7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e

General

Target
7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e.bin.exe
Size 830KB
Sample261110-n58yzsxt7n
SHA256 7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e
MD5 6eb8f87d8b806865a5e21c0759b5736c
SHA1 93d5b087f5de3063ffff7c23cf049278fa1f1e0f
SHA512 a0ab09f5769c7526fb219c5a154bf431fd89c9980b4b668e11af935d8fc4488e2d066839e5ca4bd00cef9931130c8bf7d3acdbc8c4c3718ed151c5ed42d112b5
SSDEEP 12288:u7tcNWRdeUTXAWIZHvKFHB63NuOlbYmg8GLYmDX0/gKxVk5k0O1uAVN6:Ucox7ATKj8+YmDXzKFJY
TLSH
T1B7053B197A4918BDC9C6D475978B6923452834CF1E61BCFF83CAA2323E6A0B4DF36714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2436	SyncService.exe
3768	SyncService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSync_A2C7DA76 = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SyncServices\\SyncService.exe\""	7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e.bin.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e.bin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\Registry\User\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{80B0A56D-A130-4CD2-9778-E8689050B722}	7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e.bin.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{80B0A56D-A130-4CD2-9778-E8689050B722}\Config_A2D961CF = 6ce3ce712f2ca5be7c3b379f04a5e74c84e47b6e9763b72bd5de61fbe5f1879b1bd46809aeacedb21fd626857330d9e460386dba9e64d495a61b583db6d3e88a4d079b88102b8a252c3cf44e16c414bfd4a8f9f8d5afc897bc80789c14c9f7aed0f81d25fbf6ac60768e2bf3b8e4416062b2aeb4010008f0add7e103fc22719ada86f0d2f0a3ec4496140476b7fb1924c5818898751101f36f0f991298724827e24127c46493276315025c76d6f03466b4d3f614422a14e81ad31f2ce9e59a06f96af355c32ea171e2142957d54498b4a020ec95cbe1c74b2d879366de30349cd7ed000cdeeebb6afe49c67edf2ac0e404df5f2cb4d262f73ed278f897ecc885aa05d30441c187b2181c3421092c556209d98955fe1103c7d20e0a171348d805af35637a544ee312c1df03aae4e53ec042649da03a601218	7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e.bin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4748	7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e.bin.exe
4748	7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e.bin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e.bin.exe
"C:\Users\Admin\AppData\Local\Temp\7e93ce3cb7390efabea68abdba15069dfd1a96f82ea56ed560422669a7f6e20e.bin.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4748

C:\Users\Admin\AppData\Local\Microsoft\SyncServices\SyncService.exe
C:\Users\Admin\AppData\Local\Microsoft\SyncServices\SyncService.exe
1⤵
- Executes dropped EXE
PID:2436

C:\Users\Admin\AppData\Local\Microsoft\SyncServices\SyncService.exe
"C:\Users\Admin\AppData\Local\Microsoft\SyncServices\SyncService.exe"
1⤵
- Executes dropped EXE
PID:3768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveUpdate.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDriveStandalone\OneDriveUpdate.exe
Size 830KB
SHA256 ba8fc2cd986d1f4bb7f716ae524efc1ea6991df622e1a0c79160c0acb4ed160e
MD5 2064082da2c2652a5607884d9c7c2a32
SHA1 9d0512d28b414c0e63dfdedeb737cadeab0d83f4
SHA512 c8342fa5194bce84704f5670c94662e5986bd3d223505600524413eefd0043534f9462e755897b705e71d16762bb5a5b379fc514ae99d21b8fcecafda26cd5c7
SSDEEP 12288:u7tcNWRdeUTXAWIZHvKFHB63NuOlbYmg8GLYmDX0/gKxVk5k0O1uAVN6m:Ucox7ATKj8+YmDXzKFJYm
TLSH
T12D053B197A4918BDC9C6D475978B6923452834CF1E61BCFF83CAA2323E6A0B4DF36714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncService.exe

Path C:\Users\Admin\AppData\Local\Microsoft\SyncServices\SyncService.exe
Size 830KB
SHA256 3e932ebf8b5f0b57f79ec4c153f20650558655d69cba62a3e98937ca433f2141
MD5 e541f067cf65ab5664acbe2b09702003
SHA1 09159c3263d9cdfbe9cc715fe00516505dd130cc
SHA512 f359008cb9b383bd4fbbaec28c16857b7e2fb81470bdac9acf76b4ee5a8617e2037548874827dc9af499c7e7fb83024f2580ca368e02a9a4438cea24fb33a42e
SSDEEP 12288:u7tcNWRdeUTXAWIZHvKFHB63NuOlbYmg8GLYmDX0/gKxVk5k0O1uAVN6D:Ucox7ATKj8+YmDXzKFJYD
TLSH
T10E053B197A4918BDC9C6D475978B6923452834CF1E61BCFF83CAA2323E6A0B4DF36714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads