c46448dd60

SHA512
a14a1f88f888223af231eda6bbca74449aac21aa5f46e8f2f4b34175d9b115656122e123e667ad70b7f7f8c7d7a338177a111afffa8c38e7f96e740fb4d7d46f

Download Submit
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\tutorial.wav
Filesize
135KB

MD5
a4c63effcc46eaad8dd1a53e39b1f87d

SHA1
9a2a507b07ae859d74fd7777325439c09decc792

SHA256
a3cf1f0f880ea30aa4f9d8ecf767d86c0a8898e0f50c833dbb76a170c37eca13

SHA512
1c2cfcba081ba1d365cacb8406341d3255d300a8149487ad16d4a2c2213c7de5d8c22c118d8bf23e34cc8f9dea459e82da0b3f24e97cdc693dd531020e4a3ffa

Download Submit
C:\Windows\Installer\f762a4b.msi
Filesize
314KB

MD5
f4237bd332d6a528a1a9f0fb3ae16679

SHA1
bed1b16e0da7ced0ba716ee0a81b5c6331e54c0e

SHA256
b5d9b9baa29b4d508675ca62dcba6da0468cd6999240cc02b0851f19a6959f3d

SHA512
0706aa13232cec87f360cf7421a75fc623d82ab1409dbef9848f06a2f9317fb06f042ea7f30126ef59af500699c8c147c4ae69c2f1f21135b220fa70f5c06076

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\FilesystemDialogs.dll
Filesize
89KB

MD5
f20602c73f1ef3af1d4bc548bd9b0742

SHA1
1264b76d0618e49350393c8fff9bb2b909b452bf

SHA256
2a74e26525d0c7501babee140f9ecaa3e71fbe993c1dedbe4b8bb3391a516911

SHA512
c13053eae9eca1750169ed03f7900ac8263bf9672c08f059a07489821cbcf4a773add635aa0a616b1fc16913147a9726ac4ce10615e575df51317ce2390e18c9

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\Fluent.dll
Filesize
179KB

MD5
b8eb4b304bb2caf1b488abdd98d09aa7

SHA1
34c8ba442caa17c756cbdfead8e9b1d3b4640502

SHA256
d83be5ada79acd47c19ccf777a94886458e7a15cd04041f49ab273bec3cb1bfb

SHA512
97171a55679ebf4e3fc04a35d270c7ace822e92d9b97c5970df500a28a98ab70ae78eb285b1922ca97c6ddff213ae5361fb0abe7ae32f6b3e80e40a0d5d4679c

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\FreeImage.dll
Filesize
107KB

MD5
f0cadf8548cff266e741a19219f447c0

SHA1
7cd4b19a5bb350487893b1bfde05965beebc83b9

SHA256
474d296b39086a5680a8fda9dd895cf4e1f5817b7538a813855e39210a3ec5ef

SHA512
6c059f5037311ac2b82d508d58bc6d8b4ce95b67e4dedc39437d1135e2e0bdc9e87a3f3e2307e80c27036288679ec5f0f6c2f587940aff4b181e4f55160fdf19

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\MediaInfo.dll
Filesize
160KB

MD5
eed4c6521bcb41b4e109782b8a24410d

SHA1
a9ee67f0e2c372a244520774e7252c88a4272cad

SHA256
55f92e3d92d9d4a5df61f26365da4246ce427985a8c355baf3a8ae40ae4cc91f

SHA512
5779c548a21e0af32e0ddd6472a34fed385991ed3bec54395549eb315ea080404e8c6429a9bd59fff594e65b9597df02ced67f35eca09c8806116f0238c5a318

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\SampleDisplay.dll
Filesize
290KB

MD5
444ad68918251b4cc32f07219a5a6c31

SHA1
14b6572c4fc075ad5164ace11f098b7f735a6a17

SHA256
deb374d90eec719785c54576422fd28acad8e98544a1deec4d29c03506db638b

SHA512
dda97c60eadab52b249d5c470d446d05d8b8f6fdc758bfe659143b272d18373d54521fb0eef1a6cc3654af0aeb9e7a51471baa1aa57c54c066121159ae0c7b3a

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\WinSparkle.dll
Filesize
158KB

MD5
a7d2119242e0e6ad2717030d4b62068b

SHA1
5702896034230cd88141b4ec551a97aa6be16e66

SHA256
63514bd2ac28db14736d4c33b3da92fbec3d3ef068af61f34a4acfdd2fb3266b

SHA512
4729a375b99d5fbe49657adb4c617f48b8fb9f068aa9452acdbe0f04b0635405716692cd6848a1f1dbb3e2a0f241246438d9c321b2568675efc9ea2e782ca711

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bass.dll
Filesize
135KB

MD5
8e58fcc0672a66c827c6f90fa4b58538

SHA1
3e807dfd27259ae7548692a05af4fe54f8dd32ed

SHA256
6e1bf8ea63f9923687709f4e2f0dac7ff558b2ab923e8c8aa147384746e05b1d

SHA512
0e9faf457a278ad4c5dd171f65c24f6a027696d931a9a2a2edd4e467da8b8a9e4ab3b1fd2d758f5744bf84bece88c046cda5f7e4204bead14d7c36a46702b768

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bass_fx.dll
Filesize
67KB

MD5
d8ccb4b8235f31a3c73485fde18b0187

SHA1
723bd0f39b32aff806a7651ebc0cdbcea494c57e

SHA256
7bc733acc1d2b89e5a6546f4ebc321b1c2370e42354ea415bc5fcc6807275eba

SHA512
8edafd699f9fbec0db334b9bc96a73a9196895120f3406fff28406fd0565415ac98665c9837a5b1e0c5027162ff26bf3a316ecda6a0b51d92eb5d7002b814713

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassasio.dll
Filesize
18KB

MD5
ff3d92fe7a1bf86cba27bec4523c2665

SHA1
c2184ec182c4c9686c732d9b27928bddac493b90

SHA256
9754a64a411e6b1314ae0b364e5e21ccfe2c15df2ed2e2dce2dc06fa10aa41e8

SHA512
6e0f021eb7317e021dccb8325bc42f51a0bf2b482521c05a3ff3ca9857035191f8b4b19cbe0d7130d5736f41f8f2efb2568561e9063fa55aaab9f2575afe23db

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc.dll
Filesize
31KB

MD5
a6f27196423a3d1c0caa4a0caf98893a

SHA1
58b97697fa349b40071df4272b4efbd1dd295595

SHA256
d3b9e4646f7b1cb9123914313cec23ec804bd81c4ff8b09b43c2cde5ee3e4222

SHA512
0a84cf847b80b0c2e6df9274a4199db8559757781faec508cd8999bea2c8fb5cd9bed1698144b82b86b2c6938fa8006c482a09c1b46d6bb8d2a2648a2011dea0

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_flac.dll
Filesize
76KB

MD5
5199d6173a6deb45c275ef32af377c3c

SHA1
e8989859b917cfa106b4519fefe4655c4325875b

SHA256
a36f06cbe60fc1a305bd16cd30b35b9c026fd514df89cd88c9c83d22aefbe8c3

SHA512
80b96196f1b3d6640035e8b8632a25ecdb3e4e823e1b64fc658b31aae6c6799aa1d9fd1acffbef6ff9082e0433ac9ab9426d5400d3644db9958940b8bb13f6d8

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_mp3.dll
Filesize
75KB

MD5
46ede9ea58c0ac20baf444750311e3f8

SHA1
246c36050419602960fca4ec6d2079ea0d91f46e

SHA256
7ea1636182d7520e5d005f3f8c6c1818148824cee4f092e2d2fe4f47c1793236

SHA512
d9154430c72cbf78f4f49ec1eee888c0004f30a58a70cee49f5108ded0994ba299ba6bf552a55ffeedb2ab53107172324156e12e2fbae42f8f14f87ec37cc4e7

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_ogg.dll
Filesize
164KB

MD5
89e794bbd022ae1cafbf1516541d6ba5

SHA1
a69f496680045e5f30b636e9f17429e0b3dd653e

SHA256
7d7eb0bc188fc3a8e7af7e5325d4f5e5eb918c4138aea3de60d6b1afac6863f9

SHA512
16455e29a1beece663878e84d91c8e75c34b483b6ff3b5853ced97670a75a9c29cc7a7aa78b0c158eb760cda5d3e44541aae2cc89b57d290e39b427d4c770000

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassenc_opus.dll
Filesize
141KB

MD5
b6022150de5aeab34849ade53a9ac397

SHA1
203d9458c92fc0628a84c483f17043ce468fa62f

SHA256
c53b12ebe8ea411d8215c1b81de09adc7f4cf1e84fd85a7afa13f1f4a41f8e9d

SHA512
2286399bd1f3576c6ce168e824f4d70c637485fae97d274597d045a894740519512f1865e20562656297072b5625bdd2a5ec4d4f5038176f764eb37e22451ade

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\bassmix.dll
Filesize
31KB

MD5
d31da7583083c1370f3c6b9c15f363cc

SHA1
1ebe7b1faf94c4fe135f34006e7e7cbbc0d8476c

SHA256
cff3edc109bc0d186ba8ddf60bc99e48ff3467771e741c7168adbdbe03379506

SHA512
a80364384eca446a378e3ae3420a0e3545e1d24426a9e43f3e27381cb09bb4cd1121b66c576e5a981b2e5d661f82590eb0c0fe8d8243ef872f84809ec906e266

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\basswasapi.dll
Filesize
21KB

MD5
cdfbe254cc64959fc0fc1200f41f34c0

SHA1
4e0919a8a5c4b23441e51965eaaa77f485584c01

SHA256
9513129c0bb417698a60c5e4dd232963605d1c84e01b9f883f63d03b453173a9

SHA512
63704a7a4d0cd8b53972e29fcbee71f2c3eb86a0411f90fc8375e67cb4b3bddb36c753f3f5b113c3ca333c381f86a19e2168218cc2074f05ad1143bc118cd610

Download Submit
\Users\Admin\AppData\Local\Programs\Clip Plus Community\irender.dll
Filesize
331KB

MD5
4cfdd136b31e84bd1a9c178580715dbe

SHA1
38ede7f1729a1f56c9e17edd5dd7fde670f18a59

SHA256
8205002164f8f617cbba4baad7fd4a6af22d2c8adf7ec53c98c403dc648ccdc0

SHA512
2a65256eb784e3c598fba5f3686da310ef10b4101df6f27002e781faea53967807dd6eb5c3239d1768bcf6e6ff81a88c0bd7d442f118b945a8c50df9c79db24a

Download Submit
memory/2644-87-0x0000000074550000-0x0000000074583000-memory.dmp

Filesize
204KB

Download
memory/2644-107-0x0000000073E20000-0x0000000073F45000-memory.dmp

Filesize
1.1MB

Download
memory/2644-109-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2644-75-0x00000000748B0000-0x00000000748FD000-memory.dmp

Filesize
308KB

Download
memory/2644-79-0x0000000074660000-0x000000007466E000-memory.dmp

Filesize
56KB

Download
memory/2644-80-0x0000000074630000-0x0000000074658000-memory.dmp

Filesize
160KB

Download
memory/2644-99-0x0000000000230000-0x000000000023D000-memory.dmp

Filesize
52KB

Download
memory/2644-113-0x0000000003780000-0x000000000380B000-memory.dmp

Filesize
556KB

Download
memory/2644-118-0x0000000000400000-0x0000000000BAB000-memory.dmp

Filesize
7.7MB

Download
memory/2644-120-0x0000000004530000-0x0000000004531000-memory.dmp

Filesize
4KB

Download
memory/2644-121-0x0000000072800000-0x0000000073523000-memory.dmp

Filesize
13.1MB

Download
memory/2644-119-0x0000000000E00000-0x00000000010E3000-memory.dmp

Filesize
2.9MB

Download
memory/2644-122-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/2644-123-0x0000000073E20000-0x0000000073F45000-memory.dmp

Filesize
1.1MB

Download
memory/2644-98-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2644-97-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2644-95-0x0000000074440000-0x0000000074464000-memory.dmp

Filesize
144KB

Download
memory/2644-93-0x0000000074470000-0x00000000744A6000-memory.dmp

Filesize
216KB

Download
memory/2644-92-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/2644-91-0x0000000074540000-0x000000007454E000-memory.dmp

Filesize
56KB

Download
memory/2644-89-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download
memory/2644-82-0x0000000000230000-0x000000000024D000-memory.dmp

Filesize
116KB

Download
memory/2644-86-0x0000000000260000-0x000000000027E000-memory.dmp

Filesize
120KB

Download
memory/2644-84-0x0000000000230000-0x000000000024D000-memory.dmp

Filesize
116KB

Download
memory/2644-83-0x0000000074590000-0x000000007462E000-memory.dmp

Filesize
632KB

Download
memory/2644-77-0x0000000000230000-0x000000000024D000-memory.dmp

Filesize
116KB

Download
memory/2644-72-0x0000000000E00000-0x00000000010E3000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads