248e195707624862a4268cae02ff94c6b2cd8135afcb84324142249c494568bf

Reason

Machine shutdown

General

Target
Oneclick-V8.4.bat
Size 272KB
Sample260827-2ws33a1sds
SHA256 248e195707624862a4268cae02ff94c6b2cd8135afcb84324142249c494568bf
MD5 b3ea15bf4403b1a9e048e7908bac2db5
SHA1 46647b9ba5eed25a7a4e4d30bb15ca568dcbd7a3
SHA512 4f683bb901f0ac54c9f30624280449d0ab661517c68d7789c8ab7fd0002a5284876b97746f1c8701c8f1c2e2435d521f4461ab71f0b4e39a749f7a9710a2e100
SSDEEP 3072:tkz4FbQpKFfCxn2NqJpZxa2GHPjr3Nm6m:tkz4FbRFfCxn2NqJpZxa2GHPjr3Nzm
TLSH
T1D254C62574001A2541B79E6AC5775C42FB4112C3CB501AEAB4EFA0EC2FB751BEDBBAD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AutorunOneclickAfterRestart = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Oneclick-V8.4.bat\""	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com
10	raw.githubusercontent.com

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1908	sc.exe
4756	sc.exe
5884	sc.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5232	cmd.exe
5300	cmd.exe
944	cmd.exe
4592	cmd.exe
2296	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4908	timeout.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3224	shutdown.exe
Token: SeRemoteShutdownPrivilege	3224	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3504	LogonUI.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2580	2296	cmd.exe	90
PID 2296 wrote to memory of 5232	2296	cmd.exe	91
PID 5232 wrote to memory of 2444	5232	cmd.exe	92
PID 5232 wrote to memory of 952	5232	cmd.exe	93
PID 2296 wrote to memory of 5300	2296	cmd.exe	94
PID 5300 wrote to memory of 5876	5300	cmd.exe	95
PID 2296 wrote to memory of 2800	2296	cmd.exe	96
PID 2296 wrote to memory of 2420	2296	cmd.exe	97
PID 2296 wrote to memory of 1908	2296	cmd.exe	98
PID 2296 wrote to memory of 4896	2296	cmd.exe	99
PID 2296 wrote to memory of 4256	2296	cmd.exe	100
PID 2296 wrote to memory of 3952	2296	cmd.exe	101
PID 2296 wrote to memory of 4756	2296	cmd.exe	102
PID 2296 wrote to memory of 5476	2296	cmd.exe	103
PID 2296 wrote to memory of 2208	2296	cmd.exe	104
PID 2296 wrote to memory of 4908	2296	cmd.exe	105
PID 944 wrote to memory of 876	944	cmd.exe	110
PID 944 wrote to memory of 1340	944	cmd.exe	111
PID 4592 wrote to memory of 1352	4592	cmd.exe	113
PID 2296 wrote to memory of 3224	2296	cmd.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	2	curl/8.8.0
HTTP User-Agent header	10	curl/8.8.0

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-V8.4.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s -L https://raw.githubusercontent.com/QuakedK/Oneclick/main/Version.md | findstr /i "Latest_Version"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\system32\curl.exe
    curl -s -L https://raw.githubusercontent.com/QuakedK/Oneclick/main/Version.md
    3⤵
    PID:2444
- - C:\Windows\system32\findstr.exe
    findstr /i "Latest_Version"
    3⤵
    PID:952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
    3⤵
    PID:5876
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "GlobalTimerResolutionRequests" /t REG_DWORD /d "1" /f
  2⤵
  PID:2800
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64"
  2⤵
  PID:2420
- C:\Windows\system32\sc.exe
  sc query "ucpd"
  2⤵
  - Launches sc.exe
  PID:1908
- C:\Windows\system32\find.exe
  find "STATE"
  2⤵
  PID:4896
- C:\Windows\system32\find.exe
  find "RUNNING"
  2⤵
  PID:4256
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3952
- C:\Windows\system32\sc.exe
  sc config "ucpd" start=disabled
  2⤵
  - Launches sc.exe
  PID:4756
- C:\Windows\system32\schtasks.exe
  schtasks /change /disable /tn "\Microsoft\Windows\AppxDeploymentClient\UCPD velocity"
  2⤵
  PID:5476
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "AutorunOneclickAfterRestart" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Oneclick-V8.4.bat\"" /f
  2⤵
  - Adds Run key to start application
  PID:2208
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:4908
- C:\Windows\system32\shutdown.exe
  shutdown /r /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3224

C:\Windows\system32\fltMC.exe
fltmc
1⤵
PID:1524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c curl -s -L https://raw.githubusercontent.com/QuakedK/Oneclick/main/Version.md | findstr /i "Latest_Version"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\system32\curl.exe
  curl -s -L https://raw.githubusercontent.com/QuakedK/Oneclick/main/Version.md
  2⤵
  PID:876
- C:\Windows\system32\findstr.exe
  findstr /i "Latest_Version"
  2⤵
  PID:1340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
  2⤵
  PID:1352

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "GlobalTimerResolutionRequests" /t REG_DWORD /d "1" /f
1⤵
PID:1432

C:\Windows\system32\reg.exe
reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64"
1⤵
PID:580

C:\Windows\system32\sc.exe
sc query "ucpd"
1⤵
- Launches sc.exe
PID:5884

C:\Windows\system32\find.exe
find "STATE"
1⤵
PID:2112

C:\Windows\system32\find.exe
find "RUNNING"
1⤵
PID:1596

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:3588

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a34055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3504