Overview

overview

8

Static

static

1

OneLaunch ...qr.exe

windows10-1703-x64

8

OneLaunch ...qr.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OneLaunch - PDF_8jcqr.exe

  • Size

    2.9MB

  • Sample

    230705-f8va1aae87

  • MD5

    cdd6433b49575a3a11018af8a079b695

  • SHA1

    b7c82e18b683939dff6891a9e3afe3f97275ed31

  • SHA256

    bb4a53733f0033eb457acf98da3adcaed09328dbd37dd8991d788ae67187b33d

  • SHA512

    e9ec2ffdee94d0b66a7ccd0e01a187bdcc3fbd56d84835b4fb555797008e5891580da7ea1cbee1be38a6625850e23b433105cf6cc5b88d90b98a506a0da41a96

  • SSDEEP

    49152:hqe3f6RzyPE5oZPCpecWcNwDCEjqVX5rIJwI2J5PiH7nBGtY:4SiRzcSeCec/NwWEjgJLTiH7BUY

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      OneLaunch - PDF_8jcqr.exe

    • Size

      2.9MB

    • MD5

      cdd6433b49575a3a11018af8a079b695

    • SHA1

      b7c82e18b683939dff6891a9e3afe3f97275ed31

    • SHA256

      bb4a53733f0033eb457acf98da3adcaed09328dbd37dd8991d788ae67187b33d

    • SHA512

      e9ec2ffdee94d0b66a7ccd0e01a187bdcc3fbd56d84835b4fb555797008e5891580da7ea1cbee1be38a6625850e23b433105cf6cc5b88d90b98a506a0da41a96

    • SSDEEP

      49152:hqe3f6RzyPE5oZPCpecWcNwDCEjqVX5rIJwI2J5PiH7nBGtY:4SiRzcSeCec/NwWEjgJLTiH7BUY

    Score
    8/10
    discoverypersistence

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks