3b1189ee57ef95b9164a3908f33115d58e34edf0fc856ae256f7ec1910d86f21

Submit
Reports

Overview

overview

Static

static

(Full Pack....7.bat

windows7-x64

(Full Pack....7.bat

windows10-2004-x64

(Full Pack...V3.bat

windows7-x64

(Full Pack...V3.bat

windows10-2004-x64

(Full Pack...V2.bat

windows7-x64

(Full Pack...V2.bat

windows10-2004-x64

(Full Pack....1.bat

windows7-x64

(Full Pack....1.bat

windows10-2004-x64

(Full Pack...fi.bat

windows7-x64

(Full Pack...fi.bat

windows10-2004-x64

(Full Pack...ol.bat

windows7-x64

(Full Pack...ol.bat

windows10-2004-x64

(Full Pack...er.bat

windows7-x64

(Full Pack...er.bat

windows10-2004-x64

(Full Pack...ry.bat

windows7-x64

(Full Pack...ry.bat

windows10-2004-x64

(Full Pack...ix.bat

windows7-x64

(Full Pack...ix.bat

windows10-2004-x64

(Full Pack...er.bat

windows7-x64

(Full Pack...er.bat

windows10-2004-x64

(Full Pack...up.exe

windows7-x64

(Full Pack...up.exe

windows10-2004-x64

(Full Pack...er.ps1

windows7-x64

(Full Pack...er.ps1

windows10-2004-x64

(Full Pack...ad.url

windows7-x64

(Full Pack...ad.url

windows10-2004-x64

(Full Pack...nt.lnk

windows7-x64

(Full Pack...nt.lnk

windows10-2004-x64

(Full Pack...re.lnk

windows7-x64

(Full Pack...re.lnk

windows10-2004-x64

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 06:26

Sharing

Copy URL

Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

(Full Package) One Click OPT Ver - 6.7/1- One Click OPT/1- Oneclick V6.7 (Ultimate Performance)/Oneclick V6.7.bat

Resource

win7-20240729-en

execution

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

(Full Package) One Click OPT Ver - 6.7/1- One Click OPT/1- Oneclick V6.7 (Ultimate Performance)/Oneclick V6.7.bat

Resource

win10v2004-20241007-en

execution

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral3

Sample

(Full Package) One Click OPT Ver - 6.7/1- One Click OPT/2- Orca V3/Orca V3.bat

Resource

win7-20240903-en

evasion execution

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral4

Sample

(Full Package) One Click OPT Ver - 6.7/1- One Click OPT/2- Orca V3/Orca V3.bat

Resource

win10v2004-20241007-en

defense_evasion discovery evasion execution exploit

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral5

Sample

(Full Package) One Click OPT Ver - 6.7/1- One Click OPT/3- OrcaLIte V2/OrcaLiteV2.bat

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

(Full Package) One Click OPT Ver - 6.7/1- One Click OPT/3- OrcaLIte V2/OrcaLiteV2.bat

Resource

win10v2004-20241007-en

defense_evasion discovery exploit

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral7

Sample

(Full Package) One Click OPT Ver - 6.7/1- One Click OPT/4 - Process Destroyer V2.1/Process Destroyer 2.1.bat

Resource

win7-20240903-en

defense_evasion evasion

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral8

Sample

(Full Package) One Click OPT Ver - 6.7/1- One Click OPT/4 - Process Destroyer V2.1/Process Destroyer 2.1.bat

Resource

win10v2004-20241007-en

defense_evasion evasion

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral9

Sample

(Full Package) One Click OPT Ver - 6.7/2- Fixer-Help/1- Wifi & Bluetooth Fixer/1- Turn On Wifi.bat

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

(Full Package) One Click OPT Ver - 6.7/2- Fixer-Help/1- Wifi & Bluetooth Fixer/1- Turn On Wifi.bat

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

(Full Package) One Click OPT Ver - 6.7/2- Fixer-Help/1- Wifi & Bluetooth Fixer/2- Windows Service Control.bat

Resource

win7-20240729-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

(Full Package) One Click OPT Ver - 6.7/2- Fixer-Help/1- Wifi & Bluetooth Fixer/2- Windows Service Control.bat

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

(Full Package) One Click OPT Ver - 6.7/2- Fixer-Help/2- Xbox Help/1- Xbox Service Enabler.bat

Resource

win7-20240903-en

evasion execution

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral14

Sample

(Full Package) One Click OPT Ver - 6.7/2- Fixer-Help/2- Xbox Help/1- Xbox Service Enabler.bat

Resource

win10v2004-20241007-en

evasion execution

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral15

Sample

(Full Package) One Click OPT Ver - 6.7/2- Fixer-Help/3- Clipboard & Snipping Tool Fix/2- Enable Clipboard History.bat

Resource

win7-20240708-en

discovery

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral16

Sample

(Full Package) One Click OPT Ver - 6.7/2- Fixer-Help/3- Clipboard & Snipping Tool Fix/2- Enable Clipboard History.bat

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

(Full Package) One Click OPT Ver - 6.7/2- Fixer-Help/4- Windows Security/2- Cmd Fix.bat

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

(Full Package) One Click OPT Ver - 6.7/2- Fixer-Help/4- Windows Security/2- Cmd Fix.bat

Resource

win10v2004-20241007-en

defense_evasion

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral19

Sample

(Full Package) One Click OPT Ver - 6.7/3- Browser/CTT App Installer.bat

Resource

win7-20241010-en

execution

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral20

Sample

(Full Package) One Click OPT Ver - 6.7/3- Browser/CTT App Installer.bat

Resource

win10v2004-20241007-en

execution

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral21

Sample

(Full Package) One Click OPT Ver - 6.7/3- Browser/ChromeSetup.exe

Resource

win7-20240903-en

discovery persistence privilege_escalation spyware stealer

windows7-x64

21 signatures

150 seconds

Behavioral task

behavioral22

Sample

(Full Package) One Click OPT Ver - 6.7/3- Browser/ChromeSetup.exe

Resource

win10v2004-20241007-en

discovery persistence privilege_escalation spyware stealer

windows10-2004-x64

23 signatures

150 seconds

Behavioral task

behavioral23

Sample

(Full Package) One Click OPT Ver - 6.7/3- Browser/Powershell Chrome Installer.ps1

Resource

win7-20240903-en

execution

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

(Full Package) One Click OPT Ver - 6.7/3- Browser/Powershell Chrome Installer.ps1

Resource

win10v2004-20241007-en

discovery evasion execution persistence privilege_escalation trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral25

Sample

(Full Package) One Click OPT Ver - 6.7/4- Nsudo/Nsudo Download.url

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

(Full Package) One Click OPT Ver - 6.7/4- Nsudo/Nsudo Download.url

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

(Full Package) One Click OPT Ver - 6.7/Defragment.lnk

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral28

Sample

(Full Package) One Click OPT Ver - 6.7/Defragment.lnk

Resource

win10v2004-20241007-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral29

Sample

(Full Package) One Click OPT Ver - 6.7/System Restore.lnk

Resource

win7-20240708-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral30

Sample

(Full Package) One Click OPT Ver - 6.7/System Restore.lnk

Resource

win10v2004-20241007-en

windows10-2004-x64

5 signatures

150 seconds

Report Analysis Logs

General

Target

(Full Package) One Click OPT Ver - 6.7/Defragment.lnk
Size

2KB
MD5

6c641c68dc0ee3f1f976edf0ee45fb28
SHA1

4cf48563afa0f6eedbbe1f9858bc53f8e58a4667
SHA256

307c3aab509575221348e3ce86db6ffe829f26267748af662ee164815ea441ad
SHA512

38958301b98d82b0d26ef588e872a43fb3063df5e61a05a68e986d897caf474703dd65027c9e17635ac58a4790a1505f9d8681fa44ab332eb47c7f4f6577ccad

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2740	2788	cmd.exe	32
PID 2788 wrote to memory of 2740	2788	cmd.exe	32
PID 2788 wrote to memory of 2740	2788	cmd.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Processes

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\(Full Package) One Click OPT Ver - 6.7\Defragment.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\System32\dfrgui.exe
  "C:\Windows\System32\dfrgui.exe"
  2⤵
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads