Overview
overview
10Static
static
10OneLaunch.zip
windows7-x64
1OneLaunch.zip
windows10-2004-x64
1OneLaunch\...me.dll
windows7-x64
3OneLaunch\...me.dll
windows10-2004-x64
3OneLaunch\...lf.dll
windows7-x64
1OneLaunch\...lf.dll
windows10-2004-x64
1OneLaunch\...um.exe
windows7-x64
OneLaunch\...um.exe
windows10-2004-x64
OneLaunch\...47.dll
windows7-x64
3OneLaunch\...47.dll
windows10-2004-x64
3OneLaunch\...es.pak
windows7-x64
3OneLaunch\...es.pak
windows10-2004-x64
3OneLaunch\...ot.bin
windows7-x64
3OneLaunch\...ot.bin
windows10-2004-x64
3OneLaunch\...2C.pma
windows7-x64
3OneLaunch\...2C.pma
windows10-2004-x64
3OneLaunch\...tflite
windows7-x64
3OneLaunch\...tflite
windows10-2004-x64
3OneLaunch\...tAudit
windows7-x64
1OneLaunch\...tAudit
windows10-2004-x64
1OneLaunch\...tabase
windows7-x64
1OneLaunch\...tabase
windows10-2004-x64
1OneLaunch\...data_0
windows7-x64
1OneLaunch\...data_0
windows10-2004-x64
1OneLaunch\...data_1
windows7-x64
1OneLaunch\...data_1
windows10-2004-x64
1OneLaunch\...data_2
windows7-x64
1OneLaunch\...data_2
windows10-2004-x64
1OneLaunch\...data_3
windows7-x64
1OneLaunch\...data_3
windows10-2004-x64
1OneLaunch\...\index
windows7-x64
1OneLaunch\...\index
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 17:44
Behavioral task
behavioral1
Sample
OneLaunch.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
OneLaunch.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
OneLaunch\5.3.5\chromium\chrome.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
OneLaunch\5.3.5\chromium\chrome.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
OneLaunch\5.3.5\chromium\chrome_elf.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
OneLaunch\5.3.5\chromium\chrome_elf.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
OneLaunch\5.3.5\chromium\chromium.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
OneLaunch\5.3.5\chromium\chromium.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
OneLaunch\5.3.5\chromium\d3dcompiler_47.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
OneLaunch\5.3.5\chromium\d3dcompiler_47.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
OneLaunch\5.3.5\chromium\resources.pak
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
OneLaunch\5.3.5\chromium\resources.pak
Resource
win10v2004-20230221-en
Behavioral task
behavioral13
Sample
OneLaunch\5.3.5\chromium\v8_context_snapshot.bin
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
OneLaunch\5.3.5\chromium\v8_context_snapshot.bin
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
OneLaunch\User Data\BrowserMetrics\BrowserMetrics-6419AFF6-202C.pma
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
OneLaunch\User Data\BrowserMetrics\BrowserMetrics-6419AFF6-202C.pma
Resource
win10v2004-20230221-en
Behavioral task
behavioral17
Sample
OneLaunch\User Data\ClientSidePhishing\29.0\visual_model.tflite
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
OneLaunch\User Data\ClientSidePhishing\29.0\visual_model.tflite
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
OneLaunch\User Data\Default\AccessContextAudit
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
OneLaunch\User Data\Default\AccessContextAudit
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
OneLaunch\User Data\Default\Affiliation Database
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
OneLaunch\User Data\Default\Affiliation Database
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
OneLaunch\User Data\Default\Cache\Cache_Data\data_0
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
OneLaunch\User Data\Default\Cache\Cache_Data\data_0
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
OneLaunch\User Data\Default\Cache\Cache_Data\data_1
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
OneLaunch\User Data\Default\Cache\Cache_Data\data_1
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
OneLaunch\User Data\Default\Cache\Cache_Data\data_2
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
OneLaunch\User Data\Default\Cache\Cache_Data\data_2
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
OneLaunch\User Data\Default\Cache\Cache_Data\data_3
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
OneLaunch\User Data\Default\Cache\Cache_Data\data_3
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
OneLaunch\User Data\Default\Cache\Cache_Data\index
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
OneLaunch\User Data\Default\Cache\Cache_Data\index
Resource
win10v2004-20230220-en
General
-
Target
OneLaunch\5.3.5\chromium\v8_context_snapshot.bin
-
Size
591KB
-
MD5
5f15f9f714c5dc281bdd99472cd9757b
-
SHA1
188b8e1baeaa68a213d8fead9b2bdb2fc5aa04c6
-
SHA256
8907787d21b78c6ce5aebd16009cdee9a12509c33bfae39380cc879a9666c436
-
SHA512
3159ab1c03e08a58556710f5e3bdc4099607fcc0d1486a31cffb899add5998498455f6db97a7a4447fd6c6fb7c6a16fe5f5dc2e690be38f15e2a0e5443813d28
-
SSDEEP
6144:MCp0KewbnioonOTRerLcR8TUplGw563PyoQ8pafSeOv8I72w3JFjN:LxBW+3wwY3vQ8MOv8M3J5N
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4776 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\OneLaunch\5.3.5\chromium\v8_context_snapshot.bin1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx