Analysis
- user interaction
yes - max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
20/06/2026, 12:03
General
- Target OneClickRoot.exe
- Size 1012KB
- Sample260620-n736hsfz21
- SHA256 364cd6ae3ab10e8382560e7f07084f69eb5251a9564c0d60f23df7613a0619af
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OneClickRoot.exe"C:\Users\Admin\AppData\Local\Temp\OneClickRoot.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000508 0x00000000000005041⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/708-0-0x00007FFAB864F000-0x00007FFAB8650000-memory.dmp
memory/708-1-0x000001C5FA9C0000-0x000001C5FAAC2000-memory.dmp
memory/708-2-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-4-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-3-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-5-0x000001C5FC8E0000-0x000001C5FC90E000-memory.dmp
memory/708-6-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-7-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-8-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-9-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-10-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-11-0x000001C5FD270000-0x000001C5FD278000-memory.dmp
memory/708-12-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-16-0x000001C5FD280000-0x000001C5FD28E000-memory.dmp
memory/708-15-0x000001C5FFBA0000-0x000001C5FFBDE000-memory.dmp
memory/708-25-0x000001C5FFB80000-0x000001C5FFB92000-memory.dmp
memory/708-26-0x000001C5FFE00000-0x000001C5FFE3C000-memory.dmp
memory/708-28-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-33-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-34-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-36-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-37-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-42-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/708-43-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp