Analysis
- user interaction
yes - max time kernel
153s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 18:43
Behavioral task
behavioral1
Sample
CLOSOA_2025.2.236_iND.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
CLO_Standalone_OnlineAuth_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target CLO_Standalone_OnlineAuth_x64.exe
- Size 169.5MB
- Sample260811-xdck5swthy
- SHA256 a2a304300eff0349d031ad8238a3c299b1e83a92f6139bac91be3e67000d201d
- MD5 0ea7cb3399821baa7e158fe0690b223e
- SHA1 bc0273dcb0b3a21dee48a0d1caf48a5b7d16dc2f
- SHA512 d58f6e420009bb3bd3a80f65f57d05134e31e68225c740767dae2b9857ba078714311dea052ea089c56402702a69b0147224f7b8f47dc6dbbf8380d4aff28f51
- SSDEEP 786432:jA5ux/mroWJQ1g2umRetXQlh73WCJUhoC5Yqgv/HiRAMiijUAjU/:jACzWxl8KqV3W+UhoCO
- TLSH T1CE885B5631E5069EF177E1BACF874D03CAB2344A03258EF306D4C69B2E67EE89579E10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3552 taskmgr.exe Token: SeSystemProfilePrivilege 3552 taskmgr.exe Token: SeCreateGlobalPrivilege 3552 taskmgr.exe - Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe - Suspicious use of SendNotifyMessage 27 IoCs
pid Process 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe 3552 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3552 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CLO_Standalone_OnlineAuth_x64.exe"C:\Users\Admin\AppData\Local\Temp\CLO_Standalone_OnlineAuth_x64.exe"1⤵PID:4272
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\CLOSOA_2025.2.236_iND.exe"C:\Users\Admin\AppData\Local\Temp\CLOSOA_2025.2.236_iND.exe"1⤵PID:5396
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3756