Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 18:55
Static task
static1
Behavioral task
behavioral1
Sample
FukOneDrive.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
FukOneDrive.exe
Resource
win10v2004-20240802-en
General
-
Target
FukOneDrive.exe
-
Size
466KB
-
MD5
038f9cc38d70854f617fc309ce658389
-
SHA1
c180b95e6e28f697f56897c841eb8068c04cbeba
-
SHA256
fb711c8e0525c98ea98df7a4d0386d4629de88fa233ae55eab91c612f869fa09
-
SHA512
35200a8acb4d0154b0e188d604c2aaf6463cf243192cd65805ab659a954eff6d57257aae48f933557fd334d0c7754e0cdd27f6d484e76c161e979fce9a66bca2
-
SSDEEP
6144:I5aMJNLwL73PZPkFr1jilzqqVWk6855JKSFtIooEbQOW7WiDf7U:IOxPkPjQeqQ1Y53KRdr7U
Malware Config
Signatures
-
pid Process 2916 powershell.exe 2904 powershell.exe 2348 powershell.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2644 tasklist.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files\Fuk OneDrive Files\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Program Files\Fuk OneDrive Files\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Program Files\Fuk OneDrive Files\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Program Files\Fuk OneDrive Files FukOneDrive.exe File created C:\Program Files\Fuk OneDrive Files\__tmp_rar_sfx_access_check_259448944 FukOneDrive.exe File created C:\Program Files\Fuk OneDrive Files\OneDrive.bat FukOneDrive.exe File opened for modification C:\Program Files\Fuk OneDrive Files\OneDrive.bat FukOneDrive.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2916 powershell.exe 2904 powershell.exe 2348 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2644 tasklist.exe Token: SeDebugPrivilege 2916 powershell.exe Token: SeDebugPrivilege 2904 powershell.exe Token: SeDebugPrivilege 2348 powershell.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3004 wrote to memory of 3036 3004 FukOneDrive.exe 31 PID 3004 wrote to memory of 3036 3004 FukOneDrive.exe 31 PID 3004 wrote to memory of 3036 3004 FukOneDrive.exe 31 PID 3036 wrote to memory of 2836 3036 cmd.exe 33 PID 3036 wrote to memory of 2836 3036 cmd.exe 33 PID 3036 wrote to memory of 2836 3036 cmd.exe 33 PID 3036 wrote to memory of 2644 3036 cmd.exe 34 PID 3036 wrote to memory of 2644 3036 cmd.exe 34 PID 3036 wrote to memory of 2644 3036 cmd.exe 34 PID 3036 wrote to memory of 3052 3036 cmd.exe 35 PID 3036 wrote to memory of 3052 3036 cmd.exe 35 PID 3036 wrote to memory of 3052 3036 cmd.exe 35 PID 3036 wrote to memory of 2916 3036 cmd.exe 37 PID 3036 wrote to memory of 2916 3036 cmd.exe 37 PID 3036 wrote to memory of 2916 3036 cmd.exe 37 PID 3036 wrote to memory of 2904 3036 cmd.exe 38 PID 3036 wrote to memory of 2904 3036 cmd.exe 38 PID 3036 wrote to memory of 2904 3036 cmd.exe 38 PID 3036 wrote to memory of 2348 3036 cmd.exe 39 PID 3036 wrote to memory of 2348 3036 cmd.exe 39 PID 3036 wrote to memory of 2348 3036 cmd.exe 39 PID 2348 wrote to memory of 3032 2348 powershell.exe 40 PID 2348 wrote to memory of 3032 2348 powershell.exe 40 PID 2348 wrote to memory of 3032 2348 powershell.exe 40 PID 3032 wrote to memory of 2980 3032 cmd.exe 41 PID 3032 wrote to memory of 2980 3032 cmd.exe 41 PID 3032 wrote to memory of 2980 3032 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\FukOneDrive.exe"C:\Users\Admin\AppData\Local\Temp\FukOneDrive.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\cmd.execmd /c ""C:\Program Files\Fuk OneDrive Files\OneDrive.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\system32\fltMC.exefltmc3⤵PID:2836
-
-
C:\Windows\system32\tasklist.exetasklist /fi "ImageName eq OneDrive.exe" /fo csv3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\system32\find.exefind /i "OneDrive.exe"3⤵PID:3052
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -ExecutionPolicy Unrestricted -Command "$keyName = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'; $valueName = 'OneDrive'; $hive = $keyName.Split('\')[0]; $path = """$($hive):$($keyName.Substring($hive.Length))"""; Write-Host """Removing the registry value '$valueName' from '$path'."""; if (-Not (Test-Path -LiteralPath $path)) { Write-Host 'Skipping, no action needed, registry key does not exist.'; Exit 0; }; $existingValueNames = (Get-ItemProperty -LiteralPath $path).PSObject.Properties.Name; if (-Not ($existingValueNames -Contains $valueName)) { Write-Host 'Skipping, no action needed, registry value does not exist.'; Exit 0; }; try { if ($valueName -ieq '(default)') { Write-Host 'Removing the default value.'; $(Get-Item -LiteralPath $path).OpenSubKey('', $true).DeleteValue(''); } else { Remove-ItemProperty -LiteralPath $path -Name $valueName -Force -ErrorAction Stop; }; Write-Host 'Successfully removed the registry value.'; } catch { Write-Error """Failed to remove the registry value: $($_.Exception.Message)"""; }"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\OneDrive*'; if (-Not $directoryGlob.EndsWith('\')) { $directoryGlob += '\' }; $directoryGlob )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $oneDriveUserFolderPattern = [System.Environment]::ExpandEnvironmentVariables('C:\Users\Admin\OneDrive') + '*'; while ($true) { <# Loop to control the execution of the subsequent code #>; try { $userShellFoldersRegistryPath = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders'; if (-not (Test-Path $userShellFoldersRegistryPath)) { Write-Output """Skipping verification: The registry path for user shell folders is missing: `"""$userShellFoldersRegistryPath`""""""; break; }; $userShellFoldersRegistryKeys = Get-ItemProperty -Path $userShellFoldersRegistryPath; $userShellFoldersEntries = @($userShellFoldersRegistryKeys.PSObject.Properties); if ($userShellFoldersEntries.Count -eq 0) { Write-Warning """Skipping verification: No entries found for user shell folders in the registry: `"""$userShellFoldersRegistryPath`""""""; break; }; Write-Output """Initiating verification: Checking if any of the ${userShellFoldersEntries.Count} user shell folders point to the OneDrive user folder pattern ($oneDriveUserFolderPattern)."""; $userShellFoldersInOneDrive = @(); foreach ($registryEntry in $userShellFoldersEntries) { $userShellFolderName = $registryEntry.Name; $userShellFolderPath = $registryEntry.Value; if (!$userShellFolderPath) { Write-Output """Skipping: The user shell folder `"""$userShellFolderName`""" does not have a defined path."""; continue; }; $expandedUserShellFolderPath = [System.Environment]::ExpandEnvironmentVariables($userShellFolderPath); if(-not ($expandedUserShellFolderPath -like $oneDriveUserFolderPattern)) { continue; }; $userShellFoldersInOneDrive += [PSCustomObject]@{ Name = $userShellFolderName; Path = $expandedUserShellFolderPath }; }; if ($userShellFoldersInOneDrive.Count -gt 0) { $warningMessage = 'To keep your computer running smoothly, OneDrive user folder will not be deleted.'; $warningMessage += """`nIt's being used by the OS as a user shell directory for the following folders:"""; $userShellFoldersInOneDrive.ForEach( { $warningMessage += """`n- $($_.Name): $($_.Path)"""; }); Write-Warning $warningMessage; exit 0; }; Write-Output """Successfully verified that none of the $($userShellFoldersEntries.Count) user shell folders point to the OneDrive user folder pattern."""; break; } catch { Write-Warning """An error occurred during verification of user shell folders. Skipping prevent potential issues. Error: $($_.Exception.Message)"""; exit 0; }; }; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { try { if (Test-Path -Path $path -PathType Leaf) { Write-Warning """Retaining file `"""$path`""" to safeguard your data."""; continue; } elseif (Test-Path -Path $path -PathType Container) { if ((Get-ChildItem """$path""" -Recurse | Measure-Object).Count -gt 0) { Write-Warning """Preserving non-empty folder `"""$path`""" to protect your files."""; continue; }; }; } catch { Write-Warning """An error occurred while processing `"""$path`""". Skipping to protect your data. Error: $($_.Exception.Message)"""; continue; }; if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive'; if (-Not $directoryGlob.EndsWith('\')) { $directoryGlob += '\' }; $directoryGlob )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; <# Not using `Get-Acl`/`Set-Acl` to avoid adjusting token privileges #>; $parentDirectory = [System.IO.Path]::GetDirectoryName($expandedPath); $fileName = [System.IO.Path]::GetFileName($expandedPath); if ($parentDirectory -like '*[*?]*') { throw """Unable to grant permissions to glob path parent directory: `"""$parentDirectory`""", wildcards in parent directory are not supported by ``takeown`` and ``icacls``."""; }; if (($fileName -ne '*') -and ($fileName -like '*[*?]*')) { throw """Unable to grant permissions to glob path file name: `"""$fileName`""", wildcards in file name is not supported by ``takeown`` and ``icacls``."""; }; Write-Host """Taking ownership of `"""$expandedPath`"""."""; $cmdPath = $expandedPath; if ($cmdPath.EndsWith('\')) { $cmdPath += '\' <# Escape trailing backslash for correct handling in batch commands #>; }; $takeOwnershipCommand = """takeown /f `"""$cmdPath`""" /a""" <# `icacls /setowner` does not succeed, so use `takeown` instead. #>; if (-not (Test-Path -Path """$expandedPath""" -PathType Leaf)) { $localizedYes = 'Y' <# Default 'Yes' flag (fallback) #>; try { $choiceOutput = cmd /c """choice <nul 2>nul"""; if ($choiceOutput -and $choiceOutput.Length -ge 2) { $localizedYes = $choiceOutput[1]; } else { Write-Warning """Failed to determine localized 'Yes' character. Output: `"""$choiceOutput`""""""; }; } catch { Write-Warning """Failed to determine localized 'Yes' character. Error: $_"""; }; $takeOwnershipCommand += """ /r /d $localizedYes"""; }; $takeOwnershipOutput = cmd /c """$takeOwnershipCommand 2>&1""" <# `stderr` message is misleading, e.g. """ERROR: The system cannot find the file specified.""" is not an error. #>; if ($LASTEXITCODE -eq 0) { Write-Host """Successfully took ownership of `"""$expandedPath`""" (using ``$takeOwnershipCommand``)."""; } else { Write-Host """Did not take ownership of `"""$expandedPath`""" using ``$takeOwnershipCommand``, status code: $LASTEXITCODE, message: $takeOwnershipOutput."""; <# Do not write as error or warning, because this can be due to missing path, it's handled in next command. #>; <# `takeown` exits with status code `1`, making it hard to handle missing path here. #>; }; Write-Host """Granting permissions for `"""$expandedPath`"""."""; $adminSid = New-Object System.Security.Principal.SecurityIdentifier 'S-1-5-32-544'; $adminAccount = $adminSid.Translate([System.Security.Principal.NTAccount]); $adminAccountName = $adminAccount.Value; $grantPermissionsCommand = """icacls `"""$cmdPath`""" /grant `"""$($adminAccountName):F`""" /t"""; $icaclsOutput = cmd /c """$grantPermissionsCommand"""; if ($LASTEXITCODE -eq 3) { Write-Host """Skipping, no items available for deletion according to: ``$grantPermissionsCommand``."""; exit 0; } elseif ($LASTEXITCODE -ne 0) { Write-Host """Take ownership message:`n$takeOwnershipOutput"""; Write-Host """Grant permissions:`n$icaclsOutput"""; Write-Warning """Failed to assign permissions for `"""$expandedPath`""" using ``$grantPermissionsCommand``, status code: $LASTEXITCODE."""; } else { $fileStats = $icaclsOutput | ForEach-Object { $_ -match '\d+' | Out-Null; $matches[0] } | Where-Object { $_ -ne $null } | ForEach-Object { [int]$_ }; if ($fileStats.Count -gt 0 -and ($fileStats | ForEach-Object { $_ -eq 0 } | Where-Object { $_ -eq $false }).Count -eq 0) { Write-Host """Skipping, no items available for deletion according to: ``$grantPermissionsCommand``."""; exit 0; } else { Write-Host """Successfully granted permissions for `"""$expandedPath`""" (using ``$grantPermissionsCommand``)."""; }; }; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "choice <nul 2>nul"4⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\system32\choice.exechoice5⤵PID:2980
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5ee9e90614c8503913f36e9c8403df858
SHA1426f0a41f3e7aea087a25e2ea98134c2ca40c719
SHA256aab2dc2fb0b4452d4fc436bfa8c515704db6e29556dde55f4d9b390041740bb9
SHA5129bf39ecd21132e48b6a977331aabc83337d439a1e33ce1ee30cd785c1b84b14994d0543d02dc180bdf042b513284ba8e4f1870f5b2ff88c1ed6247a60cdb1653
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5c60c6429ce1bacb4c995a7753f479782
SHA1bad59d3e106b4a84049b630155ab1805cce568e4
SHA2567cd7dfd05e3cfd5532f1db22a62dc668022647ad71beaaaf7672f489e2d8abec
SHA5122637228cc41d7c38ae21e266949e2ba306e84a07649f027bc7adbfad1c18cbed183e30bf24b24fb194123c90f09d7c138b70a985cffc9552316969a7f35afbee