OneDrive[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
OneDrive.exe
Size 2.5MB
Sample261107-q2exvadv6j
SHA256 c42605752c5b47aac98cf53afb5b0033e2df2a8a6df953ac1656d9701ebedddc
MD5 d792e1428ca1f7c041663685510e3fa3
SHA1 c95986a439c7fba59f9d65e1bbdb6b80a519fe42
SHA512 700d5e6674ed4561f795904955771a5b2b5cb01a8bf7fd974bbb48caeb2bc12b96881fab0f8938250ca833675a78007ecc88a4c35da45962d3fbe37dbd09ea55
SSDEEP 49152:80jSNa3efgsic+qgXXyTtsBP/OlsLzFmNfW6FJKxxfZA4XH:/3Ds/OXzBP/OlsLzFmNfW6FJKxxfZA43
TLSH
T18FC5E5CA7E5072F2D19CE8343967727DD7637C796E224A8F2297FF1E1A372604926102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

OneDrive.exe

.exe 2.5MB

OneDrive.exe

IMPHASH ce4f3c8515ae09314c195d3210288006
SHA256 c42605752c5b47aac98cf53afb5b0033e2df2a8a6df953ac1656d9701ebedddc
MD5 d792e1428ca1f7c041663685510e3fa3
SHA1 c95986a439c7fba59f9d65e1bbdb6b80a519fe42
SHA512 700d5e6674ed4561f795904955771a5b2b5cb01a8bf7fd974bbb48caeb2bc12b96881fab0f8938250ca833675a78007ecc88a4c35da45962d3fbe37dbd09ea55
SSDEEP 49152:80jSNa3efgsic+qgXXyTtsBP/OlsLzFmNfW6FJKxxfZA4XH:/3Ds/OXzBP/OlsLzFmNfW6FJKxxfZA43
TLSH
T18FC5E5CA7E5072F2D19CE8343967727DD7637C796E224A8F2297FF1E1A372604926102
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

1b:d3:34:ac:cc:b8:1d:d3:46:92:93:2b:b0:0e:1d:48:38:af:1d:03:bf:99:ef:92:78:28:c8:55:fa:46:61:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 20, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

490848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\dbs\sh\odct\0119_223951_0\client\onedrive\Product\UX\Exe\obj\amd64\OneDrive.pdb

kernel32

FindFirstFileNameW IsDebuggerPresent CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeviceIoControl IsWow64Process LoadLibraryExW ReadDirectoryChangesW CreateSymbolicLinkW GetUserGeoID CreateToolhelp32Snapshot Process32FirstW Process32NextW VerSetConditionMask GetProductInfo VerifyVersionInfoW SetLastError ReleaseMutex CreateEventW Sleep WaitForMultipleObjects GetProcessTimes GetExitCodeProcess SetProcessShutdownParameters GetSystemTimes SetThreadInformation GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW MoveFileExW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById FormatMessageW WriteConsoleW ReadConsoleW SetEndOfFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetCompressedFileSizeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileW FindFirstFileExW GetOEMCP SetFilePointer SetFileInformationByHandle SetFileAttributesW RemoveDirectoryW ReadFile GetVolumePathNameW GetLongPathNameW GetFinalPathNameByHandleW GetFileType GetFileSizeEx GetFileSize GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateFileW CreateDirectoryW CompareStringOrdinal ExpandEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW K32GetModuleFileNameExW GetUserDefaultLCID SystemTimeToFileTime MoveFileW LocalAlloc GetModuleFileNameW GetVersionExW GetSystemTimeAsFileTime GetSystemTime TerminateProcess GetCurrentProcess CreateMutexW WaitForSingleObject GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc FindFirstFileW FindClose DeleteFileW OpenProcess LCMapStringW WideCharToMultiByte MultiByteToWideChar CloseHandle CreateProcessW GetCurrentProcessId FreeLibrary GetProcAddress InitializeCriticalSectionEx LoadLibraryW SetDllDirectoryW LocalFree DeleteCriticalSection GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc WriteFile GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx InitializeSListHead DecodePointer GetLastError SetFilePointerEx GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx GetStringTypeW LeaveCriticalSection EnterCriticalSection RaiseException OutputDebugStringW

user32

DispatchMessageW SendMessageTimeoutW PostMessageW EnumWindows GetClassNameW GetWindowThreadProcessId SystemParametersInfoW GetMessageW TranslateMessage CreateWindowExW ShowWindow DestroyWindow RegisterClassW UnregisterPowerSettingNotification RegisterPowerSettingNotification

advapi32

CreateProcessAsUserW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW CreateProcessWithTokenW GetUserNameW SetFileSecurityW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegGetValueW RegSetKeyValueW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges OpenProcessToken RegSetValueExW RegCloseKey

shell32

SHCreateItemFromParsingName SHAssocEnumHandlers SHCreateDirectoryExW SHGetFolderPathW SHGetFolderPathAndSubDirW SHSetKnownFolderPath CommandLineToArgvW SHParseDisplayName SHFileOperationW SHGetSpecialFolderPathW SHGetKnownFolderPath SHChangeNotify ShellExecuteExW ord526

ole32

CoInitialize CoInitializeSecurity CoUninitialize StringFromCLSID CoTaskMemFree CoCreateInstance StringFromGUID2 CreateBindCtx CoInitializeEx CoSetProxyBlanket CoCreateFreeThreadedMarshaler CoCreateGuid CreateItemMoniker GetRunningObjectTable

oleaut32

GetErrorInfo SetErrorInfo SysAllocString GetRecordInfoFromTypeInfo SysFreeString LoadTypeLi LoadRegTypeLi SysStringLen

crypt32

CryptBinaryToStringW CryptStringToBinaryW

rpcrt4

RpcBindingFree RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcStringFreeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister RpcServerInqCallAttributesW

secur32

GetUserNameExW

shlwapi

PathFileExistsW PathIsDirectoryW PathStripPathW SHDeleteValueW SHDeleteKeyW SHGetValueW PathRemoveFileSpecW StrStrIW SHCreateStreamOnFileW AssocQueryStringW PathIsPrefixW SHRegGetBoolUSValueW SHRegGetPathW SHRegGetValueW SHSetValueW SHGetValueA

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetCanonicalizeUrlW InternetCheckConnectionW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock GetDefaultUserProfileDirectoryW

Name

.text

Size

669KB

Virtual Size

668KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

202KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

OneDrive.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

userenv

generic