5a23e31df8a552f29c44e23a37e19616080d46c75eb2d7db462eb01441106742

General

Target

Oneclick-V6.7.bat
Size

201KB
MD5

ea994c0d4dcdf963b7b7bf5cf54a26ae
SHA1

f16c3d7d5f2fd868d9385b601dc411605ba95342
SHA256

5a23e31df8a552f29c44e23a37e19616080d46c75eb2d7db462eb01441106742
SHA512

0a065d62966e08d34dc00973d5955b918f0d588f2f03361099b7b21a5696f8da4a07cc5bd8ad2e1b2153ff3372c95d3d6a19a0d8d61aacd4607a6608adb298da
SSDEEP

1536:97SPKdigMQgPTjIV4wJzSwTgfGH/ngfHH4pX/WaZSiDk2IWOmXmomk:9nnHgv3h4KmXmomk

Score

4^/10

execution

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

Processes:

DrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2596 sc.exe
2188 sc.exe
2952 sc.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2748 powershell.exe
1128 powershell.exe
2532 powershell.exe
Delays execution with timeout.exe 5 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

2448 timeout.exe
2836 timeout.exe
2072 timeout.exe
2244 timeout.exe
2296 timeout.exe

pid	process
2596	sc.exe
2188	sc.exe
2952	sc.exe

pid	process
2748	powershell.exe
1128	powershell.exe
2532	powershell.exe

pid	process
2448	timeout.exe
2836	timeout.exe
2072	timeout.exe
2244	timeout.exe
2296	timeout.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Runs net.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2748 powershell.exe
1128 powershell.exe
2532 powershell.exe

pid	process
2748	powershell.exe
1128	powershell.exe
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

powershell.exepowershell.exepowershell.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeBackupPrivilege	2320	vssvc.exe
Token: SeRestorePrivilege	2320	vssvc.exe
Token: SeAuditPrivilege	2320	vssvc.exe
Token: SeRestorePrivilege	1072	DrvInst.exe
Token: SeRestorePrivilege	1072	DrvInst.exe
Token: SeRestorePrivilege	1072	DrvInst.exe
Token: SeRestorePrivilege	1072	DrvInst.exe
Token: SeRestorePrivilege	1072	DrvInst.exe
Token: SeRestorePrivilege	1072	DrvInst.exe
Token: SeRestorePrivilege	1072	DrvInst.exe
Token: SeLoadDriverPrivilege	1072	DrvInst.exe
Token: SeLoadDriverPrivilege	1072	DrvInst.exe
Token: SeLoadDriverPrivilege	1072	DrvInst.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exenet.exe

description	pid	process	target process
PID 2160 wrote to memory of 1988	2160	cmd.exe	fltMC.exe
PID 2160 wrote to memory of 1988	2160	cmd.exe	fltMC.exe
PID 2160 wrote to memory of 1988	2160	cmd.exe	fltMC.exe
PID 2160 wrote to memory of 2596	2160	cmd.exe	sc.exe
PID 2160 wrote to memory of 2596	2160	cmd.exe	sc.exe
PID 2160 wrote to memory of 2596	2160	cmd.exe	sc.exe
PID 2160 wrote to memory of 2088	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2088	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2088	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2436	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2436	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2436	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2188	2160	cmd.exe	sc.exe
PID 2160 wrote to memory of 2188	2160	cmd.exe	sc.exe
PID 2160 wrote to memory of 2188	2160	cmd.exe	sc.exe
PID 2160 wrote to memory of 2432	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2432	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2432	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 1048	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 1048	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 1048	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2952	2160	cmd.exe	sc.exe
PID 2160 wrote to memory of 2952	2160	cmd.exe	sc.exe
PID 2160 wrote to memory of 2952	2160	cmd.exe	sc.exe
PID 2160 wrote to memory of 996	2160	cmd.exe	net.exe
PID 2160 wrote to memory of 996	2160	cmd.exe	net.exe
PID 2160 wrote to memory of 996	2160	cmd.exe	net.exe
PID 996 wrote to memory of 1752	996	net.exe	net1.exe
PID 996 wrote to memory of 1752	996	net.exe	net1.exe
PID 996 wrote to memory of 1752	996	net.exe	net1.exe
PID 2160 wrote to memory of 2836	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2836	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2836	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2268	2160	cmd.exe	chcp.com
PID 2160 wrote to memory of 2268	2160	cmd.exe	chcp.com
PID 2160 wrote to memory of 2268	2160	cmd.exe	chcp.com
PID 2160 wrote to memory of 2072	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2072	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2072	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2724	2160	cmd.exe	chcp.com
PID 2160 wrote to memory of 2724	2160	cmd.exe	chcp.com
PID 2160 wrote to memory of 2724	2160	cmd.exe	chcp.com
PID 2160 wrote to memory of 2736	2160	cmd.exe	chcp.com
PID 2160 wrote to memory of 2736	2160	cmd.exe	chcp.com
PID 2160 wrote to memory of 2736	2160	cmd.exe	chcp.com
PID 2160 wrote to memory of 2748	2160	cmd.exe	powershell.exe
PID 2160 wrote to memory of 2748	2160	cmd.exe	powershell.exe
PID 2160 wrote to memory of 2748	2160	cmd.exe	powershell.exe
PID 2160 wrote to memory of 1128	2160	cmd.exe	powershell.exe
PID 2160 wrote to memory of 1128	2160	cmd.exe	powershell.exe
PID 2160 wrote to memory of 1128	2160	cmd.exe	powershell.exe
PID 2160 wrote to memory of 2104	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2104	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2104	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2568	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2568	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2568	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 1328	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 1328	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 1328	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2244	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2244	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2244	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2532	2160	cmd.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-V6.7.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\system32\fltMC.exe
fltmc
2⤵
PID:1988

C:\Windows\system32\sc.exe
sc query "WinDefend"
2⤵
- Launches sc.exe
PID:2596

C:\Windows\system32\find.exe
find "STATE"
2⤵
PID:2088

C:\Windows\system32\find.exe
find "RUNNING"
2⤵
PID:2436

C:\Windows\system32\sc.exe
sc qc "TrustedInstaller"
2⤵
- Launches sc.exe
PID:2188

C:\Windows\system32\find.exe
find "START_TYPE"
2⤵
PID:2432

C:\Windows\system32\find.exe
find "DISABLED"
2⤵
PID:1048

C:\Windows\system32\sc.exe
sc config TrustedInstaller start=auto
2⤵
- Launches sc.exe
PID:2952

C:\Windows\system32\net.exe
net start TrustedInstaller
2⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start TrustedInstaller
3⤵
PID:1752

C:\Windows\system32\timeout.exe
timeout 1
2⤵
- Delays execution with timeout.exe
PID:2836

C:\Windows\system32\chcp.com
chcp 65001
2⤵
PID:2268

C:\Windows\system32\timeout.exe
timeout 2
2⤵
- Delays execution with timeout.exe
PID:2072

C:\Windows\system32\chcp.com
chcp 65001
2⤵
PID:2724

C:\Windows\system32\chcp.com
chcp 437
2⤵
PID:2736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Write-Host 'Recommended!' -ForegroundColor White -BackgroundColor Red"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\system32\reg.exe
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
2⤵
PID:2104

C:\Windows\system32\reg.exe
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
2⤵
PID:2568

C:\Windows\system32\reg.exe
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
2⤵
PID:1328

C:\Windows\system32\timeout.exe
timeout 1
2⤵
- Delays execution with timeout.exe
PID:2244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Checkpoint-Computer -Description 'OneClick V6.7 Restore Point'"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\system32\timeout.exe
timeout 2
2⤵
- Delays execution with timeout.exe
PID:2296

C:\Windows\system32\chcp.com
chcp 65001
2⤵
PID:1916

C:\Windows\system32\timeout.exe
timeout 1
2⤵
- Delays execution with timeout.exe
PID:2448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002EC" "0000000000000324"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1072

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
8b1330f0f74306b44d5a1d24c047d78e

SHA1
fb66925ec338079c0fecec9559f7480fedbacc75

SHA256
6182bba8fe79b3b22585e8dcc49094020ed08b833fbb986579736f4f41437f95

SHA512
bb9e627b7ae06ee1473448aff6be035ac6fc415737a1e8fb4fbe672626bbde7d62f859f2e142ff97f687aec4e92d5a9ef3dd78c08c6f12667b8a027bd29c4d81

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1128-11-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/1128-12-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2748-4-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2748-5-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads