Analysis
- max time kernel
40s - max time network
43s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
03/10/2026, 12:45
General
- Target 568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134.exe
- Size 22.0MB
- Sample261003-py5teszyat
- SHA256 568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134.exe"C:\Users\Admin\AppData\Local\Temp\568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -STA -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\nsqEAEA.tmp\payload\Install-CLIPVIDE.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a3crovaf\a3crovaf.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES239B.tmp" "c:\Users\Admin\AppData\Local\Temp\a3crovaf\CSC149AD4834DA4D94A4EA72E64644197D.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLIPVIDE-Setup-7eda68d2-8cfa-4c22-aaa4-b29732f41641\node\node-v24.21.0-win-x64\node.exe"C:\Users\Admin\AppData\Local\Temp\CLIPVIDE-Setup-7eda68d2-8cfa-4c22-aaa4-b29732f41641\node\node-v24.21.0-win-x64\node.exe" --version3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541.zip
LICENSE
LICENSE
LICENSE
witness.js
package.json
package.json
LICENSE
LICENSE
LICENSE.md
LICENSE
RES239B.tmp
__PSScriptPolicyTest_jyks5uoz.nsf.ps1
a3crovaf.dll
System.dll
nsDialogs.dll
Install-CLIPVIDE.ps1
CSC149AD4834DA4D94A4EA72E64644197D.TMP
a3crovaf.0.cs
a3crovaf.cmdline
memory/2508-153-0x0000000000400000-0x000000000045C000-memory.dmp
memory/2508-218-0x0000000000400000-0x000000000045C000-memory.dmp
memory/2508-10-0x0000000074469000-0x000000007446A000-memory.dmp
memory/2508-155-0x0000000074460000-0x000000007446F000-memory.dmp
memory/2508-154-0x0000000074510000-0x000000007451C000-memory.dmp
memory/2808-179-0x0000000005D40000-0x0000000005DA6000-memory.dmp
memory/2808-196-0x0000000007760000-0x000000000776A000-memory.dmp
memory/2808-195-0x00000000077D0000-0x0000000007862000-memory.dmp
memory/2808-209-0x0000000005140000-0x0000000005148000-memory.dmp
memory/2808-210-0x0000000007960000-0x000000000796A000-memory.dmp
memory/2808-211-0x0000000002B20000-0x0000000002B30000-memory.dmp
memory/2808-212-0x0000000002B20000-0x0000000002B30000-memory.dmp
memory/2808-213-0x00000000093D0000-0x0000000009466000-memory.dmp
memory/2808-214-0x0000000009360000-0x0000000009382000-memory.dmp
memory/2808-194-0x00000000086A0000-0x0000000008C44000-memory.dmp
memory/2808-193-0x0000000006980000-0x000000000699A000-memory.dmp
memory/2808-224-0x000000000A490000-0x000000000A4A2000-memory.dmp
memory/2808-839-0x0000000002B20000-0x0000000002B30000-memory.dmp
memory/2808-192-0x0000000007A70000-0x00000000080EA000-memory.dmp
memory/2808-190-0x0000000006440000-0x000000000648C000-memory.dmp
memory/2808-189-0x0000000006420000-0x000000000643E000-memory.dmp
memory/2808-186-0x0000000005E20000-0x0000000006174000-memory.dmp
memory/2808-180-0x0000000005DB0000-0x0000000005E16000-memory.dmp
memory/2808-178-0x0000000005460000-0x0000000005482000-memory.dmp
memory/2808-1166-0x0000000002B20000-0x0000000002B30000-memory.dmp
memory/2808-177-0x00000000056A0000-0x0000000005CC8000-memory.dmp
memory/2808-176-0x0000000002B20000-0x0000000002B30000-memory.dmp
memory/2808-175-0x0000000002EA0000-0x0000000002ED6000-memory.dmp
memory/2808-1524-0x0000000002B20000-0x0000000002B30000-memory.dmp
memory/2808-174-0x0000000002B20000-0x0000000002B30000-memory.dmp