Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2024 06:26

General

  • Target

    (Full Package) One Click OPT Ver - 6.7/1- One Click OPT/1- Oneclick V6.7 (Ultimate Performance)/Oneclick V6.7.bat

  • Size

    202KB

  • MD5

    4acd7d1e7294d4ab4e9db8977d5135e4

  • SHA1

    07c5474fcd09ff5843df3f776d665dcf0eef4284

  • SHA256

    b66cd5d6a39c016d0c39e270bed5cc8dbeb1920b3f827d78bc9d36a4a1e3f84f

  • SHA512

    d45a1a26440116df843fbef3bc86a727267cc687f59f9062ef9a66c08a3581c9903d568303d5700dacaad7f5e398601211841328e1784989822d644a426b2d36

  • SSDEEP

    1536:97SPKdigMQgPTjIV4wJzSwTgfGH/ngfHH4pX/paZSiDk2IWOmXmomk:9nnHgvOh4KmXmomk

Score
4/10

Malware Config

Signatures

  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Delays execution with timeout.exe 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\(Full Package) One Click OPT Ver - 6.7\1- One Click OPT\1- Oneclick V6.7 (Ultimate Performance)\Oneclick V6.7.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Windows\system32\fltMC.exe
      fltmc
      2⤵
        PID:1880
      • C:\Windows\system32\sc.exe
        sc query "WinDefend"
        2⤵
        • Launches sc.exe
        PID:2264
      • C:\Windows\system32\find.exe
        find "STATE"
        2⤵
          PID:2272
        • C:\Windows\system32\find.exe
          find "RUNNING"
          2⤵
            PID:2688
          • C:\Windows\system32\sc.exe
            sc qc "TrustedInstaller"
            2⤵
            • Launches sc.exe
            PID:2696
          • C:\Windows\system32\find.exe
            find "START_TYPE"
            2⤵
              PID:2752
            • C:\Windows\system32\find.exe
              find "DISABLED"
              2⤵
                PID:2776
              • C:\Windows\system32\sc.exe
                sc config TrustedInstaller start=auto
                2⤵
                • Launches sc.exe
                PID:2756
              • C:\Windows\system32\net.exe
                net start TrustedInstaller
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2956
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 start TrustedInstaller
                  3⤵
                    PID:2700
                • C:\Windows\system32\timeout.exe
                  timeout 1
                  2⤵
                  • Delays execution with timeout.exe
                  PID:2692
                • C:\Windows\system32\chcp.com
                  chcp 65001
                  2⤵
                    PID:2948
                  • C:\Windows\system32\timeout.exe
                    timeout 2
                    2⤵
                    • Delays execution with timeout.exe
                    PID:2680
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    2⤵
                      PID:2572
                    • C:\Windows\system32\chcp.com
                      chcp 437
                      2⤵
                        PID:3064
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "Write-Host 'Recommended!' -ForegroundColor White -BackgroundColor Red"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2684

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/2684-4-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/2684-5-0x0000000001E80000-0x0000000001E88000-memory.dmp

                      Filesize

                      32KB