Analysis
-
max time kernel
25s -
max time network
26s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-01-2025 20:07
Behavioral task
behavioral1
Sample
ClawLoader.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ClawLoader.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ClawLoader.exe
-
Size
9.9MB
-
MD5
76c342b6f59b9777acf846f391f4eff0
-
SHA1
8d5c1fa4cd4d18a553ce64ea84622ff7151b315c
-
SHA256
3679db6d8c374db965bc7856ac071678b069ab04011bcba8845602cdac9b55fb
-
SHA512
933c1160eef8e874284473c16b911d4c5af1d19a094398ec91007020968903febbfe4ea11248fe5bf8ca0d49a948aa3bdedd513b9a74c5b59865d9e5a909fa80
-
SSDEEP
98304:c1TllXwYCe9Kq59V+9Ux6lct0znXgEAWGgbZmYXz:c1fCe9P5ohlct0DXZDhz
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" ClawLoader.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2396 ClawLoader.exe Token: SeDebugPrivilege 4196 taskmgr.exe Token: SeSystemProfilePrivilege 4196 taskmgr.exe Token: SeCreateGlobalPrivilege 4196 taskmgr.exe Token: 33 4196 taskmgr.exe Token: SeIncBasePriorityPrivilege 4196 taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2396 wrote to memory of 316 2396 ClawLoader.exe 84 PID 2396 wrote to memory of 316 2396 ClawLoader.exe 84 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 316 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ClawLoader.exe"C:\Users\Admin\AppData\Local\Temp\ClawLoader.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\ClawLoader.exe2⤵
- Views/modifies file attributes
PID:316
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4196
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD5c253318aff3a18eafc6c80e0b1226593
SHA19dace52e81bc4cefbdd3a8e66aad6410a10ec0ab
SHA256373e2337fac201ef30e752aac3b5cd708ee20227084c49995111fcbb692c38a8
SHA512466af21ad70335cf61940a74979d3d72a6c28dfb7a7cd6ce4e3ea49402195ceff2709c359d6e18796d4c7cb4e11d2d2b14911ea6f732be6239e890628a2690e5