Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
OneDriveUpdater.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
||
|
C:\Users\user\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.json
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\Update.xml
|
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\OneDrive\Update\Update.xml
|
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\DeviceHealthSummaryConfiguration.ini
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2024-07-04.2340.7252.1.aodl
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2024-07-04_234035_7252-7256.log
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\OneDriveUpdater.exe
|
"C:\Users\user\Desktop\OneDriveUpdater.exe"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://g.live.com/1rewlive5skydrive/OneDriveEnterpriseV2
|
unknown
|
||
|
https://g.live.com/odclientsettings/Prod
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2
|
unknown
|
||
|
https://g.live.com/odclientsettings/EnterpriseG?Bi
|
unknown
|
||
|
https://g.live.com/odclientsettings/Prods
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/ODSUInsiderV2
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/ODSUMsitSlowV2
|
unknown
|
||
|
https://g.live.com/odclientsettings/Enterprise
|
unknown
|
||
|
https://g.live.com/odclientsettings/MsitFastl
|
unknown
|
||
|
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.
|
unknown
|
||
|
https://g.live.com/odclientsettings/MsitSlow#?
|
unknown
|
||
|
https://clients.config.office.net/user/v1.0/tenantassociationkey
|
unknown
|
||
|
https://clients.config.office.net/collector/v1.0/inventoryodbc:December
|
unknown
|
||
|
https://g.live.com/odclientsettings/Prodonfig
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/ODSUMsitFastV2
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/win81
|
unknown
|
||
|
https://dc.services.visualstudio.com/v2/track
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/Onee
|
unknown
|
||
|
https://g.live.com/odclientsettings/MsitFast:?
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/One
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/MsitFastV2
|
unknown
|
||
|
https://g.live.com/odclientsettings/Insiders
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/ODSUEnterpriseV2https://g.live.com/1rewlive5skydrive/ODSUMsitFa
|
unknown
|
||
|
https://g.live.com/odclientsettings/MsitSlow
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/OneDriveInsiderV2
|
unknown
|
||
|
https://oneclient.sfx.
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/OSRSS_32bit
|
unknown
|
||
|
https://g.live.com
|
unknown
|
||
|
https://g.live.com/odclientsettings/Enterprise%l
|
unknown
|
||
|
https://g.live.com/odclientsettings/Insidersl
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/OSRSS_64bit
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2ember:Dec:December
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/ODSUProductionV2
|
unknown
|
||
|
https://g.live.com/odclientsettings/MsitFast
|
unknown
|
||
|
https://g.live.com/odclientsettings/MsitSlowl
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/win7
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/ODSUEnterpriseV2
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/MsitSlowV2
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/win8
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2ember:Dec:Decemberd$hh0
|
unknown
|
||
|
https://g.live.com/1rewlive5skydrive/OSRSS_32bithttps://g.live.com/1rewlive5skydrive/OSRSS_64bit%loc
|
unknown
|
There are 32 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive
|
StandaloneUpdaterSafeMode
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Installer\BITS\PreSignInSettingsConfigJSON
|
GUID
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Installer\BITS\PreSignInSettingsConfigJSON
|
File
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Installer\BITS\UpdateDescriptionXml
|
GUID
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Installer\BITS\UpdateDescriptionXml
|
File
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive
|
OdsuCheckForUpdateStartTime
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive
|
OdsuCheckForUpdateEndTime
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Installer\BITS\UpdateXml
|
GUID
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Installer\BITS\UpdateXml
|
File
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive
|
UpdateBeginTimestampTryCountODSU
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive
|
UpdateBeginTimestampODSU
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Installer\BITS\SetupBinary
|
GUID
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Installer\BITS\SetupBinary
|
File
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive
|
OdsuCheckForUpdateStartTime
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive
|
OdsuCheckForUpdateEndTime
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1BB954A3000
|
heap
|
page read and write
|
||
|
1BB954F2000
|
heap
|
page read and write
|
||
|
7FF7C43CB000
|
unkown
|
page write copy
|
||
|
1BB93796000
|
heap
|
page read and write
|
||
|
1BB936C0000
|
heap
|
page read and write
|
||
|
1BB937AD000
|
heap
|
page read and write
|
||
|
7FF7C42E9000
|
unkown
|
page readonly
|
||
|
1BB95435000
|
heap
|
page read and write
|
||
|
7FF7C43E3000
|
unkown
|
page readonly
|
||
|
1BB9542E000
|
heap
|
page read and write
|
||
|
1BB9540E000
|
heap
|
page read and write
|
||
|
1BB953C9000
|
heap
|
page read and write
|
||
|
1BB936EE000
|
heap
|
page read and write
|
||
|
1BB9540D000
|
heap
|
page read and write
|
||
|
1BB954AC000
|
heap
|
page read and write
|
||
|
1BB94FC0000
|
trusted library allocation
|
page read and write
|
||
|
1BB93794000
|
heap
|
page read and write
|
||
|
1BB9376C000
|
heap
|
page read and write
|
||
|
7FF7C4001000
|
unkown
|
page execute read
|
||
|
1BB9545A000
|
heap
|
page read and write
|
||
|
1BB93708000
|
heap
|
page read and write
|
||
|
1BB95475000
|
heap
|
page read and write
|
||
|
1BB9376E000
|
heap
|
page read and write
|
||
|
1BB93783000
|
heap
|
page read and write
|
||
|
1BB94FF0000
|
heap
|
page read and write
|
||
|
1BB954A3000
|
heap
|
page read and write
|
||
|
1BB9553B000
|
heap
|
page read and write
|
||
|
1BB953C1000
|
heap
|
page read and write
|
||
|
1BB954C0000
|
heap
|
page read and write
|
||
|
7FF7C42E9000
|
unkown
|
page readonly
|
||
|
1BB93717000
|
heap
|
page read and write
|
||
|
1BB9377D000
|
heap
|
page read and write
|
||
|
1BB937A0000
|
heap
|
page read and write
|
||
|
1BB94FC0000
|
trusted library allocation
|
page read and write
|
||
|
1BB93791000
|
heap
|
page read and write
|
||
|
1BB93798000
|
heap
|
page read and write
|
||
|
46A4EF8000
|
stack
|
page read and write
|
||
|
1BB953D2000
|
heap
|
page read and write
|
||
|
7FF7C43DD000
|
unkown
|
page read and write
|
||
|
1BB9550B000
|
heap
|
page read and write
|
||
|
1BB95455000
|
heap
|
page read and write
|
||
|
1BB95435000
|
heap
|
page read and write
|
||
|
1BB95425000
|
heap
|
page read and write
|
||
|
1BB953D0000
|
heap
|
page read and write
|
||
|
46A52F9000
|
stack
|
page read and write
|
||
|
46A52FC000
|
stack
|
page read and write
|
||
|
1BB9559E000
|
heap
|
page read and write
|
||
|
1BB954A2000
|
heap
|
page read and write
|
||
|
1BB937AA000
|
heap
|
page read and write
|
||
|
7FF7C4401000
|
unkown
|
page readonly
|
||
|
1BB95425000
|
heap
|
page read and write
|
||
|
1BB95819000
|
heap
|
page read and write
|
||
|
46A51FA000
|
stack
|
page read and write
|
||
|
1BB954AF000
|
heap
|
page read and write
|
||
|
1BB953D6000
|
heap
|
page read and write
|
||
|
7FF7C43E3000
|
unkown
|
page readonly
|
||
|
1BB93784000
|
heap
|
page read and write
|
||
|
1BB9378A000
|
heap
|
page read and write
|
||
|
1BB95070000
|
heap
|
page read and write
|
||
|
1BB954B4000
|
heap
|
page read and write
|
||
|
1BB93782000
|
heap
|
page read and write
|
||
|
7FF7C43C3000
|
unkown
|
page write copy
|
||
|
1BB953F1000
|
heap
|
page read and write
|
||
|
1BB95075000
|
heap
|
page read and write
|
||
|
1BB953C0000
|
heap
|
page read and write
|
||
|
1BB937BE000
|
heap
|
page read and write
|
||
|
1BB95499000
|
heap
|
page read and write
|
||
|
1BB93774000
|
heap
|
page read and write
|
||
|
1BB9548A000
|
heap
|
page read and write
|
||
|
1BB95401000
|
heap
|
page read and write
|
||
|
7FF7C43CA000
|
unkown
|
page read and write
|
||
|
1BB937AD000
|
heap
|
page read and write
|
||
|
46A53FF000
|
stack
|
page read and write
|
||
|
1BB94FE0000
|
heap
|
page read and write
|
||
|
1BB936C8000
|
heap
|
page read and write
|
||
|
1BB953D8000
|
heap
|
page read and write
|
||
|
1BB9379D000
|
heap
|
page read and write
|
||
|
1BB95416000
|
heap
|
page read and write
|
||
|
1BB9553D000
|
heap
|
page read and write
|
||
|
1BB9554D000
|
heap
|
page read and write
|
||
|
1BB9379D000
|
heap
|
page read and write
|
||
|
7FF7C4000000
|
unkown
|
page readonly
|
||
|
1BB953D0000
|
heap
|
page read and write
|
||
|
1BB953DE000
|
heap
|
page read and write
|
||
|
1BB93770000
|
heap
|
page read and write
|
||
|
1BB9377B000
|
heap
|
page read and write
|
||
|
1BB953E5000
|
heap
|
page read and write
|
||
|
1BB93778000
|
heap
|
page read and write
|
||
|
1BB937AD000
|
heap
|
page read and write
|
||
|
1BB95425000
|
heap
|
page read and write
|
||
|
1BB94FE2000
|
heap
|
page read and write
|
||
|
1BB9553D000
|
heap
|
page read and write
|
||
|
1BB93762000
|
heap
|
page read and write
|
||
|
1BB9377F000
|
heap
|
page read and write
|
||
|
1BB95485000
|
heap
|
page read and write
|
||
|
1BB937A0000
|
heap
|
page read and write
|
||
|
1BB95436000
|
heap
|
page read and write
|
||
|
1BB93794000
|
heap
|
page read and write
|
||
|
1BB937AD000
|
heap
|
page read and write
|
||
|
1BB954A3000
|
heap
|
page read and write
|
||
|
1BB937A5000
|
heap
|
page read and write
|
||
|
7FF7C43BF000
|
unkown
|
page write copy
|
||
|
1BB93744000
|
heap
|
page read and write
|
||
|
1BB93794000
|
heap
|
page read and write
|
||
|
1BB935A0000
|
heap
|
page read and write
|
||
|
1BB9554D000
|
heap
|
page read and write
|
||
|
1BB94F60000
|
heap
|
page read and write
|
||
|
1BB954A4000
|
heap
|
page read and write
|
||
|
1BB937BE000
|
heap
|
page read and write
|
||
|
1BB9552A000
|
heap
|
page read and write
|
||
|
1BB95800000
|
heap
|
page read and write
|
||
|
1BB954E2000
|
heap
|
page read and write
|
||
|
1BB953FA000
|
heap
|
page read and write
|
||
|
1BB955A2000
|
heap
|
page read and write
|
||
|
1BB95445000
|
heap
|
page read and write
|
||
|
1BB93680000
|
heap
|
page read and write
|
||
|
1BB93783000
|
heap
|
page read and write
|
||
|
46A51F6000
|
stack
|
page read and write
|
||
|
1BB95509000
|
heap
|
page read and write
|
||
|
46A4EFD000
|
stack
|
page read and write
|
||
|
1BB9376E000
|
heap
|
page read and write
|
||
|
1BB95465000
|
heap
|
page read and write
|
||
|
1BB937A0000
|
heap
|
page read and write
|
||
|
7FF7C4401000
|
unkown
|
page readonly
|
||
|
1BB93787000
|
heap
|
page read and write
|
||
|
1BB95509000
|
heap
|
page read and write
|
||
|
46A51FF000
|
stack
|
page read and write
|
||
|
1BB95435000
|
heap
|
page read and write
|
||
|
1BB93776000
|
heap
|
page read and write
|
||
|
1BB937B7000
|
heap
|
page read and write
|
||
|
1BB94FEA000
|
heap
|
page read and write
|
||
|
1BB95403000
|
heap
|
page read and write
|
||
|
1BB94F90000
|
trusted library allocation
|
page read and write
|
||
|
7FF7C4000000
|
unkown
|
page readonly
|
||
|
1BB954A3000
|
heap
|
page read and write
|
||
|
1BB9377D000
|
heap
|
page read and write
|
||
|
1BB93787000
|
heap
|
page read and write
|
||
|
7FF7C43BF000
|
unkown
|
page read and write
|
||
|
1BB95445000
|
heap
|
page read and write
|
||
|
1BB95509000
|
heap
|
page read and write
|
||
|
1BB954AE000
|
heap
|
page read and write
|
||
|
7FF7C4001000
|
unkown
|
page execute read
|
There are 132 hidden memdumps, click here to show them.