Analysis
- max time kernel
40s - max time network
43s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
03/10/2026, 12:45
General
- Target $PLUGINSDIR/payload/Install-CLIPVIDE.ps1
- Size 12KB
- Sample261003-py5teszyat
- SHA256 a86ab232fbba466ccb74d36832f6e6999d23c3516c570994eac8cad3220dffb0
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\payload\Install-CLIPVIDE.ps11⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y41t1k5q\y41t1k5q.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF4BB.tmp" "c:\Users\Admin\AppData\Local\Temp\y41t1k5q\CSCCB01260DA18248B58D277A97143DF757.TMP"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLIPVIDE-Setup-c91e33a6-e6e0-4e68-83c6-5b62587c6564\node\node-v24.21.0-win-x64\node.exe"C:\Users\Admin\AppData\Local\Temp\CLIPVIDE-Setup-c91e33a6-e6e0-4e68-83c6-5b62587c6564\node\node-v24.21.0-win-x64\node.exe" --version2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541.zip
LICENSE
LICENSE
LICENSE
witness.js
package.json
package.json
LICENSE
LICENSE
LICENSE.md
LICENSE
RESF4BB.tmp
__PSScriptPolicyTest_40naa3ib.0f5.ps1
y41t1k5q.dll
CSCCB01260DA18248B58D277A97143DF757.TMP
y41t1k5q.0.cs
y41t1k5q.cmdline
memory/1780-25-0x000001CFC42D0000-0x000001CFC42E0000-memory.dmp
memory/1780-594-0x000001CFC42D0000-0x000001CFC42E0000-memory.dmp
memory/1780-131-0x000001CFC65B0000-0x000001CFC66FE000-memory.dmp
memory/1780-24-0x000001CFC42D0000-0x000001CFC42E0000-memory.dmp
memory/1780-23-0x000001CFC6B60000-0x000001CFC6B68000-memory.dmp
memory/1780-1-0x000001CFC42D0000-0x000001CFC42E0000-memory.dmp
memory/1780-593-0x000001CFC42D0000-0x000001CFC42E0000-memory.dmp
memory/1780-32-0x000001CFC7800000-0x000001CFC7812000-memory.dmp
memory/1780-10-0x000001CFC6B70000-0x000001CFC6B7A000-memory.dmp
memory/1780-9-0x000001CFC6580000-0x000001CFC65A2000-memory.dmp
memory/1780-1337-0x000001CFC42D0000-0x000001CFC42E0000-memory.dmp
memory/1780-0-0x000001CFC42D0000-0x000001CFC42E0000-memory.dmp
memory/1780-2032-0x000001CFC42D0000-0x000001CFC42E0000-memory.dmp
memory/1780-2033-0x000001CFC65B0000-0x000001CFC66FE000-memory.dmp