65074307103c32cf27f0e0ff2f4d171c69e71b287a34e51183e9f65f542ae230

Analysis

user interaction
yes
max time kernel
43s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clodespo0fer.exe
Size 246KB
Sample260702-l9ppsset5r
SHA256 65074307103c32cf27f0e0ff2f4d171c69e71b287a34e51183e9f65f542ae230
MD5 92db6000e9058adbce81a8e6c037cc64
SHA1 4961235fcd4717beaac03ba0117ae1e1e9b52656
SHA512 98c62d87a04a0e18b5422da7dc64b4a15767881e1b7b2f1d8c614371a41368109f798cc3def9641727a7519569df0eae69a3b5c43d419d55da728b896d0b3ddc
SSDEEP 3072:U667Drsp72hcfwoyAl2g5yqTpLgMz/LJTDWs9FL7+X8ofdUScT2ni:47vsZ2hZtAl2g5/LJ/N3Ws9FODx7ni
TLSH
T17A346D29B6280DB9E5E7C978C943C403EB737C4A8335D6E723E559660F275D0AA3FA40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthSystray.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5424	powershell.exe
5424	powershell.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	SecurityHealthSystray.exe

Deletes itself 1 IoCs

pid	Process
3068	SecurityHealthSystray.exe

Executes dropped EXE 1 IoCs

pid	Process
3068	SecurityHealthSystray.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3068	SecurityHealthSystray.exe
3068	SecurityHealthSystray.exe
3068	SecurityHealthSystray.exe
3068	SecurityHealthSystray.exe
5424	powershell.exe
5424	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	5424	powershell.exe
Token: SeIncreaseQuotaPrivilege	5424	powershell.exe
Token: SeSecurityPrivilege	5424	powershell.exe
Token: SeTakeOwnershipPrivilege	5424	powershell.exe
Token: SeLoadDriverPrivilege	5424	powershell.exe
Token: SeSystemProfilePrivilege	5424	powershell.exe
Token: SeSystemtimePrivilege	5424	powershell.exe
Token: SeProfSingleProcessPrivilege	5424	powershell.exe
Token: SeIncBasePriorityPrivilege	5424	powershell.exe
Token: SeCreatePagefilePrivilege	5424	powershell.exe
Token: SeBackupPrivilege	5424	powershell.exe
Token: SeRestorePrivilege	5424	powershell.exe
Token: SeShutdownPrivilege	5424	powershell.exe
Token: SeDebugPrivilege	5424	powershell.exe
Token: SeSystemEnvironmentPrivilege	5424	powershell.exe
Token: SeRemoteShutdownPrivilege	5424	powershell.exe
Token: SeUndockPrivilege	5424	powershell.exe
Token: SeManageVolumePrivilege	5424	powershell.exe
Token: 33	5424	powershell.exe
Token: 34	5424	powershell.exe
Token: 35	5424	powershell.exe
Token: 36	5424	powershell.exe
Token: SeIncreaseQuotaPrivilege	5424	powershell.exe
Token: SeSecurityPrivilege	5424	powershell.exe
Token: SeTakeOwnershipPrivilege	5424	powershell.exe
Token: SeLoadDriverPrivilege	5424	powershell.exe
Token: SeSystemProfilePrivilege	5424	powershell.exe
Token: SeSystemtimePrivilege	5424	powershell.exe
Token: SeProfSingleProcessPrivilege	5424	powershell.exe
Token: SeIncBasePriorityPrivilege	5424	powershell.exe
Token: SeCreatePagefilePrivilege	5424	powershell.exe
Token: SeBackupPrivilege	5424	powershell.exe
Token: SeRestorePrivilege	5424	powershell.exe
Token: SeShutdownPrivilege	5424	powershell.exe
Token: SeDebugPrivilege	5424	powershell.exe
Token: SeSystemEnvironmentPrivilege	5424	powershell.exe
Token: SeRemoteShutdownPrivilege	5424	powershell.exe
Token: SeUndockPrivilege	5424	powershell.exe
Token: SeManageVolumePrivilege	5424	powershell.exe
Token: 33	5424	powershell.exe
Token: 34	5424	powershell.exe
Token: 35	5424	powershell.exe
Token: 36	5424	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3972	ShellHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3068	4500	clodespo0fer.exe	88
PID 3068 wrote to memory of 5424	3068	SecurityHealthSystray.exe	89

C:\Users\Admin\AppData\Local\Temp\clodespo0fer.exe
"C:\Users\Admin\AppData\Local\Temp\clodespo0fer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe" /origin:"C:\Users\Admin\AppData\Local\Temp\clodespo0fer.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VMWare services registry key.
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2484

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F4
1⤵
PID:6032

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe
Size 246KB
SHA256 65074307103c32cf27f0e0ff2f4d171c69e71b287a34e51183e9f65f542ae230
MD5 92db6000e9058adbce81a8e6c037cc64
SHA1 4961235fcd4717beaac03ba0117ae1e1e9b52656
SHA512 98c62d87a04a0e18b5422da7dc64b4a15767881e1b7b2f1d8c614371a41368109f798cc3def9641727a7519569df0eae69a3b5c43d419d55da728b896d0b3ddc
SSDEEP 3072:U667Drsp72hcfwoyAl2g5yqTpLgMz/LJTDWs9FL7+X8ofdUScT2ni:47vsZ2hZtAl2g5/LJ/N3Ws9FODx7ni
TLSH
T17A346D29B6280DB9E5E7C978C943C403EB737C4A8335D6E723E559660F275D0AA3FA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3068-1-0x00007FFD4AB00000-0x00007FFD4AD63000-memory.dmp

Download

memory/5424-2-0x00007FFD27C4F000-0x00007FFD27C50000-memory.dmp

Download

memory/5424-3-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/5424-4-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/5424-8-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/5424-7-0x0000024479770000-0x0000024479792000-memory.dmp

Download

memory/5424-9-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/5424-10-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/5424-13-0x0000024479800000-0x000002447981E000-memory.dmp

Download

memory/5424-14-0x0000024479820000-0x00000244798D2000-memory.dmp

Download

memory/5424-15-0x00000244798E0000-0x00000244798EA000-memory.dmp

Download

memory/5424-16-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/5424-17-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/5424-18-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/5424-21-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/5424-20-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download