Overview

overview

10

Static

static

OneDriveSetup.exe

windows7_x64

1

OneDriveSetup.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OneDriveSetup.exe

  • Size

    37.6MB

  • Sample

    210721-sl1qxeza9s

  • MD5

    16143a6b432ca69e69e8764bca56ed3f

  • SHA1

    e9c7a9a2f2901e3a39077d7eefdb4ade17a6dc27

  • SHA256

    12266562456721eee56d850057587c00f058699db1c5a36cf7bf4a7d287bb51b

  • SHA512

    4dd0b60404a7ca14947dc523c60edb6f6a21fcea9e63524e733eba31585e00ee1ade9c9f8d29fefa6d56a869a1c00a4a228f6cdf915ba76dbfda096f5849c160

Score
10/10
discoverypersistence

Malware Config

Targets

    • Target

      OneDriveSetup.exe

    • Size

      37.6MB

    • MD5

      16143a6b432ca69e69e8764bca56ed3f

    • SHA1

      e9c7a9a2f2901e3a39077d7eefdb4ade17a6dc27

    • SHA256

      12266562456721eee56d850057587c00f058699db1c5a36cf7bf4a7d287bb51b

    • SHA512

      4dd0b60404a7ca14947dc523c60edb6f6a21fcea9e63524e733eba31585e00ee1ade9c9f8d29fefa6d56a869a1c00a4a228f6cdf915ba76dbfda096f5849c160

    Score
    10/10
    discoverypersistence

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks