Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06-05-2024 17:33
General
-
Target
OneLaunch - Top Templates_cdn1q.exe
-
Size
2.9MB
-
MD5
cdd6433b49575a3a11018af8a079b695
-
SHA1
b7c82e18b683939dff6891a9e3afe3f97275ed31
-
SHA256
bb4a53733f0033eb457acf98da3adcaed09328dbd37dd8991d788ae67187b33d
-
SHA512
e9ec2ffdee94d0b66a7ccd0e01a187bdcc3fbd56d84835b4fb555797008e5891580da7ea1cbee1be38a6625850e23b433105cf6cc5b88d90b98a506a0da41a96
-
SSDEEP
49152:hqe3f6RzyPE5oZPCpecWcNwDCEjqVX5rIJwI2J5PiH7nBGtY:4SiRzcSeCec/NwWEjgJLTiH7BUY
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 7 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 8 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OneLaunch - Top Templates_cdn1q.exe"C:\Users\Admin\AppData\Local\Temp\OneLaunch - Top Templates_cdn1q.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-399V5.tmp\OneLaunch - Top Templates_cdn1q.tmp"C:\Users\Admin\AppData\Local\Temp\is-399V5.tmp\OneLaunch - Top Templates_cdn1q.tmp" /SL5="$60178,2173635,893952,C:\Users\Admin\AppData\Local\Temp\OneLaunch - Top Templates_cdn1q.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OneLaunch - Top Templates_cdn1q.exe"C:\Users\Admin\AppData\Local\Temp\OneLaunch - Top Templates_cdn1q.exe" /PDATA=eyJtZXNzYWdlIjoiTm8gUmVjb3JkIEZvdW5kIiwiaW5zdGFsbF90aW1lIjoxNzE1MDE2ODA3LCJkaXN0aW5jdF9pZCI6IjJGNUM0OTJELTRFQUYtNDQwOC1BNjc1LTQxMTlBQ0VDQzZCNiIsImRlZmF1bHRfYnJvd3NlciI6Ik1TRWRnZUhUTSIsImluaXRpbmFsX3ZlcnNpb24iOiI1LjE3LjQuMCIsInBhY2thZ2VkX2Jyb3dzZXIiOiJOb25lIiwic3BsaXQiOiJiIiwib2xfcGx1c192MiI6ZmFsc2UsIm5vX3NwbGl0IjpmYWxzZSwic3BsaXQyIjoiYiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2ZvY3VzX2N1cnNvcl9udHAiOiJjb250cm9sIiwic2VydmVyX3NpZGVfc3BsaXRfMjhfMTFfbnRwX2Rpc3RyaWJ1dGlvbiI6InZhcmlhdGlvbiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2Rlc2t0b3Bfc2hvcnRjdXRfbmFtZSI6InZhcmlhdGlvbiIsInNwbGl0XzIyXzEyX21vcmVfZWR1Y2F0aW9uYWxfbWluaXByb21wdHMiOiJ2YXJpYXRpb24iLCJzcGxpdF8yM18wNl9wcmVwaW5fbGFiZWxsZWRfYW1hem9uX2FwcCI6InZhcmlhdGlvbiIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-O4Q17.tmp\OneLaunch - Top Templates_cdn1q.tmp"C:\Users\Admin\AppData\Local\Temp\is-O4Q17.tmp\OneLaunch - Top Templates_cdn1q.tmp" /SL5="$11004C,2173635,893952,C:\Users\Admin\AppData\Local\Temp\OneLaunch - Top Templates_cdn1q.exe" /PDATA=eyJtZXNzYWdlIjoiTm8gUmVjb3JkIEZvdW5kIiwiaW5zdGFsbF90aW1lIjoxNzE1MDE2ODA3LCJkaXN0aW5jdF9pZCI6IjJGNUM0OTJELTRFQUYtNDQwOC1BNjc1LTQxMTlBQ0VDQzZCNiIsImRlZmF1bHRfYnJvd3NlciI6Ik1TRWRnZUhUTSIsImluaXRpbmFsX3ZlcnNpb24iOiI1LjE3LjQuMCIsInBhY2thZ2VkX2Jyb3dzZXIiOiJOb25lIiwic3BsaXQiOiJiIiwib2xfcGx1c192MiI6ZmFsc2UsIm5vX3NwbGl0IjpmYWxzZSwic3BsaXQyIjoiYiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2ZvY3VzX2N1cnNvcl9udHAiOiJjb250cm9sIiwic2VydmVyX3NpZGVfc3BsaXRfMjhfMTFfbnRwX2Rpc3RyaWJ1dGlvbiI6InZhcmlhdGlvbiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2Rlc2t0b3Bfc2hvcnRjdXRfbmFtZSI6InZhcmlhdGlvbiIsInNwbGl0XzIyXzEyX21vcmVfZWR1Y2F0aW9uYWxfbWluaXByb21wdHMiOiJ2YXJpYXRpb24iLCJzcGxpdF8yM18wNl9wcmVwaW5fbGFiZWxsZWRfYW1hem9uX2FwcCI6InZhcmlhdGlvbiIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_cdn1q.exe"C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_cdn1q.exe" /PDATA=eyJtZXNzYWdlIjoiTm8gUmVjb3JkIEZvdW5kIiwiaW5zdGFsbF90aW1lIjoxNzE1MDE2ODA3LCJkaXN0aW5jdF9pZCI6IjJGNUM0OTJELTRFQUYtNDQwOC1BNjc1LTQxMTlBQ0VDQzZCNiIsImRlZmF1bHRfYnJvd3NlciI6Ik1TRWRnZUhUTSIsImluaXRpbmFsX3ZlcnNpb24iOiI1LjE3LjQuMCIsInBhY2thZ2VkX2Jyb3dzZXIiOiJOb25lIiwic3BsaXQiOiJiIiwib2xfcGx1c192MiI6ZmFsc2UsIm5vX3NwbGl0IjpmYWxzZSwic3BsaXQyIjoiYiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2ZvY3VzX2N1cnNvcl9udHAiOiJjb250cm9sIiwic2VydmVyX3NpZGVfc3BsaXRfMjhfMTFfbnRwX2Rpc3RyaWJ1dGlvbiI6InZhcmlhdGlvbiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2Rlc2t0b3Bfc2hvcnRjdXRfbmFtZSI6InZhcmlhdGlvbiIsInNwbGl0XzIyXzEyX21vcmVfZWR1Y2F0aW9uYWxfbWluaXByb21wdHMiOiJ2YXJpYXRpb24iLCJzcGxpdF8yM18wNl9wcmVwaW5fbGFiZWxsZWRfYW1hem9uX2FwcCI6InZhcmlhdGlvbiIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-282DG.tmp\OneLaunch Setup_cdn1q.tmp"C:\Users\Admin\AppData\Local\Temp\is-282DG.tmp\OneLaunch Setup_cdn1q.tmp" /SL5="$10250,98167063,893952,C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_cdn1q.exe" /PDATA=eyJtZXNzYWdlIjoiTm8gUmVjb3JkIEZvdW5kIiwiaW5zdGFsbF90aW1lIjoxNzE1MDE2ODA3LCJkaXN0aW5jdF9pZCI6IjJGNUM0OTJELTRFQUYtNDQwOC1BNjc1LTQxMTlBQ0VDQzZCNiIsImRlZmF1bHRfYnJvd3NlciI6Ik1TRWRnZUhUTSIsImluaXRpbmFsX3ZlcnNpb24iOiI1LjE3LjQuMCIsInBhY2thZ2VkX2Jyb3dzZXIiOiJOb25lIiwic3BsaXQiOiJiIiwib2xfcGx1c192MiI6ZmFsc2UsIm5vX3NwbGl0IjpmYWxzZSwic3BsaXQyIjoiYiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2ZvY3VzX2N1cnNvcl9udHAiOiJjb250cm9sIiwic2VydmVyX3NpZGVfc3BsaXRfMjhfMTFfbnRwX2Rpc3RyaWJ1dGlvbiI6InZhcmlhdGlvbiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2Rlc2t0b3Bfc2hvcnRjdXRfbmFtZSI6InZhcmlhdGlvbiIsInNwbGl0XzIyXzEyX21vcmVfZWR1Y2F0aW9uYWxfbWluaXByb21wdHMiOiJ2YXJpYXRpb24iLCJzcGxpdF8yM18wNl9wcmVwaW5fbGFiZWxsZWRfYW1hem9uX2FwcCI6InZhcmlhdGlvbiIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD546af77b61e829d5037ba657cea94d50a
SHA12872c94df0e7abddb94a5c7c1822492b09eeeb65
SHA256a4d525be5f7e6e7f60e31a2227dadf16d43f5510bb17625bda76868279751099
SHA5124232d98a32008aae1cea8b235bbb9fd9908d78f98617228e45c90ef719d210de9c0880aec41e220d9c504b1ae63dbe97967e54bbbcfa36e2ed73ede323ba9069
-
Filesize
3.0MB
MD59b5632f007c8167a3b00da0650890656
SHA1fa58306fc2dc2a6be63501625e96570979560582
SHA2564f97a90004773cb627a9cbb39cff5c2c43262d04b7f9f88572b81ad041ed48a4
SHA5120ec72d4dd1d188bf7a717d1fb8fd087c16cd0c93fc2d78bc16bce625dc615710f2c6074b54d8f1f0f0b4b9a1042c3ab47482ed16a5c4bd038f62bfe5a2c6fa21
-
Filesize
45KB
MD54f424691cf849999b6ac476ca09afdee
SHA198e2827aea19ccfc3980c5329f53e408f30acf8f
SHA256ca6793c4f4b12fac9506f441b8d6641a3e465dda0a1a14d49acdaa56a0389b07
SHA5122aec1c49b608a47b3804345094a108db3ce0e0ef7127eb70fa2e07a4c500fa697b33fcee4d7e6ebf3d8cc04dae13f7f07439d4dc1dcd6239baddef5d818edfff
-
Filesize
70KB
MD5d3110fb775ee7fd24426503d67840c25
SHA154f649c8bf3af2ad3a4d92cd8b1397bad1a49a75
SHA256f8392390dc81756e79ec5f359dbdcac3b4bd219b5188a429b814fc51aabb6e36
SHA512f6b79f728be17c9060edb2df2dac2b0f59a4dffd8c416e7e957bc3fa4696f4237e5969647309f5425a6297f189e351e20c99c642f90d1476050285929657c32f
-
Filesize
363B
MD5a4d4dc66a41d9c3b54a2ed3ee8d4b3df
SHA1e91a5e7a6690c14c6f799e2433beb2f6388c4df6
SHA25646e9c171e2115cd43e5d05f6a5f6015b27bda065fbab939916fee2fd5c06d5a4
SHA51299d5425aa653b93d0b6065020f88c095c39d982fb20a0ed0078418e8e862a104b4f0392791c79d2df86410a0ba5ba60e644852943a9fc602f7eaf82fecaaefd4
-
Filesize
5KB
MD52257b1d0d33a41f509e7c3e117819f8b
SHA187583bfbc655aec4e8cc4465b341c3f7889a6317
SHA256d43e4b285b5b54313b53e87d2a56ca9ba0c85f8f55c9c5fdcdb4fac815ff4d02
SHA512702d1a126a0a7a64af5cee9450daeed74364aa9e9f123e1bc398ecd4215c082e7f55e43dd292a4119749e84999b015109bff8b11732df11143d202b385411cc5
-
Filesize
24KB
MD52484489c7443ec4745488a77ed084d80
SHA1fcf49d1be8bbbae3d0dea49bb5e677fb19d98d9d
SHA25670b6921812f29b698f454927802db818c1625402baefd53ced1bfb9135c17d5a
SHA512a4776969b6bf215a85e7cfbc8f13dbb1beb4ef42eb5abfa572bb7f54c0032941c8bb178e7b77eda0c442741c29fccb02d8de157068dd31203bfed4e49ce051a5
-
Filesize
725KB
MD500de2dff1787f6d7904189476b307bfb
SHA1098a2c23f651d08730927adc8c63518744b199f9
SHA256cc24488a078d3e92dd7dfb96c22cebd4004ee7fcb297a438e2d3848b633a9f71
SHA51233a06affebca41e4580279d3ab0f5a2e798584f1ac7f15a19b2364825caba06d8cf57d4ea1ae15bb41d7b14b6ed48f0d3f472c4a4231b7ff792bfca97e93250f
-
Filesize
205B
MD5ea33b8c0de391aff43600a0ce7c4b87d
SHA18cc2700de8faac23b94e6e5dee37a91ce3ea0693
SHA256a48eb3ac6fbff98a67b8c14b1fce8ad2a5a7d715a31e76decb97a843647fd61b
SHA5126f005baeb6e82aedb5f6898f86266551ec938996afe5faf84b717947581816d7ccc25fbcc45b415b2b9af11b4bae2920a1c1b37134ccf74ebb8ac296ffd14aa2
-
Filesize
3.0MB
-
Filesize
80KB
-
Filesize
3.0MB
-
Filesize
80KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
728KB
-
Filesize
584KB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
1.2MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.0MB
-
Filesize
1.2MB
-
Filesize
3.0MB
-
Filesize
1.2MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
3.0MB
-
Filesize
3.0MB
