833b709b93b80919dc06d8b0619de8919df283060dd9fdb9da6bd4d9b778ca7a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.7MB
Sample260804-t167gsdf65
SHA256 833b709b93b80919dc06d8b0619de8919df283060dd9fdb9da6bd4d9b778ca7a
MD5 2bb1b024135ef7b0af3141d389530d82
SHA1 96a837eee8332c0d27efcad1537000001e5aa86d
SHA512 fab1098c7bd59975d36b89a5ab3baf98eb8485b081a77933dbe98075e5d861de0594dffead070dcd542d3768b04746dbffc83ce2059f9c229937bcfa408b92e2
SSDEEP 98304:RBJzPZwQwRYTkDTysBKwbCym8bILHGWCv5IjjPmg9:RvvpYTysBhegv5IjjPmg9
TLSH
T1F7068D17E2A350ECC12BC17D4657A772A530B868C534FE7F5A90DB312E31E50AB6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4040	OneDriveSync.exe
4352	OneDriveSync.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneDrive\\OneDriveSync.exe\""	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneDrive\\OneDriveSync.exe\""	OneDriveSync.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneDrive\\OneDriveSync.exe\""	OneDriveSync.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5032	schtasks.exe
568	schtasks.exe
5044	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3608	file.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 568	3608	file.exe	86
PID 4040 wrote to memory of 5044	4040	OneDriveSync.exe	92
PID 4352 wrote to memory of 5032	4352	OneDriveSync.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "OneDriveSync" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:568

C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "OneDriveSync" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5044

C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "OneDriveSync" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveSync.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe
Size 3.7MB
SHA256 833b709b93b80919dc06d8b0619de8919df283060dd9fdb9da6bd4d9b778ca7a
MD5 2bb1b024135ef7b0af3141d389530d82
SHA1 96a837eee8332c0d27efcad1537000001e5aa86d
SHA512 fab1098c7bd59975d36b89a5ab3baf98eb8485b081a77933dbe98075e5d861de0594dffead070dcd542d3768b04746dbffc83ce2059f9c229937bcfa408b92e2
SSDEEP 98304:RBJzPZwQwRYTkDTysBKwbCym8bILHGWCv5IjjPmg9:RvvpYTysBhegv5IjjPmg9
TLSH
T1F7068D17E2A350ECC12BC17D4657A772A530B868C534FE7F5A90DB312E31E50AB6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads