Analysis
- max time kernel
38s - max time network
44s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 12:45
General
- Target $PLUGINSDIR/payload/Install-CLIPVIDE.ps1
- Size 12KB
- Sample261003-py5teszyat
- SHA256 a86ab232fbba466ccb74d36832f6e6999d23c3516c570994eac8cad3220dffb0
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\payload\Install-CLIPVIDE.ps11⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ig0ifwte\ig0ifwte.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES89A8.tmp" "c:\Users\Admin\AppData\Local\Temp\ig0ifwte\CSC131AB29CB2504D1F8877457F90C9CBD3.TMP"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLIPVIDE-Setup-c65e4538-dea5-44cf-b123-dc4590308d52\node\node-v24.21.0-win-x64\node.exe"C:\Users\Admin\AppData\Local\Temp\CLIPVIDE-Setup-c65e4538-dea5-44cf-b123-dc4590308d52\node\node-v24.21.0-win-x64\node.exe" --version2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541.zip
LICENSE
LICENSE
LICENSE
witness.js
package.json
package.json
LICENSE
LICENSE
LICENSE.md
LICENSE
RES89A8.tmp
ig0ifwte.dll
CSC131AB29CB2504D1F8877457F90C9CBD3.TMP
ig0ifwte.0.cs
ig0ifwte.cmdline
memory/796-44-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-191-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-21-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-29-0x000001B8F7B50000-0x000001B8F7B58000-memory.dmp
memory/796-19-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-30-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-13-0x000001B8F8020000-0x000001B8F802A000-memory.dmp
memory/796-37-0x000001B8FAEE0000-0x000001B8FAEF2000-memory.dmp
memory/796-0-0x00007FFB361EF000-0x00007FFB361F0000-memory.dmp
memory/796-45-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-46-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-71-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-104-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-130-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-152-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-165-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-178-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-20-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-204-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-206-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-207-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-205-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-235-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-651-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-12-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-11-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-10-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-9-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-8-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-7-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-6-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-5-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-4-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/796-3-0x000001B8F7B60000-0x000001B8F7B82000-memory.dmp