CyberLock 9.0

[RoboMan]

In CyberLock, SiriusGPT classifies the file srtasks.exe in the system32 directory as unsafe, even though I have marked it as safe. Microsoft Defender, McAfee, and VirusTotal all consider this file safe. How can I prevent SiriusGPT from repeatedly classifying srtasks.exe as unsafe?

This happens to me too.

 

[Victor M]

srtasks.exe in the system32

Do you have another machine with the same updated Windows? Check the SHA256 of the file against the other machine.

 

[Miraculix]

Do you have another machine with the same updated Windows? Check the SHA256 of the file against the other machine.

Thanks for the tip, but navigating the file system via the command line is beyond me these days. I'll just leave it as it is.

 

[danb]

This is quite interesting actually. SrTasks.exe performs system‑level actions (shadow copies, restore point creation, scheduled execution) that look similar to how malware behaves.

I searched our database and found only one SrTasks.exe false positive, and it was for: e7e56c2607614a58d4fc0fde58fa32a9057e2ec6501808e666faf1d11af62a0e

Since this is a catalog signed file, it appears this hash somehow did not make it into the catalog... please see the Sirius Analysis Report below.

So even though it is a false positive, it is super cool that Sirius caught this . If you read the Sirius Analysis Report below it tells you exactly what happened, which is the super cool part. I can rest better at night knowing that Sirius is able to catch anomalies like this.

You might need to delete the old result in the CyberLock Settings / Whitelist tab for it to show the updated / corrected Sirius result.

File path: c:\users\user\desktop\e7e56c2607614a58d4fc0fde58fa32a9057e2ec6501808e666faf1d11af62a0e.exe.sample\e7e56c2607614a58d4fc0fde58fa32a9057e2ec6501808e666faf1d11af62a0e.exe
File hash: e7e56c2607614a58d4fc0fde58fa32a9057e2ec6501808e666faf1d11af62a0e
File size: 0.11 MB
File publisher: This file is a signable file type but has not been digitally signed.

Final Verdict: Not Safe with 92% confidence.

Analysis Summary
The file presents itself as “Microsoft® Windows System Protection background tasks” (srtasks.exe) and is located in the expected System32 path, yet it is completely unsigned and carries a future PE time-stamp (2074-03-31) – both classic red flags for a dropped or patched binary. While the imported API set is dominated by legitimate Windows event-tracing, registry, and SPP/VSS restore-point functions, the absence of any Microsoft certificate on a core OS component is highly suspicious; no mainstream Windows build ships an unsigned srtasks.exe. Entropy values are within normal ranges and no obviously hostile imports (e.g., process hollowing, injection, or network stubs) are present, but the contextual evidence outweighs these benign technical indicators.

Detailed Analysis
- Metadata & Authenticity: Version info claims Microsoft origin but the file is unsigned; valid Windows executables in System32 are virtually always signed with the Microsoft Windows PCA certificate. The 2074 time-stamp is impossible and indicates intentional tampering or a malicious builder attempting to bypass AV heuristics.
- Imports: 137 functions, almost exclusively ADVAPI32, KERNEL32, VSSAPI, and ETW helpers. Key calls (SRSetRestorePointW, CreateVssBackupComponentsInternal, CoInitializeSecurity, etc.) are consistent with System Restore task automation, but the same APIs can be (and have been) abused by ransomware to create malicious restore points or delete snapshots. No crypto, network, or process-injection primitives are imported, so the immediate impact surface is limited.
- Exports: None – normal for a background task executable.
- Strings: Human-readable symbols match the declared purpose (GetRestorePointsCount, _ExecuteScheduledSPPCreation, srtasks.pdb). No hard-coded IPs, URLs, or suspicious C2 artifacts. The presence of “WilFailureNotify” and ETW helpers is typical for modern Windows telemetry, but again the lack of signature invalidates the trust chain.
- Sections & entropy: Seven sections, entropies 0–6.1, no packed or encrypted payload evident. ASLR/DEP enabled, no TLS or overlay data.

Likely Type / Purpose
The binary is designed to masquerade as the legitimate Windows System Restore task host (srtasks.exe). Its functionality appears focused on manipulating VSS/SPP restore points, a tactic frequently observed in ransomware that wishes to delete shadow copies or create fake restore points to hinder recovery. The absence of a valid digital signature on a purported Microsoft system component is the decisive indicator that this is not a genuine Windows file.

Malware type: Ransomware support tool
Malware name: FakeSRTasks
Final verdict: Malicious with 92% confidence.

 

[Miraculix]

This is quite interesting actually. SrTasks.exe performs system‑level actions (shadow copies, restore point creation, scheduled execution) that look similar to how malware behaves.

I searched our database and found only one SrTasks.exe false positive, and it was for: e7e56c2607614a58d4fc0fde58fa32a9057e2ec6501808e666faf1d11af62a0e

Since this is a catalog signed file, it appears this hash somehow did not make it into the catalog... please see the Sirius Analysis Report below.

So even though it is a false positive, it is super cool that Sirius caught this . If you read the Sirius Analysis Report below it tells you exactly what happened, which is the super cool part. I can rest better at night knowing that Sirius is able to catch anomalies like this.

You might need to delete the old result in the CyberLock Settings / Whitelist tab for it to show the updated / corrected Sirius result.

File path: c:\users\user\desktop\e7e56c2607614a58d4fc0fde58fa32a9057e2ec6501808e666faf1d11af62a0e.exe.sample\e7e56c2607614a58d4fc0fde58fa32a9057e2ec6501808e666faf1d11af62a0e.exe
File hash: e7e56c2607614a58d4fc0fde58fa32a9057e2ec6501808e666faf1d11af62a0e
File size: 0.11 MB
File publisher: This file is a signable file type but has not been digitally signed.

Final Verdict: Not Safe with 92% confidence.

Analysis Summary
The file presents itself as “Microsoft® Windows System Protection background tasks” (srtasks.exe) and is located in the expected System32 path, yet it is completely unsigned and carries a future PE time-stamp (2074-03-31) – both classic red flags for a dropped or patched binary. While the imported API set is dominated by legitimate Windows event-tracing, registry, and SPP/VSS restore-point functions, the absence of any Microsoft certificate on a core OS component is highly suspicious; no mainstream Windows build ships an unsigned srtasks.exe. Entropy values are within normal ranges and no obviously hostile imports (e.g., process hollowing, injection, or network stubs) are present, but the contextual evidence outweighs these benign technical indicators.

Detailed Analysis
- Metadata & Authenticity: Version info claims Microsoft origin but the file is unsigned; valid Windows executables in System32 are virtually always signed with the Microsoft Windows PCA certificate. The 2074 time-stamp is impossible and indicates intentional tampering or a malicious builder attempting to bypass AV heuristics.
- Imports: 137 functions, almost exclusively ADVAPI32, KERNEL32, VSSAPI, and ETW helpers. Key calls (SRSetRestorePointW, CreateVssBackupComponentsInternal, CoInitializeSecurity, etc.) are consistent with System Restore task automation, but the same APIs can be (and have been) abused by ransomware to create malicious restore points or delete snapshots. No crypto, network, or process-injection primitives are imported, so the immediate impact surface is limited.
- Exports: None – normal for a background task executable.
- Strings: Human-readable symbols match the declared purpose (GetRestorePointsCount, _ExecuteScheduledSPPCreation, srtasks.pdb). No hard-coded IPs, URLs, or suspicious C2 artifacts. The presence of “WilFailureNotify” and ETW helpers is typical for modern Windows telemetry, but again the lack of signature invalidates the trust chain.
- Sections & entropy: Seven sections, entropies 0–6.1, no packed or encrypted payload evident. ASLR/DEP enabled, no TLS or overlay data.

Likely Type / Purpose
The binary is designed to masquerade as the legitimate Windows System Restore task host (srtasks.exe). Its functionality appears focused on manipulating VSS/SPP restore points, a tactic frequently observed in ransomware that wishes to delete shadow copies or create fake restore points to hinder recovery. The absence of a valid digital signature on a purported Microsoft system component is the decisive indicator that this is not a genuine Windows file.

Malware type: Ransomware support tool
Malware name: FakeSRTasks
Final verdict: Malicious with 92% confidence.

Thanks for the explanations. srtasks.exe is now classified as safe by SiriusGPT.