Overview

overview

10

Static

static

1

Oneclick-V7.0.bat

windows7-x64

10

Oneclick-V7.0.bat

windows10-2004-x64

3

Resubmissions

27/03/2025, 09:39

250327-lm3m5sslv4 10

27/03/2025, 07:44

250327-jkzscsyxgx 10

27/03/2025, 04:15

250327-evp9fsyrx2 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Oneclick-V7.0.bat

  • Size

    201KB

  • Sample

    250327-evp9fsyrx2

  • MD5

    c8e2a0c12285b709fc839a4c7cbd6e1a

  • SHA1

    cae0726adbd932745e4e4db37c82c5839f632efa

  • SHA256

    67b5e27f2726692662d746c555d403d35293c6bf6eb0f5d8beaba417872a5d9c

  • SHA512

    a99ca57c12ab00bd160747812ef71518cff0db5b8962b6b21694f0e9d7682830642290c8cbef7a83368ea7b302730e3d0930761edae15fca51247ee8f14bdc18

  • SSDEEP

    1536:8PSPKdigMQgPTjIV4QJ8STaggyjH/nvfHH4pXfCWOBEzCLiD15ToSmcj/DB:MfjvvfeTTmcTDB

Score
10/10
defense_evasionevasionexecutionpersistenceprivilege_escalationransomwaretrojan

Malware Config

Targets

    • Target

      Oneclick-V7.0.bat

    • Size

      201KB

    • MD5

      c8e2a0c12285b709fc839a4c7cbd6e1a

    • SHA1

      cae0726adbd932745e4e4db37c82c5839f632efa

    • SHA256

      67b5e27f2726692662d746c555d403d35293c6bf6eb0f5d8beaba417872a5d9c

    • SHA512

      a99ca57c12ab00bd160747812ef71518cff0db5b8962b6b21694f0e9d7682830642290c8cbef7a83368ea7b302730e3d0930761edae15fca51247ee8f14bdc18

    • SSDEEP

      1536:8PSPKdigMQgPTjIV4QJ8STaggyjH/nvfHH4pXfCWOBEzCLiD15ToSmcj/DB:MfjvvfeTTmcTDB

    Score
    10/10
    defense_evasionevasionexecutionpersistenceprivilege_escalationransomwaretrojan

    • Modifies visibility of file extensions in Explorer

      defense_evasion

    • UAC bypass

      defense_evasiontrojan

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

2
T1059.001

Persistence

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Power Settings

1
T1653

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

2
T1564

Hidden Files and Directories

1
T1564.001

Ignore Process Interrupts

1
T1564.011

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

4
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks