Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-10-2024 23:13
General
-
Target
SkyDriveSetup.exe
-
Size
4.9MB
-
MD5
6961f3aec7f861c65091b8fb35086561
-
SHA1
e3b0fb8d929898ad342002afa28cc265194efe90
-
SHA256
cc9d7f28a00c0782658cfa90cfa69baebbb056d1838011f30782d2e96e2979fb
-
SHA512
e0fb908d916647e0297e272ec1428f6b70e4538bfdc2e8a99f45308e3d73165661a0bc3ef1425e6e8ad3da3e321bea9f5a4e10dc4434aeb4d0addf34027464bb
-
SSDEEP
98304:2qfhtV37w74C0CJmzevREdhOXQTFB74unJSqqgw3LFkkEGr3ra:JfXVrw7RRE2gTgunJSYw3LiWra
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 20 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SkyDriveSetup.exe"C:\Users\Admin\AppData\Local\Temp\SkyDriveSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SkyDriveSetup.exe"C:\Users\Admin\AppData\Local\Temp\SkyDriveSetup.exe" C:\Users\Admin\AppData\Local\Temp\SkyDriveSetup.exe /permachine /silent /childprocess /cusid:S-1-5-21-3063565911-2056067323-3330884624-10002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\SkyDriveSetup.exeC:\Users\Admin\AppData\Local\Temp\SkyDriveSetup.exe /peruser /childprocess2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\SkyDrive\16.4.4111.0525\SkyDriveConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\SkyDrive\16.4.4111.0525\SkyDriveConfig.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe"C:\Users\Admin\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD5f3738a46712623c6ddd0a8dab470fa27
SHA1b65914c2b4b000ad464859d510aca3fd37f5ad20
SHA256267cf817f247e7c399e7bc0ee5ca54bce3c88885f046da7e0f177a4c3ddba347
SHA5122c23395a185ea3f28edcc4109c59da3a4bb0e9f6d95d5b0abb9218bb72ad95a30d3b2361f3429586c42b92c550c9593ddcebf813426cb12796301670cd247087
-
Filesize
342B
MD582623dfc9d1185c2dd094a788f25a6f2
SHA1be1f0edcb23f6dfd26cf602f9227e12ad273798a
SHA256a200cf199da30e242e13c0b58c4bc0c27fa8ef638812bb0cfb8b6197b8b8211b
SHA512a5641a7209863bf31c76d578420633a5c647b4075bcff988d264d366ba06c45b2b269b31abd8d9baff1368b46952c69e854542c5b9a6ddee4fbb38647ffd865d
-
Filesize
342B
MD514e7b2786d76acc3be4b47fa18b7653d
SHA12fcb721d03ee5d2cb07b5766893d79fa06a6fa95
SHA256ba0614a1b7c584630fcfa409001e7fc6a2ff21637f191887b686755cf1a18cae
SHA5122bac96374572f18335d2cddc91a4c8c494655e9626bc1ec7f6cfae162367001dd49025df0462b6e148426a06d83543ea8f79061ec2d239600b2684c775cc7a01
-
Filesize
342B
MD5fd26a78c08c760b3134735de58401b11
SHA1c12931d8a896c0b794246d70a0a746599363f21b
SHA2565c6e15489cda149a8e2965d53e10b80c5c4c038e81749c0773c447e880578d0a
SHA51286453d7f25d6ff83729d74113bcbc61c5527a9b0b925ea93bdb40867669227088cba5907894ff2e0509f870ab1e2a14bfabb039c3d7960beab8bb9aea736ad03
-
Filesize
342B
MD5cdc4617b2751a31bcfb1a737b029ee24
SHA1d21dcb98d36bc5d2713190c0d1f14fadacfda9c0
SHA2560c35d2d6a9198a7315e14e5ddd1dcb3e8a0bdb8651be9053cfe9212a3055c8b1
SHA512709cb8943307eecf997a0558a5e0c0a8016c3984b2c2b0c89807f23bbff637dfb31c9e8446b1cb45e7dbd42d910027bf74b72cc3c41423251b7a2260fd20cefb
-
Filesize
342B
MD58a81ee1c7a322ed42237857f0c97376f
SHA19c3954849aafbc9979f55e8e346897222ecd1e65
SHA256374b30e15d7a2662a39b77fe1e31bb8e4a954b4bbed588d3a4a201357be95241
SHA512749b63401326442e67ec6633dc14510bdf29f0465f087d775a33908779c01bdbcd81019c91c4c206e14fe5ab0208a0ff9b24a5f72f55a276cb485a6f9f5c688c
-
Filesize
342B
MD5254a3905ce359f847a536fb930b4282a
SHA1cae00a8758252bda6519c184e21820e3ac1784e8
SHA256c4417a8a618e3ca3f9544b743cd2f0e35ef775af9832a690fec25c6a76b626f7
SHA5127b93fd17b4b7ee74516a7bc29f3c2286598d3c99bb4023030ecfa52d3f91f3dc57c3979d11522adcf60dbaeb219b5725a6346467fce2c1d9c9454dbb3eb9be0a
-
Filesize
342B
MD576812053741f1e170fab414b3e5d5dcd
SHA160a2066059780fd76a2a87c5b501bb7770b58fba
SHA256fd7298153cc3f95ab42d25512f807891f0a37dde5a4622fc58bdd42b62661b21
SHA512c686b2c0e07f3811f6dd4a906fa071a9fb95461af101371afca5abe19e1104fb338c4a92816eae9058d4b96ad183aed73e94e0d70d60fd8dae5c732a619454a9
-
Filesize
342B
MD5bec701dd53294f17aed2bdb67fc529aa
SHA10686c1c40fbd0040bd1cace3f4f4983801a05139
SHA2569ee18192ca49fdbb197320c9de397e99f0b82e9d87adca73a6fe522257897b4c
SHA512dec0a2b13afb33cbf7e03bc10fea46daf03321a2d0cb7da1695a677dfde46593ac42a5ae5dd7b6004980402620af57ab3c6d85738c0c03c77aa278b44fa96824
-
Filesize
342B
MD5e23a14f1d6bcdb86a09f93b7d235abc4
SHA14801ccaa7e8558baa6ec93c21b6e3a698a973c32
SHA25641e6d551aa1dc05b079130900f677f31224abc97963b5755eda50c6fa0856199
SHA512d39d7934a584ecc3d4103c0d13f1721a8847564502d0f1d9e4d2181850f5e04934f170c1bd99edafbe46a8b0dc1e346efa21542e0ce204b467c830905b81e0cd
-
Filesize
486KB
MD5ca8caf812a9c267599f1ce883f16550f
SHA11fad05ba938095aa21aaeaa89fb7ef7ac378209f
SHA2560b7347d9a5900c9d06335abeee9f14fbe01dce01d82c2a6a7f803401ca32a09c
SHA512cf0c5bfa75c07fa4db909fabad5ce24e91011cb0487c5c02e8428b41dc3bc955dc2562c51a362c47c0d4821c3e7378a80f9cbee381df12e487252cd19d388c6a
-
Filesize
838KB
MD53b271a85ee735442eb34a0526862acdb
SHA11c041547955f207137432dd5ae8b58a50ac90ee7
SHA2568b9d8f5194ed37ec144bc6f1292687bac4e87c4e00c42d5a9accb5f77e571575
SHA512897e222479e5f9fba4f68e59d2656605862a0323f1160a54dedfcc7fef5d950928ccd3cf96429ec11fd57e89fe21ac93cd64603efa4c6b0c5533f5d406b3ed42
-
Filesize
885KB
MD5606228a21d8ff8350feb26a5e2b106b0
SHA1b96329cc3cffbed8cdbac69ae8ad65902ff2b1f2
SHA256666eec7449ea081f967462b105b460327ffffd96609c26c60c6b5033b802eaa9
SHA512564841f2df6dc3ede506224c15804cf69741ce5ba8daf2bbfdb50f0bbc25594ba93597de85fac186b17ed21ad1c15219dd6c9c12bed1308528a0b0a1000aa475
-
Filesize
28KB
MD506bb2a6d881371d2ed1c603d2b1e48e5
SHA16493f64fedd2fa5a712377535dcc096a75b99f64
SHA2569bd2bcb6b0c55a3cc87945e867a8ba0b0c5c30f7811c951246446642fa415fdf
SHA5122175b064b896f8a6a075f3f7fd12ef1a1a5859f6336c89d10ee471d495c6251371b6a027bd98e9c7337281490f62bd580b78d9fd15833291b0b8fade8f5c1fa0
-
Filesize
427KB
MD52d8360363b8f6fdcca299d2c22dca771
SHA1744fe047f366e98f078fc9bc84c3c276ddec5c75
SHA256fd3f29babc567fe239cfadf14170ddb0f31f1735123ebfee267a7aa0132477e9
SHA51208d2f7d5d4ab8e4f1bb39f5a74aa4a6613cd4f030b2443522022b5c735deb689f14f3fa2e93dce4eff6b0e3853f0264b3c0d3ddb23bf89688c547ddcb2520e65
-
Filesize
289KB
MD54f7c80e5a420e47b584055eb1ac61562
SHA1f54a90b305dbcf051c8fccd572bd7a4ec2539414
SHA25603a7569d09f443e19074d8f8e7fd34dd386d95421c1ff82925540a403b0c45da
SHA512913aa669b299dccc9add2bf1244cc950b5b0d331f5a7a493f49c43c0be24709543cb64d9abe49e83328cd99d96c1ce410fc0d680d2d243142d735c01faba59aa
-
Filesize
1.9MB
MD5d7efb91b4c82161855e72be5b344e5e7
SHA1deb88b421b147d2181616b3e704536499d2b038c
SHA2561ebb38890123790c3375c9990474ba81da2b68e90f61fd2c8f4356a1d3782321
SHA51212a21cb2af0f6a8b90dcd6349aeb54ff36ea69119dc037a85c16a522ebb9dac0c4592308acf8832df4a4ac1bfb25f8d585ff75bf9dc5ab25fe79dd71e54fe934
-
Filesize
39KB
MD5462ee1e45428317bb2b52445742012c9
SHA13ca3c44963eaad900b467a27879085f5db7f20fa
SHA2561840e21bc882f7b3c9da3211f4bd69e56a1d9b360660723ddb553ceb227d6dda
SHA512773a9f0db154a040850fbf9fd7699b76a013af757b10df52dc7bb9bff6a5ca75c866296a7854479cb2689d8d11c9678383a4d0b604942667a423120458b5d6ea
-
Filesize
1.9MB
MD58a36fb420dc8c1d9a41bc803ab06e273
SHA1ca0423ac0d4a3380ec9b844ad69421bc07431518
SHA25698e6897e79adc2faac4aef576a320636087e1b80f28960a97642d64faaac3468
SHA512ddc7b5fd3c03398dcd514a5d1eb1ec65f14deef1c545f522ebd16fcd482e306fdb67c88d19d4029e2b9dc7ba6644a3ae77a6e2c2e58ee1dd3016bcc8f23c3108
-
Filesize
511KB
MD524cda4e1d91100810cf0d42f8d8c6534
SHA12a1268c85814eb4f87b5805dc3eee3c75129dfe9
SHA2569c47367bf8fef455b252bc83e19020eb41372271942f840221e4e49d90b1e13d
SHA512389c8bfe3d22f2816d7edf22247eeb9065f73333100e570803202cba0b6e329871fe015ac992d52e25e04b944e86a3e57435d337d862992c67cbb35439c3dc5c
-
Filesize
475KB
MD53c5dae00549cb0c864a1a2a2495f31dd
SHA18c4e99a300a1c82ca55e32b59fd751b7572229aa
SHA2562cf8de735b2e4257ff0460f94d3455dd284350a9cfdc7689aff793403c4146a8
SHA512d7bdabfbf2b044ce2907deec97e4c5255d5454c3769b69a09724613ab089440d73b2d01e87831a9de48014c345b59dfaa6e5547c92d6dbedd6f3a2d564a12d13
-
Filesize
28KB
MD5eb5816e700351887eb38b60f13147952
SHA10adb402d5524a1ab7cd57b75ae2c062ff93bda4b
SHA25607eda6d034cecbdb55cb0a47a4368ac11d5e4cea56f4c6d96720a85afa5dfea1
SHA512474928f869f409480ba4b028a369f780033959dccb4d5ed7a7efa49a70add599d68093a3173ef6e6092a4cb78592d2356d4908d32b1be7e101e505836477dc84
-
Filesize
191KB
MD5d475bbd6fef8db2dde0da7ccfd2c9042
SHA180887bdb64335762a3b1d78f7365c4ee9cfaeab5
SHA2568e9d77a216d8dd2be2b304e60edf85ce825309e67262fcff1891aede63909599
SHA512f760e02d4d336ac384a0125291b9deac88c24f457271be686b6d817f01ea046d286c73deddbf0476dcc2ade3b3f5329563abd8f2f1e40aee817fee1e3766d008
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
4.0MB
MD577adb580cb498135d0a82cb549188b63
SHA13f34333dee14db56ef9e26b068aa910098942f4d
SHA256bbef38f8e366fbe02d5e32a221dcec0aed2507a7b69c7bd862aa11c1cc754e49
SHA5128c71d984e7efd06aeac65e35e7ee9ac5f6373b8be56447fe88e328ae84a301d74f7d2231efc9ca22801dfed29747ae69ffdc86f8d02aee019a9b0718cbc408d1
-
Filesize
96B
MD56b5a8d85f341857daef9d7e22fca7070
SHA1e5f57f966bb2a42af24c0075757e16df4c6c6a3a
SHA256783d72de685889ee953c109f7b82c92a5e8484c18fa65766513b9b805436ad7a
SHA5123ecfaea6e48158fc6ebfc4f6d8903d5bdda646a2cf39d300fbb82deead41932146765ade9ebbd6f12ef9f49f519f31409e3020312b55efea0312f9b680d00be3
-
Filesize
892KB
MD5d1b88551772c865d673a9e133f3f2bf3
SHA1f3a1bf1c52bc956393367596059a53e73cb1c6ef
SHA256d78959317fbdd26f39e9b7f716a261c1913aaeb674b030aab88a04faa43732ca
SHA512a6f310211c7e3474148cd448e375c20b847a63f0f2627438b165b0e0b570dbcd2d72612182f6de6a68973bec655f8259e79e0cf84070ff05447668aeeccda540
-
Filesize
64KB
MD518c8c55eb81f2ed8111dbcf5f404e991
SHA12e98030db805513f25f2cc735d4a3c2cd0e3ee08
SHA25607b12c599f712e28cac3394ecfeb5c3490334be181a0d30019687a8b626023b9
SHA512bd196777879778b67235bdeae4ce6bcb0522f9aebf90ca5808d05f65340ee6355ac8f88d12a7ca3d41955b34abcae4a34b128f4987fe7519aeafe8429c7d8725
-
Filesize
29KB
MD57ad6181041e79f86c982ad8998c1cccf
SHA1cb3cb2cbedfae2062994970ee2cbe9bf52c1e439
SHA2563a13368ac6c2028a75edb650097f4e573f052c4b32dbfaab7e906ac815aa0586
SHA512a2a50fb65d742b97459be1f5f1f2125ed63c39653a6e6943280ab7188897755841d7df050884378959cbaa74cf0666b86d105dd21718f72e617dd6738596bdf2