Overview
overview
10Static
static
5Oneclick-main.zip
windows7-x64
1Oneclick-main.zip
windows10-2004-x64
1Oneclick-m...MD.bat
windows7-x64
1Oneclick-m...MD.bat
windows10-2004-x64
1OneclickTo...MD.bat
windows7-x64
1OneclickTo...MD.bat
windows10-2004-x64
1OneclickTo...at.exe
windows7-x64
8OneclickTo...at.exe
windows10-2004-x64
8OneclickTo...ol.exe
windows7-x64
10OneclickTo...ol.exe
windows10-2004-x64
5OneclickTo...LG.exe
windows7-x64
1OneclickTo...LG.exe
windows10-2004-x64
1OneclickTo...10.exe
windows7-x64
1OneclickTo...10.exe
windows10-2004-x64
1OneclickTo...ca.bat
windows7-x64
1OneclickTo...ca.bat
windows10-2004-x64
1OneclickTo...nd.bat
windows7-x64
4OneclickTo...nd.bat
windows10-2004-x64
4OneclickTo...on.exe
windows7-x64
1OneclickTo...on.exe
windows10-2004-x64
1Oneclick-m...me.xml
windows7-x64
3Oneclick-m...me.xml
windows10-2004-x64
1Oneclick-m...ca.bat
windows7-x64
1Oneclick-m...ca.bat
windows10-2004-x64
1Oneclick-m...nd.bat
windows7-x64
4Oneclick-m...nd.bat
windows10-2004-x64
4Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
21-01-2025 18:57
Behavioral task
behavioral1
Sample
Oneclick-main.zip
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Oneclick-main.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Oneclick-main/Downloads/AMD.bat
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
Oneclick-main/Downloads/AMD.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
OneclickTools/Amd/AMD.bat
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
OneclickTools/Amd/AMD.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
OneclickTools/DPC Checker/dpclat.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
OneclickTools/DPC Checker/dpclat.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
OneclickTools/Dcontrol/dControl.exe
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
OneclickTools/Dcontrol/dControl.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
OneclickTools/NSudo/NSudoLG.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
OneclickTools/NSudo/NSudoLG.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
OneclickTools/OOshutup10/OOSU10.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
OneclickTools/OOshutup10/OOSU10.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
OneclickTools/Orca/Orca.bat
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
OneclickTools/Orca/Orca.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
OneclickTools/Sound/Sound.bat
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
OneclickTools/Sound/Sound.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
OneclickTools/Timer Resolution/SetTimerResolution.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
OneclickTools/Timer Resolution/SetTimerResolution.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Oneclick-main/Downloads/OpenShellTheme.xml
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
Oneclick-main/Downloads/OpenShellTheme.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Oneclick-main/Downloads/Orca.bat
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Oneclick-main/Downloads/Orca.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Oneclick-main/Downloads/Sound.bat
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Oneclick-main/Downloads/Sound.bat
Resource
win10v2004-20241007-en
General
-
Target
Oneclick-main/Downloads/AMD.bat
-
Size
364B
-
MD5
4f432879f0b02c48301741a208cd1309
-
SHA1
12f08180a3e9479e3ede245aa7904b1c85a61d37
-
SHA256
0617bbd07889ed453dffaf7ccefd7bbf1f092ca6dcb1d9d354efab231f8d385f
-
SHA512
9971d9076b038cd453e70b90cd408802a7ca4279ce1fc01395dcd9a341bca3d21b7d37491a1525935456816a20aba889586c6594da2bdcb44bba601627e1eedf
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2512 1988 cmd.exe 31 PID 1988 wrote to memory of 2512 1988 cmd.exe 31 PID 1988 wrote to memory of 2512 1988 cmd.exe 31 PID 1988 wrote to memory of 2504 1988 cmd.exe 32 PID 1988 wrote to memory of 2504 1988 cmd.exe 32 PID 1988 wrote to memory of 2504 1988 cmd.exe 32 PID 1988 wrote to memory of 3000 1988 cmd.exe 33 PID 1988 wrote to memory of 3000 1988 cmd.exe 33 PID 1988 wrote to memory of 3000 1988 cmd.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-main\Downloads\AMD.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\system32\reg.exereg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AMD Crash Defender Service" /v "Start" /t REG_DWORD /d "4" /f2⤵PID:2512
-
-
C:\Windows\system32\reg.exereg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AMD External Events Utility" /v "Start" /t REG_DWORD /d "4" /f2⤵PID:2504
-
-
C:\Windows\system32\reg.exereg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AUEPLauncher" /v "Start" /t REG_DWORD /d "4" /f2⤵PID:3000
-