Overview

overview

7

Static

static

3

oncesport_...er.exe

windows10-2004-x64

oncesport_...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    73s
  • max time network
    92s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 10:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    oncesport_installer.exe
  • Size 294.6MB
  • Sample260910-mracts1hnd
  • SHA256 bab4cd5a161b16ecc598a2b2280310cce471da3c532d4078ecd1a271c7a10bbf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\oncesport_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\oncesport_installer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4780
    • C:\Users\Admin\AppData\Local\Temp\is-I5D68.tmp\oncesport_installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-I5D68.tmp\oncesport_installer.tmp" /SL5="$602CA,307769417,843264,C:\Users\Admin\AppData\Local\Temp\oncesport_installer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Users\Admin\AppData\Local\Temp\is-H209S.tmp\vcredist.exe
        "C:\Users\Admin\AppData\Local\Temp\is-H209S.tmp\vcredist.exe" /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Windows\Temp\{2E832B0B-A99E-40AC-ACF3-C6361C50EA99}\.cr\vcredist.exe
          "C:\Windows\Temp\{2E832B0B-A99E-40AC-ACF3-C6361C50EA99}\.cr\vcredist.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-H209S.tmp\vcredist.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /install /passive /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4672
          • C:\Windows\Temp\{90B233A1-E070-4E25-989F-52C3B3813922}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{90B233A1-E070-4E25-989F-52C3B3813922}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{3BCE0923-AD3F-4C45-A62F-A8184F0A6C9D} {87924DB9-C5AF-4240-A1DA-9F767877DF94} 4672
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2072
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1120 -burn.embedded BurnPipe.{A8F9D6F1-83FF-44E2-B12C-A4D9927F2124} {506A9587-8443-4172-9C11-628B11D33759} 2072
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4240
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1120 -burn.embedded BurnPipe.{A8F9D6F1-83FF-44E2-B12C-A4D9927F2124} {506A9587-8443-4172-9C11-628B11D33759} 2072
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4620
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{92D118E4-9A64-455A-A50A-79ABE97BF5B5} {268D831B-E6D8-41FB-9DE0-12075358FE81} 4620
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:3584
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3308
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:3608
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2108
    • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910120456.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910120456.log" /install
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:780
          • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A86A0520-5392-406F-9421-0EDED0E1C4A3} {080D6809-C534-48B4-AF1D-6324D2C2DFB3} 780
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:692
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa38c2855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2196

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5988c3.rbs
          • Path C:\Config.Msi\e5988c3.rbs
          • Size 19KB
          • SHA256 112811def7fb9d4f77a7f42308c702ad349e640e2762a680baf12132eb6c6b64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5988cf.rbs
          • Path C:\Config.Msi\e5988cf.rbs
          • Size 19KB
          • SHA256 ea4aa6d8c42b026acfc66816cb3ce9955a2d0705f70ecb0279b4ef3664462558
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5988d6.rbs
          • Path C:\Config.Msi\e5988d6.rbs
          • Size 21KB
          • SHA256 5fd69e51a3897d0851742163bd7380746df1a3257ec33dda585553097b855916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5988e5.rbs
          • Path C:\Config.Msi\e5988e5.rbs
          • Size 21KB
          • SHA256 e1217697e05a34472781aa6252cec0a8c2f764af74df24791e47ec9d9eeb27be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
          • Size 970B
          • SHA256 c43559cd31266c399bfc00f0ba5834d010a8876d0dc205e0eadf0f384e8d7367
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
          • Size 950B
          • SHA256 bbcb0c134eb4a793e8056cd48252e7719ccb19e3fc81aa7843f80032e56ad28e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          OnceSport.exe
          • Path C:\Users\Admin\AppData\Local\Programs\Once Sport\OnceSport.exe
          • Size 187KB
          • SHA256 181834308a673aa9f01d32262be144d73b37cb3fb94749080825492657ddf79e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-0B5TC.tmp
          • Path C:\Users\Admin\AppData\Local\Programs\Once Sport\UI\DAL\Database\Rugby\is-0B5TC.tmp
          • Size 12KB
          • SHA256 dde16311b16890703717fdddeb05144a45cd3a089bbda1d5255c2c5b20a5b724
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_amd64_20260910120456_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910120456_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 77941a1eb5ed29a014b84b2103418fb32133f1e550ff552a2b546ddc32c36179
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260910120456_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910120456_001_vcRuntimeAdditional_x64.log
          • Size 2KB
          • SHA256 a3cd48c3be740916fb751ed00234afea4ddfab5f26c5be594976794e263b52a1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vcredist.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-H209S.tmp\vcredist.exe
          • Size 24.4MB
          • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          oncesport_installer.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-I5D68.tmp\oncesport_installer.tmp
          • Size 3.4MB
          • SHA256 add2ec7663b235c0d896cd8df785b42ee9922d33d9b83613105e456770a9801f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcredist.exe
          • Path C:\Windows\Temp\{2E832B0B-A99E-40AC-ACF3-C6361C50EA99}\.cr\vcredist.exe
          • Size 670KB
          • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88FF4D07-DE17-4A59-A9AE-DC7FA2B5D46D}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88FF4D07-DE17-4A59-A9AE-DC7FA2B5D46D}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{88FF4D07-DE17-4A59-A9AE-DC7FA2B5D46D}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{88FF4D07-DE17-4A59-A9AE-DC7FA2B5D46D}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{90B233A1-E070-4E25-989F-52C3B3813922}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{90B233A1-E070-4E25-989F-52C3B3813922}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{90B233A1-E070-4E25-989F-52C3B3813922}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{90B233A1-E070-4E25-989F-52C3B3813922}\cab5046A8AB272BF37297BB7928664C9503
          • Size 964KB
          • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{90B233A1-E070-4E25-989F-52C3B3813922}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{90B233A1-E070-4E25-989F-52C3B3813922}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3584-1185-0x0000000000170000-0x00000000001E7000-memory.dmp
          Download

          memory/4240-1188-0x0000000000170000-0x00000000001E7000-memory.dmp
          Download

          memory/4376-8-0x00000000000C0000-0x000000000043F000-memory.dmp
          Download

          memory/4376-110-0x00000000000C0000-0x000000000043F000-memory.dmp
          Download

          memory/4376-390-0x00000000000C0000-0x000000000043F000-memory.dmp
          Download

          memory/4376-9-0x0000000000E40000-0x0000000000E41000-memory.dmp
          Download

          memory/4376-1003-0x00000000000C0000-0x000000000043F000-memory.dmp
          Download

          memory/4376-5-0x0000000000E40000-0x0000000000E41000-memory.dmp
          Download

          memory/4376-1196-0x00000000000C0000-0x000000000043F000-memory.dmp
          Download

          memory/4620-1187-0x0000000000170000-0x00000000001E7000-memory.dmp
          Download

          memory/4780-1-0x0000000000DF0000-0x0000000000ECD000-memory.dmp
          Download

          memory/4780-7-0x0000000000DF0000-0x0000000000ECD000-memory.dmp
          Download

          memory/4780-1197-0x0000000000DF0000-0x0000000000ECD000-memory.dmp
          Download