Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\clipboardhelperautostart
Modifies file system
Creates the following files
- %TEMP%\_mei45482\vcruntime140.dll
- %TEMP%\_mei45482\_bz2.pyd
- %TEMP%\_mei45482\_cffi_backend.cp39-win32.pyd
- %TEMP%\_mei45482\_ctypes.pyd
- %TEMP%\_mei45482\_decimal.pyd
- %TEMP%\_mei45482\_hashlib.pyd
- %TEMP%\_mei45482\_lzma.pyd
- %TEMP%\_mei45482\_queue.pyd
- %TEMP%\_mei45482\_socket.pyd
- %TEMP%\_mei45482\_ssl.pyd
- %TEMP%\_mei45482\charset_normalizer\md.cp39-win32.pyd
- %TEMP%\_mei45482\charset_normalizer\md__mypyc.cp39-win32.pyd
- %TEMP%\_mei45482\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei45482\libcrypto-1_1.dll
- %TEMP%\_mei45482\libffi-7.dll
- %TEMP%\_mei45482\libssl-1_1.dll
- %TEMP%\_mei45482\python3.dll
- %TEMP%\_mei45482\python39.dll
- %TEMP%\_mei45482\select.pyd
- %TEMP%\_mei45482\unicodedata.pyd
- %TEMP%\_mei45482\base_library.zip
- %TEMP%\_mei45482\certifi\cacert.pem
- %TEMP%\_mei45482\cryptography-43.0.3.dist-info\installer
- %TEMP%\_mei45482\cryptography-43.0.3.dist-info\metadata
- %TEMP%\_mei45482\cryptography-43.0.3.dist-info\record
- %TEMP%\_mei45482\cryptography-43.0.3.dist-info\wheel
- %TEMP%\_mei45482\cryptography-43.0.3.dist-info\license_files\license
- %TEMP%\_mei45482\cryptography-43.0.3.dist-info\license_files\license.apache
- %TEMP%\_mei45482\cryptography-43.0.3.dist-info\license_files\license.bsd
- %TEMP%\_mei45482\pyperclip-1.9.0-py3.9.egg-info\pkg-info
- %TEMP%\_mei45482\pyperclip-1.9.0-py3.9.egg-info\sources.txt
- %TEMP%\_mei45482\pyperclip-1.9.0-py3.9.egg-info\dependency_links.txt
- %TEMP%\_mei45482\pyperclip-1.9.0-py3.9.egg-info\installed-files.txt
- %TEMP%\_mei45482\pyperclip-1.9.0-py3.9.egg-info\top_level.txt
- %TEMP%\_mei45482\pyperclip\__init__.py
- %TEMP%\_mei45482\pyperclip\__main__.py
- %TEMP%\_mei45482\pyperclip\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei45482\pyperclip\__pycache__\__main__.cpython-39.pyc
- %TEMP%\_mei45482\requests-2.32.5.dist-info\installer
- %TEMP%\_mei45482\requests-2.32.5.dist-info\metadata
- %TEMP%\_mei45482\requests-2.32.5.dist-info\record
- %TEMP%\_mei45482\requests-2.32.5.dist-info\wheel
- %TEMP%\_mei45482\requests-2.32.5.dist-info\licenses\license
- %TEMP%\_mei45482\requests-2.32.5.dist-info\top_level.txt
- %TEMP%\_mei45482\requests\__init__.py
- %TEMP%\_mei45482\requests\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\__version__.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\_internal_utils.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\adapters.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\api.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\auth.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\certs.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\compat.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\cookies.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\exceptions.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\help.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\hooks.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\models.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\packages.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\sessions.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\status_codes.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\structures.cpython-39.pyc
- %TEMP%\_mei45482\requests\__pycache__\utils.cpython-39.pyc
- %TEMP%\_mei45482\requests\__version__.py
- %TEMP%\_mei45482\requests\_internal_utils.py
- %TEMP%\_mei45482\requests\adapters.py
- %TEMP%\_mei45482\requests\api.py
- %TEMP%\_mei45482\requests\auth.py
- %TEMP%\_mei45482\requests\certs.py
- %TEMP%\_mei45482\requests\compat.py
- %TEMP%\_mei45482\requests\cookies.py
- %TEMP%\_mei45482\requests\exceptions.py
- %TEMP%\_mei45482\requests\help.py
- %TEMP%\_mei45482\requests\hooks.py
- %TEMP%\_mei45482\requests\models.py
- %TEMP%\_mei45482\requests\packages.py
- %TEMP%\_mei45482\requests\sessions.py
- %TEMP%\_mei45482\requests\status_codes.py
- %TEMP%\_mei45482\requests\structures.py
- %TEMP%\_mei45482\requests\utils.py
- %APPDATA%\clipboardhelper\clipboardhelper_autostart.exe
- %TEMP%\_mei30202\vcruntime140.dll
- %TEMP%\_mei30202\_bz2.pyd
- %TEMP%\_mei30202\_cffi_backend.cp39-win32.pyd
- %TEMP%\_mei30202\_ctypes.pyd
- %TEMP%\_mei30202\_decimal.pyd
- %TEMP%\_mei30202\_hashlib.pyd
- %TEMP%\_mei30202\_lzma.pyd
- %TEMP%\_mei30202\_queue.pyd
- %TEMP%\_mei30202\_socket.pyd
- %TEMP%\_mei30202\_ssl.pyd
- %TEMP%\_mei30202\charset_normalizer\md.cp39-win32.pyd
- %TEMP%\_mei30202\charset_normalizer\md__mypyc.cp39-win32.pyd
- %TEMP%\_mei30202\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei30202\libcrypto-1_1.dll
- %TEMP%\_mei30202\libffi-7.dll
- %TEMP%\_mei30202\libssl-1_1.dll
- %TEMP%\_mei30202\python3.dll
- %TEMP%\_mei30202\python39.dll
- %TEMP%\_mei30202\select.pyd
- %TEMP%\_mei30202\unicodedata.pyd
- %TEMP%\_mei30202\base_library.zip
- %TEMP%\_mei30202\certifi\cacert.pem
- %TEMP%\_mei30202\cryptography-43.0.3.dist-info\installer
- %TEMP%\_mei30202\cryptography-43.0.3.dist-info\metadata
- %TEMP%\_mei30202\cryptography-43.0.3.dist-info\record
- %TEMP%\_mei30202\cryptography-43.0.3.dist-info\wheel
- %TEMP%\_mei30202\cryptography-43.0.3.dist-info\license_files\license
- %TEMP%\_mei30202\cryptography-43.0.3.dist-info\license_files\license.apache
- %TEMP%\_mei30202\cryptography-43.0.3.dist-info\license_files\license.bsd
- %TEMP%\_mei30202\pyperclip-1.9.0-py3.9.egg-info\pkg-info
- %TEMP%\_mei30202\pyperclip-1.9.0-py3.9.egg-info\sources.txt
- %TEMP%\_mei30202\pyperclip-1.9.0-py3.9.egg-info\dependency_links.txt
- %TEMP%\_mei30202\pyperclip-1.9.0-py3.9.egg-info\installed-files.txt
- %TEMP%\_mei30202\pyperclip-1.9.0-py3.9.egg-info\top_level.txt
- %TEMP%\_mei30202\pyperclip\__init__.py
- %TEMP%\_mei30202\pyperclip\__main__.py
- %TEMP%\_mei30202\pyperclip\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei30202\pyperclip\__pycache__\__main__.cpython-39.pyc
- %TEMP%\_mei30202\requests-2.32.5.dist-info\installer
- %TEMP%\_mei30202\requests-2.32.5.dist-info\metadata
- %TEMP%\_mei30202\requests-2.32.5.dist-info\record
- %TEMP%\_mei30202\requests-2.32.5.dist-info\wheel
- %TEMP%\_mei30202\requests-2.32.5.dist-info\licenses\license
- %TEMP%\_mei30202\requests-2.32.5.dist-info\top_level.txt
- %TEMP%\_mei30202\requests\__init__.py
- %TEMP%\_mei30202\requests\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\__version__.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\_internal_utils.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\adapters.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\api.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\auth.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\certs.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\compat.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\cookies.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\exceptions.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\help.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\hooks.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\models.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\packages.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\sessions.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\status_codes.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\structures.cpython-39.pyc
- %TEMP%\_mei30202\requests\__pycache__\utils.cpython-39.pyc
- %TEMP%\_mei30202\requests\__version__.py
- %TEMP%\_mei30202\requests\_internal_utils.py
- %TEMP%\_mei30202\requests\adapters.py
- %TEMP%\_mei30202\requests\api.py
- %TEMP%\_mei30202\requests\auth.py
- %TEMP%\_mei30202\requests\certs.py
- %TEMP%\_mei30202\requests\compat.py
- %TEMP%\_mei30202\requests\cookies.py
- %TEMP%\_mei30202\requests\exceptions.py
- %TEMP%\_mei30202\requests\help.py
- %TEMP%\_mei30202\requests\hooks.py
- %TEMP%\_mei30202\requests\models.py
- %TEMP%\_mei30202\requests\packages.py
- %TEMP%\_mei30202\requests\sessions.py
- %TEMP%\_mei30202\requests\status_codes.py
- %TEMP%\_mei30202\requests\structures.py
- %TEMP%\_mei30202\requests\utils.py
Network activity
Connects to
- 'pa###bin.com':443
TCP
Other
- 'pa###bin.com':443
UDP
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\clipboardhelper\clipboardhelper_autostart.exe'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn ClipboardHelperAutoStart /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn ClipboardHelperAutoStart /tr \"%APPDATA%\ClipboardHelper\ClipboardHelper_AUTOSTART.exe\" /sc onlogon /rl highest /f
