sality | b6f36f8da8dfb0102f342abe6f1e17b00a90a2d3e91adadeacf0e2f23341b012

Modify Existing Service

T1031

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

Modifies system executable filetype association 2 TTPs 7 IoCs

persistence

Modify Registry

Change Default File Association

T1042

Processes:

OneDriveSetup.exeOneDrive.exeOneDrive.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

svchost.exe

description pid process target process

PID 2872 created 1788 2872 svchost.exe OneDriveSetup.exe
PID 2872 created 1744 2872 svchost.exe OneDriveSetup.exe

description	pid	process	target process
PID 2872 created 1788	2872	svchost.exe	OneDriveSetup.exe
PID 2872 created 1744	2872	svchost.exe	OneDriveSetup.exe

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

Executes dropped EXE 4 IoCs

Processes:

OneDriveSetup.exeOneDriveSetup.exeFileSyncConfig.exeOneDrive.exe

pid process

1788 OneDriveSetup.exe
1744 OneDriveSetup.exe
4020 FileSyncConfig.exe
4424 OneDrive.exe

pid	process
1788	OneDriveSetup.exe
1744	OneDriveSetup.exe
4020	FileSyncConfig.exe
4424	OneDrive.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

OneDriveSetup.exeOneDrive.exeOneDrive.exeFileSyncConfig.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\Microsoft.SharePoint.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_CLASSES\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\INPROCSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileCoAuthLib64.dll"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\Microsoft.SharePoint.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /cci /client=Personal"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDrive.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3484-131-0x0000000002330000-0x00000000033EA000-memory.dmp	upx
behavioral2/memory/3484-132-0x0000000002330000-0x00000000033EA000-memory.dmp	upx
behavioral2/memory/3484-134-0x0000000002330000-0x00000000033EA000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

OneDriveSetup.exeOneDrive.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	OneDriveSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	OneDrive.exe

Loads dropped DLL 37 IoCs

Processes:

FileSyncConfig.exeOneDrive.exe

pid	process
4020	FileSyncConfig.exe
4020	FileSyncConfig.exe
4020	FileSyncConfig.exe
4020	FileSyncConfig.exe
4020	FileSyncConfig.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe

Windows security modification 2 TTPs 7 IoCs

Disabling Security Tools

Modify Registry

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

OneDriveSetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

description	ioc	process
File opened (read-only)	\??\E:	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
File opened (read-only)	\??\F:	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

Drops file in Windows directory 2 IoCs

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
File created	C:\Windows\e565d28	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

OneDrive.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OneDrive.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

Processes:

OneDrive.exeOneDriveSetup.exeOneDrive.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\IESettingSync	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	OneDrive.exe

Modifies registry class 64 IoCs

Processes:

OneDrive.exeOneDriveSetup.exeOneDrive.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\ = "ICreateLibraryCallback"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\ = "ToastActivator Class"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\OOBERequestHandler.OOBERequestHandler\CLSID	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\ProgID\ = "StorageProviderUriSource.StorageProviderUriSource.1"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\BannerNotificationHandler.BannerNotificationHandler\CurVer\ = "BannerNotificationHandler.AutoBannerNotificationHandlerPlayHandler.1"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ = "IGetSpaceUsedCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\VersionIndependentProgID\ = "StorageProviderUriSource.StorageProviderUriSource"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0\FLAGS\ = "0"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ = "IToastNotificationEvent"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024}	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\ProgID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\ProgID\ = "SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy.1"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\FileSyncClient.AutoPlayHandler\shell\import\DropTarget	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\.fluid\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\OneDriveFileLauncher.exe\" \"%1\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{0f872661-c863-47a4-863f-c065c182858a}\ = "IFileSyncClient4"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\odopen\shell	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ThreadingModel = "Both"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\TypeLib\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\TypeLib\Version = "1.0"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_CLASSES\INTERFACE\{50487D09-FFA9-45E1-8DF5-D457F646CD83}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{50487D09-FFA9-45E1-8DF5-D457F646CD83}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\ = "StorageProviderUriSource Class"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\ = "ErrorOverlayHandler2 Class"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\ = "ReadOnlyOverlayHandler Class"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\VersionIndependentProgID	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\ = "IMapLibraryCallback"	OneDrive.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

OneDrive.exeOneDrive.exe

pid process

704 OneDrive.exe
4424 OneDrive.exe

pid	process
704	OneDrive.exe
4424	OneDrive.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exeOneDrive.exeOneDriveSetup.exeOneDriveSetup.exeOneDrive.exe

pid	process
3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
704	OneDrive.exe
704	OneDrive.exe
1788	OneDriveSetup.exe
1788	OneDriveSetup.exe
1788	OneDriveSetup.exe
1788	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
1744	OneDriveSetup.exe
4424	OneDrive.exe
4424	OneDrive.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

description	pid	process
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
Token: SeDebugPrivilege	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

OneDrive.exeOneDrive.exe

pid process

704 OneDrive.exe
704 OneDrive.exe
704 OneDrive.exe
704 OneDrive.exe
4424 OneDrive.exe
4424 OneDrive.exe
4424 OneDrive.exe
4424 OneDrive.exe
Suspicious use of SendNotifyMessage 8 IoCs

Processes:

OneDrive.exeOneDrive.exe

pid process

704 OneDrive.exe
704 OneDrive.exe
704 OneDrive.exe
704 OneDrive.exe
4424 OneDrive.exe
4424 OneDrive.exe
4424 OneDrive.exe
4424 OneDrive.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

OneDrive.exeOneDrive.exe

pid process

704 OneDrive.exe
4424 OneDrive.exe
4424 OneDrive.exe
4424 OneDrive.exe

pid	process
704	OneDrive.exe
704	OneDrive.exe
704	OneDrive.exe
704	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe

pid	process
704	OneDrive.exe
704	OneDrive.exe
704	OneDrive.exe
704	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe

pid	process
704	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe
4424	OneDrive.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exeOneDrive.exesvchost.exeOneDriveSetup.exe

description	pid	process	target process
PID 3484 wrote to memory of 804	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	fontdrvhost.exe
PID 3484 wrote to memory of 812	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	fontdrvhost.exe
PID 3484 wrote to memory of 1020	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	dwm.exe
PID 3484 wrote to memory of 2780	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	sihost.exe
PID 3484 wrote to memory of 2832	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	svchost.exe
PID 3484 wrote to memory of 2892	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	taskhostw.exe
PID 3484 wrote to memory of 892	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	Explorer.EXE
PID 3484 wrote to memory of 684	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	svchost.exe
PID 3484 wrote to memory of 3264	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	DllHost.exe
PID 3484 wrote to memory of 3352	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	StartMenuExperienceHost.exe
PID 3484 wrote to memory of 3412	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	RuntimeBroker.exe
PID 3484 wrote to memory of 3500	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	SearchApp.exe
PID 3484 wrote to memory of 3648	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	RuntimeBroker.exe
PID 3484 wrote to memory of 2140	3484	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe	RuntimeBroker.exe
PID 704 wrote to memory of 1788	704	OneDrive.exe	OneDriveSetup.exe
PID 704 wrote to memory of 1788	704	OneDrive.exe	OneDriveSetup.exe
PID 704 wrote to memory of 1788	704	OneDrive.exe	OneDriveSetup.exe
PID 2872 wrote to memory of 1744	2872	svchost.exe	OneDriveSetup.exe
PID 2872 wrote to memory of 1744	2872	svchost.exe	OneDriveSetup.exe
PID 2872 wrote to memory of 1744	2872	svchost.exe	OneDriveSetup.exe
PID 1744 wrote to memory of 4020	1744	OneDriveSetup.exe	FileSyncConfig.exe
PID 1744 wrote to memory of 4020	1744	OneDriveSetup.exe	FileSyncConfig.exe
PID 1744 wrote to memory of 4020	1744	OneDriveSetup.exe	FileSyncConfig.exe
PID 2872 wrote to memory of 4424	2872	svchost.exe	OneDrive.exe
PID 2872 wrote to memory of 4424	2872	svchost.exe	OneDrive.exe
PID 2872 wrote to memory of 4424	2872	svchost.exe	OneDrive.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:804

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:812

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2832

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2892

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:892

C:\Users\Admin\AppData\Local\Temp\c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe
"C:\Users\Admin\AppData\Local\Temp\c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3484

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
2⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1788

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
4⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Checks computer location settings
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
PID:4020

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
/updateInstalled /background
5⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Checks computer location settings
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4424

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3264

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:684

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3412

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3500

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3648

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:2872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery