Malware Analysis Report

2024-09-11 03:53

Sample ID 240621-p2vgvstgrr
Target Oneclick-V6.7.bat
SHA256 5a23e31df8a552f29c44e23a37e19616080d46c75eb2d7db462eb01441106742
Tags
execution
score
4/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
4/10

SHA256

5a23e31df8a552f29c44e23a37e19616080d46c75eb2d7db462eb01441106742

Threat Level: Likely benign

The file Oneclick-V6.7.bat was found to be: Likely benign.

Malicious Activity Summary

execution

Launches sc.exe

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Runs net.exe

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Delays execution with timeout.exe

Modifies data under HKEY_USERS

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-21 12:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-21 12:49

Reported

2024-06-21 12:52

Platform

win7-20240611-en

Max time kernel

119s

Max time network

120s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-V6.7.bat"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2160 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\fltMC.exe
PID 2160 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\fltMC.exe
PID 2160 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\fltMC.exe
PID 2160 wrote to memory of 2596 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2160 wrote to memory of 2596 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2160 wrote to memory of 2596 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2160 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 2188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2160 wrote to memory of 2188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2160 wrote to memory of 2188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2160 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 1048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 1048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 1048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2160 wrote to memory of 2952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2160 wrote to memory of 2952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2160 wrote to memory of 2952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2160 wrote to memory of 996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2160 wrote to memory of 996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2160 wrote to memory of 996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 996 wrote to memory of 1752 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 996 wrote to memory of 1752 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 996 wrote to memory of 1752 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2160 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2160 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2160 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2160 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2160 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2160 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2160 wrote to memory of 2072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2160 wrote to memory of 2072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2160 wrote to memory of 2072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2160 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2160 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2160 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2160 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2160 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2160 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2160 wrote to memory of 2748 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2160 wrote to memory of 2748 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2160 wrote to memory of 2748 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2160 wrote to memory of 1128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2160 wrote to memory of 1128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2160 wrote to memory of 1128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2160 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2160 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2160 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2160 wrote to memory of 2568 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2160 wrote to memory of 2568 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2160 wrote to memory of 2568 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2160 wrote to memory of 1328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2160 wrote to memory of 1328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2160 wrote to memory of 1328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2160 wrote to memory of 2244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2160 wrote to memory of 2244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2160 wrote to memory of 2244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2160 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-V6.7.bat"

C:\Windows\system32\fltMC.exe

fltmc

C:\Windows\system32\sc.exe

sc query "WinDefend"

C:\Windows\system32\find.exe

find "STATE"

C:\Windows\system32\find.exe

find "RUNNING"

C:\Windows\system32\sc.exe

sc qc "TrustedInstaller"

C:\Windows\system32\find.exe

find "START_TYPE"

C:\Windows\system32\find.exe

find "DISABLED"

C:\Windows\system32\sc.exe

sc config TrustedInstaller start=auto

C:\Windows\system32\net.exe

net start TrustedInstaller

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start TrustedInstaller

C:\Windows\system32\timeout.exe

timeout 1

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\timeout.exe

timeout 2

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\chcp.com

chcp 437

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Write-Host 'Recommended!' -ForegroundColor White -BackgroundColor Red"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f

C:\Windows\system32\reg.exe

reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f

C:\Windows\system32\timeout.exe

timeout 1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Checkpoint-Computer -Description 'OneClick V6.7 Restore Point'"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002EC" "0000000000000324"

C:\Windows\system32\timeout.exe

timeout 2

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\timeout.exe

timeout 1

Network

N/A

Files

memory/2748-4-0x000000001B640000-0x000000001B922000-memory.dmp

memory/2748-5-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 8b1330f0f74306b44d5a1d24c047d78e
SHA1 fb66925ec338079c0fecec9559f7480fedbacc75
SHA256 6182bba8fe79b3b22585e8dcc49094020ed08b833fbb986579736f4f41437f95
SHA512 bb9e627b7ae06ee1473448aff6be035ac6fc415737a1e8fb4fbe672626bbde7d62f859f2e142ff97f687aec4e92d5a9ef3dd78c08c6f12667b8a027bd29c4d81

memory/1128-11-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

memory/1128-12-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-21 12:49

Reported

2024-06-21 12:52

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-V6.7.bat"

Signatures

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2932 wrote to memory of 1796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\fltMC.exe
PID 2932 wrote to memory of 1796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\fltMC.exe
PID 2932 wrote to memory of 1796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\fltMC.exe
PID 2932 wrote to memory of 2064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2932 wrote to memory of 2064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2932 wrote to memory of 2064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2932 wrote to memory of 2100 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 2100 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 2100 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 316 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 316 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 316 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2932 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2932 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2932 wrote to memory of 2084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 2084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 2084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 2824 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 2824 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 2824 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2932 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2932 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2932 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2932 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2932 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2932 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2692 wrote to memory of 2604 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2692 wrote to memory of 2604 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2692 wrote to memory of 2604 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2932 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2932 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2932 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2932 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2932 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2932 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2932 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2932 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2932 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2932 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2932 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2932 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2932 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2932 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2932 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2932 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2932 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2932 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-V6.7.bat"

C:\Windows\system32\fltMC.exe

fltmc

C:\Windows\system32\sc.exe

sc query "WinDefend"

C:\Windows\system32\find.exe

find "STATE"

C:\Windows\system32\find.exe

find "RUNNING"

C:\Windows\system32\sc.exe

sc qc "TrustedInstaller"

C:\Windows\system32\find.exe

find "START_TYPE"

C:\Windows\system32\find.exe

find "DISABLED"

C:\Windows\system32\sc.exe

sc config TrustedInstaller start=auto

C:\Windows\system32\net.exe

net start TrustedInstaller

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start TrustedInstaller

C:\Windows\system32\timeout.exe

timeout 1

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\timeout.exe

timeout 2

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\chcp.com

chcp 437

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Write-Host 'Recommended!' -ForegroundColor White -BackgroundColor Red"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

N/A

Files

memory/2520-4-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

memory/2520-5-0x0000000002860000-0x0000000002868000-memory.dmp