Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07-09-2024 18:55

General

  • Target

    FukOneDrive.exe

  • Size

    466KB

  • MD5

    038f9cc38d70854f617fc309ce658389

  • SHA1

    c180b95e6e28f697f56897c841eb8068c04cbeba

  • SHA256

    fb711c8e0525c98ea98df7a4d0386d4629de88fa233ae55eab91c612f869fa09

  • SHA512

    35200a8acb4d0154b0e188d604c2aaf6463cf243192cd65805ab659a954eff6d57257aae48f933557fd334d0c7754e0cdd27f6d484e76c161e979fce9a66bca2

  • SSDEEP

    6144:I5aMJNLwL73PZPkFr1jilzqqVWk6855JKSFtIooEbQOW7WiDf7U:IOxPkPjQeqQ1Y53KRdr7U

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FukOneDrive.exe
    "C:\Users\Admin\AppData\Local\Temp\FukOneDrive.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Program Files\Fuk OneDrive Files\OneDrive.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Windows\system32\fltMC.exe
        fltmc
        3⤵
          PID:2836
        • C:\Windows\system32\tasklist.exe
          tasklist /fi "ImageName eq OneDrive.exe" /fo csv
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2644
        • C:\Windows\system32\find.exe
          find /i "OneDrive.exe"
          3⤵
            PID:3052
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$keyName = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'; $valueName = 'OneDrive'; $hive = $keyName.Split('\')[0]; $path = """$($hive):$($keyName.Substring($hive.Length))"""; Write-Host """Removing the registry value '$valueName' from '$path'."""; if (-Not (Test-Path -LiteralPath $path)) { Write-Host 'Skipping, no action needed, registry key does not exist.'; Exit 0; }; $existingValueNames = (Get-ItemProperty -LiteralPath $path).PSObject.Properties.Name; if (-Not ($existingValueNames -Contains $valueName)) { Write-Host 'Skipping, no action needed, registry value does not exist.'; Exit 0; }; try { if ($valueName -ieq '(default)') { Write-Host 'Removing the default value.'; $(Get-Item -LiteralPath $path).OpenSubKey('', $true).DeleteValue(''); } else { Remove-ItemProperty -LiteralPath $path -Name $valueName -Force -ErrorAction Stop; }; Write-Host 'Successfully removed the registry value.'; } catch { Write-Error """Failed to remove the registry value: $($_.Exception.Message)"""; }"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2916
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\OneDrive*'; if (-Not $directoryGlob.EndsWith('\')) { $directoryGlob += '\' }; $directoryGlob )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $oneDriveUserFolderPattern = [System.Environment]::ExpandEnvironmentVariables('C:\Users\Admin\OneDrive') + '*'; while ($true) { <# Loop to control the execution of the subsequent code #>; try { $userShellFoldersRegistryPath = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders'; if (-not (Test-Path $userShellFoldersRegistryPath)) { Write-Output """Skipping verification: The registry path for user shell folders is missing: `"""$userShellFoldersRegistryPath`""""""; break; }; $userShellFoldersRegistryKeys = Get-ItemProperty -Path $userShellFoldersRegistryPath; $userShellFoldersEntries = @($userShellFoldersRegistryKeys.PSObject.Properties); if ($userShellFoldersEntries.Count -eq 0) { Write-Warning """Skipping verification: No entries found for user shell folders in the registry: `"""$userShellFoldersRegistryPath`""""""; break; }; Write-Output """Initiating verification: Checking if any of the ${userShellFoldersEntries.Count} user shell folders point to the OneDrive user folder pattern ($oneDriveUserFolderPattern)."""; $userShellFoldersInOneDrive = @(); foreach ($registryEntry in $userShellFoldersEntries) { $userShellFolderName = $registryEntry.Name; $userShellFolderPath = $registryEntry.Value; if (!$userShellFolderPath) { Write-Output """Skipping: The user shell folder `"""$userShellFolderName`""" does not have a defined path."""; continue; }; $expandedUserShellFolderPath = [System.Environment]::ExpandEnvironmentVariables($userShellFolderPath); if(-not ($expandedUserShellFolderPath -like $oneDriveUserFolderPattern)) { continue; }; $userShellFoldersInOneDrive += [PSCustomObject]@{ Name = $userShellFolderName; Path = $expandedUserShellFolderPath }; }; if ($userShellFoldersInOneDrive.Count -gt 0) { $warningMessage = 'To keep your computer running smoothly, OneDrive user folder will not be deleted.'; $warningMessage += """`nIt's being used by the OS as a user shell directory for the following folders:"""; $userShellFoldersInOneDrive.ForEach( { $warningMessage += """`n- $($_.Name): $($_.Path)"""; }); Write-Warning $warningMessage; exit 0; }; Write-Output """Successfully verified that none of the $($userShellFoldersEntries.Count) user shell folders point to the OneDrive user folder pattern."""; break; } catch { Write-Warning """An error occurred during verification of user shell folders. Skipping prevent potential issues. Error: $($_.Exception.Message)"""; exit 0; }; }; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { try { if (Test-Path -Path $path -PathType Leaf) { Write-Warning """Retaining file `"""$path`""" to safeguard your data."""; continue; } elseif (Test-Path -Path $path -PathType Container) { if ((Get-ChildItem """$path""" -Recurse | Measure-Object).Count -gt 0) { Write-Warning """Preserving non-empty folder `"""$path`""" to protect your files."""; continue; }; }; } catch { Write-Warning """An error occurred while processing `"""$path`""". Skipping to protect your data. Error: $($_.Exception.Message)"""; continue; }; if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2904
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive'; if (-Not $directoryGlob.EndsWith('\')) { $directoryGlob += '\' }; $directoryGlob )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; <# Not using `Get-Acl`/`Set-Acl` to avoid adjusting token privileges #>; $parentDirectory = [System.IO.Path]::GetDirectoryName($expandedPath); $fileName = [System.IO.Path]::GetFileName($expandedPath); if ($parentDirectory -like '*[*?]*') { throw """Unable to grant permissions to glob path parent directory: `"""$parentDirectory`""", wildcards in parent directory are not supported by ``takeown`` and ``icacls``."""; }; if (($fileName -ne '*') -and ($fileName -like '*[*?]*')) { throw """Unable to grant permissions to glob path file name: `"""$fileName`""", wildcards in file name is not supported by ``takeown`` and ``icacls``."""; }; Write-Host """Taking ownership of `"""$expandedPath`"""."""; $cmdPath = $expandedPath; if ($cmdPath.EndsWith('\')) { $cmdPath += '\' <# Escape trailing backslash for correct handling in batch commands #>; }; $takeOwnershipCommand = """takeown /f `"""$cmdPath`""" /a""" <# `icacls /setowner` does not succeed, so use `takeown` instead. #>; if (-not (Test-Path -Path """$expandedPath""" -PathType Leaf)) { $localizedYes = 'Y' <# Default 'Yes' flag (fallback) #>; try { $choiceOutput = cmd /c """choice <nul 2>nul"""; if ($choiceOutput -and $choiceOutput.Length -ge 2) { $localizedYes = $choiceOutput[1]; } else { Write-Warning """Failed to determine localized 'Yes' character. Output: `"""$choiceOutput`""""""; }; } catch { Write-Warning """Failed to determine localized 'Yes' character. Error: $_"""; }; $takeOwnershipCommand += """ /r /d $localizedYes"""; }; $takeOwnershipOutput = cmd /c """$takeOwnershipCommand 2>&1""" <# `stderr` message is misleading, e.g. """ERROR: The system cannot find the file specified.""" is not an error. #>; if ($LASTEXITCODE -eq 0) { Write-Host """Successfully took ownership of `"""$expandedPath`""" (using ``$takeOwnershipCommand``)."""; } else { Write-Host """Did not take ownership of `"""$expandedPath`""" using ``$takeOwnershipCommand``, status code: $LASTEXITCODE, message: $takeOwnershipOutput."""; <# Do not write as error or warning, because this can be due to missing path, it's handled in next command. #>; <# `takeown` exits with status code `1`, making it hard to handle missing path here. #>; }; Write-Host """Granting permissions for `"""$expandedPath`"""."""; $adminSid = New-Object System.Security.Principal.SecurityIdentifier 'S-1-5-32-544'; $adminAccount = $adminSid.Translate([System.Security.Principal.NTAccount]); $adminAccountName = $adminAccount.Value; $grantPermissionsCommand = """icacls `"""$cmdPath`""" /grant `"""$($adminAccountName):F`""" /t"""; $icaclsOutput = cmd /c """$grantPermissionsCommand"""; if ($LASTEXITCODE -eq 3) { Write-Host """Skipping, no items available for deletion according to: ``$grantPermissionsCommand``."""; exit 0; } elseif ($LASTEXITCODE -ne 0) { Write-Host """Take ownership message:`n$takeOwnershipOutput"""; Write-Host """Grant permissions:`n$icaclsOutput"""; Write-Warning """Failed to assign permissions for `"""$expandedPath`""" using ``$grantPermissionsCommand``, status code: $LASTEXITCODE."""; } else { $fileStats = $icaclsOutput | ForEach-Object { $_ -match '\d+' | Out-Null; $matches[0] } | Where-Object { $_ -ne $null } | ForEach-Object { [int]$_ }; if ($fileStats.Count -gt 0 -and ($fileStats | ForEach-Object { $_ -eq 0 } | Where-Object { $_ -eq $false }).Count -eq 0) { Write-Host """Skipping, no items available for deletion according to: ``$grantPermissionsCommand``."""; exit 0; } else { Write-Host """Successfully granted permissions for `"""$expandedPath`""" (using ``$grantPermissionsCommand``)."""; }; }; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2348
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "choice <nul 2>nul"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3032
              • C:\Windows\system32\choice.exe
                choice
                5⤵
                  PID:2980

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Fuk OneDrive Files\OneDrive.bat

          Filesize

          29KB

          MD5

          ee9e90614c8503913f36e9c8403df858

          SHA1

          426f0a41f3e7aea087a25e2ea98134c2ca40c719

          SHA256

          aab2dc2fb0b4452d4fc436bfa8c515704db6e29556dde55f4d9b390041740bb9

          SHA512

          9bf39ecd21132e48b6a977331aabc83337d439a1e33ce1ee30cd785c1b84b14994d0543d02dc180bdf042b513284ba8e4f1870f5b2ff88c1ed6247a60cdb1653

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          c60c6429ce1bacb4c995a7753f479782

          SHA1

          bad59d3e106b4a84049b630155ab1805cce568e4

          SHA256

          7cd7dfd05e3cfd5532f1db22a62dc668022647ad71beaaaf7672f489e2d8abec

          SHA512

          2637228cc41d7c38ae21e266949e2ba306e84a07649f027bc7adbfad1c18cbed183e30bf24b24fb194123c90f09d7c138b70a985cffc9552316969a7f35afbee

        • memory/2904-27-0x000000001B710000-0x000000001B9F2000-memory.dmp

          Filesize

          2.9MB

        • memory/2904-28-0x00000000027A0000-0x00000000027A8000-memory.dmp

          Filesize

          32KB

        • memory/2916-20-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

          Filesize

          2.9MB

        • memory/2916-21-0x0000000001D70000-0x0000000001D78000-memory.dmp

          Filesize

          32KB