clp8.exe

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 27, 2023, 10:22 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW July 27, 2023, 10:22 a.m.	buffer: SUCCESS: The scheduled task "DotNetStartup" has successfully been created. console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 27, 2023, 10:22 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

^%#EUTYR

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 27, 2023, 10:22 a.m.	process_identifier: 2584 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bb0000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\DotNetSecurity\DotNetServer.exe

Creates a suspicious process (3 events)

cmdline	 /c powershell Add-MpPreference -ExclusionPath "C:\ProgramData\DotNetSecurity"
cmdline	schtasks.exe /CREATE /TN "DotNetStartup" /TR "C:\ProgramData\DotNetSecurity\DotNetServer.exe" /SC MINUTE /RL HIGHEST
cmdline	"C:\Windows\System32\schtasks.exe" /CREATE /TN "DotNetStartup" /TR "C:\ProgramData\DotNetSecurity\DotNetServer.exe" /SC MINUTE /RL HIGHEST

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 27, 2023, 10:22 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /CREATE /TN "DotNetStartup" /TR "C:\ProgramData\DotNetSecurity\DotNetServer.exe" /SC MINUTE /RL HIGHEST filepath: schtasks.exe	1	1	0
ShellExecuteExW July 27, 2023, 10:22 a.m.	show_type: 0 filepath_r:  parameters: /c powershell Add-MpPreference -ExclusionPath "C:\ProgramData\DotNetSecurity" filepath: 		0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x0032ee00', u'virtual_address': u'0x0022a000', u'entropy': 7.977701208783349, u'name': u'^%#EUTYR', u'virtual_size': u'0x0032ec20'}				entropy	7.97770120878				description	A section with a high entropy has been found
entropy	0.999233599019				description	Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks.exe /CREATE /TN "DotNetStartup" /TR "C:\ProgramData\DotNetSecurity\DotNetServer.exe" /SC MINUTE /RL HIGHEST
cmdline	"C:\Windows\System32\schtasks.exe" /CREATE /TN "DotNetStartup" /TR "C:\ProgramData\DotNetSecurity\DotNetServer.exe" /SC MINUTE /RL HIGHEST

Installs itself for autorun at Windows startup (2 events)

cmdline	schtasks.exe /CREATE /TN "DotNetStartup" /TR "C:\ProgramData\DotNetSecurity\DotNetServer.exe" /SC MINUTE /RL HIGHEST
cmdline	"C:\Windows\System32\schtasks.exe" /CREATE /TN "DotNetStartup" /TR "C:\ProgramData\DotNetSecurity\DotNetServer.exe" /SC MINUTE /RL HIGHEST

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Trojan.Heur.GM.0800520180
FireEye	Generic.mg.1c88f016b6d72ca7
McAfee	Artemis!1C88F016B6D7
Malwarebytes	Malware.AI.1899995452
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Heur.GM.D2FB6F7F4
BitDefenderTheta	AI:Packer.B51EA2641D
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.VMProtect.BC suspicious
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Tasker.aznb
BitDefender	Gen:Trojan.Heur.GM.0800520180
Avast	Win32:MalwareX-gen [Trj]
Emsisoft	Gen:Trojan.Heur.GM.0800520180 (B)
F-Secure	Trojan.TR/Tasker.mcfky
DrWeb	Trojan.PWS.Steam.36332
VIPRE	Gen:Trojan.Heur.GM.0800520180
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
Trapmine	malicious.high.ml.score
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious PE
Avira	TR/Tasker.mcfky
MAX	malware (ai score=84)
Gridinsoft	Trojan.Heur!.022120A1
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	Trojan.Win32.Tasker.aznb
GData	Gen:Trojan.Heur.GM.0800520180
ALYac	Gen:Trojan.Heur.GM.0800520180
VBA32	BScope.TrojanSpy.LClipper
Rising	Trojan.Generic@AI.100 (RDML:XtzoPoWZu06rlT+ZRNcs9A)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/Application
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS