Challenge 03: Copy and Rename

Easy Process Name Evasion Target: Rule 1

Objective

Execute a blacklisted tool by copying it to a completely different name.

Scanner Behavior

The EDR only checks the process executable name reported by CreateToolhelp32Snapshot. It does not verify file hashes, digital signatures, or file contents.

Rules

Copy any blacklisted tool to a new, non-blacklisted name
Execute the copy successfully without detection
The copy must be functionally identical to the original

Hints

Hint 1

Windows runs executables by their filename, not by their content.

Hint 2

copy notepad.exe editor.exe && editor.exe - is editor.exe in the blacklist?

Hint 3

The EDR has no hash database (Rule 6 is empty). It cannot identify a binary by its content.