Analysis
-
max time kernel
89s -
max time network
97s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
21-11-2024 07:47
Static task
static1
Behavioral task
behavioral1
Sample
Clip Studio Paint EX 2.2.0 (x64) Multilingual By GetPCSofts/CSP_220w_setup.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
Clip Studio Paint EX 2.2.0 (x64) Multilingual By GetPCSofts/Crack/CLIPStudioPaint.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
Clip Studio Paint EX 2.2.0 (x64) Multilingual By GetPCSofts/Crack/INSTRUCTION (read me first).txt
Resource
win10ltsc2021-20241023-en
General
-
Target
Clip Studio Paint EX 2.2.0 (x64) Multilingual By GetPCSofts/Crack/CLIPStudioPaint.exe
-
Size
35.3MB
-
MD5
53231d1f6f6ef97a2900d8b54de10e97
-
SHA1
a4f2b153d5c3787a41268e963d0705e5e7562714
-
SHA256
f718a2c7314f22029e508b072a65df3e2f86127bc1b94f66ae6b9482fc8b381d
-
SHA512
009e11e4ef6592d3a3cdf600d63eb8ee9870ba16df13ebfc15179e491ae24364584d25b1db86924cffe788e5901f5877a60339dccc60d61bfceb2d8f35486ea1
-
SSDEEP
786432:wmSJ2pMSdIFPXHe5jniRmPq9aD3nPOBXP+qGgN2hnv9EdEboN5:w1Jk7OJ3eBEEQE2BXmGawx5
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
taskmgr.exepid process 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 1968 taskmgr.exe Token: SeSystemProfilePrivilege 1968 taskmgr.exe Token: SeCreateGlobalPrivilege 1968 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
Processes:
taskmgr.exepid process 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
Processes:
taskmgr.exepid process 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Clip Studio Paint EX 2.2.0 (x64) Multilingual By GetPCSofts\Crack\CLIPStudioPaint.exe"C:\Users\Admin\AppData\Local\Temp\Clip Studio Paint EX 2.2.0 (x64) Multilingual By GetPCSofts\Crack\CLIPStudioPaint.exe"1⤵PID:4944
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1968