Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
onedrive.bat.exe
|
PE32 executable (console) Intel 80386, for MS Windows
|
initial sample
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tw0strn3.bud.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u2wwjpve.24z.psm1
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\onedrive.bat.exe
|
C:\Users\user\Desktop\onedrive.bat.exe
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://aka.ms/pscore6LR
|
unknown
|
||
|
https://aka.ms/pscore6lB
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
868A000
|
trusted library allocation
|
page read and write
|
||
|
88F0000
|
trusted library allocation
|
page read and write
|
||
|
85E0000
|
trusted library allocation
|
page read and write
|
||
|
86A0000
|
trusted library allocation
|
page read and write
|
||
|
80E0000
|
trusted library allocation
|
page read and write
|
||
|
8640000
|
trusted library allocation
|
page read and write
|
||
|
6EE0000
|
trusted library allocation
|
page read and write
|
||
|
7CA0000
|
trusted library allocation
|
page read and write
|
||
|
8670000
|
trusted library allocation
|
page execute and read and write
|
||
|
6B70000
|
unkown
|
page read and write
|
||
|
8710000
|
trusted library allocation
|
page read and write
|
||
|
6B70000
|
unkown
|
page read and write
|
||
|
426D000
|
trusted library allocation
|
page execute and read and write
|
||
|
842A000
|
heap
|
page read and write
|
||
|
7EE0000
|
trusted library allocation
|
page read and write
|
||
|
8830000
|
trusted library allocation
|
page read and write
|
||
|
4AC8000
|
trusted library allocation
|
page read and write
|
||
|
8660000
|
trusted library allocation
|
page read and write
|
||
|
8850000
|
trusted library allocation
|
page read and write
|
||
|
8390000
|
trusted library allocation
|
page read and write
|
||
|
6BA0000
|
trusted library allocation
|
page read and write
|
||
|
80D0000
|
trusted library allocation
|
page read and write
|
||
|
7E70000
|
trusted library allocation
|
page read and write
|
||
|
83A0000
|
trusted library allocation
|
page read and write
|
||
|
85E0000
|
trusted library allocation
|
page read and write
|
||
|
7E60000
|
trusted library allocation
|
page read and write
|
||
|
8670000
|
trusted library allocation
|
page read and write
|
||
|
6F30000
|
trusted library allocation
|
page read and write
|
||
|
7D7E000
|
stack
|
page read and write
|
||
|
6BA0000
|
trusted library allocation
|
page read and write
|
||
|
86C0000
|
trusted library allocation
|
page read and write
|
||
|
8640000
|
unkown
|
page read and write
|
||
|
8650000
|
trusted library allocation
|
page read and write
|
||
|
8855000
|
trusted library allocation
|
page read and write
|
||
|
8830000
|
trusted library allocation
|
page read and write
|
||
|
6BC0000
|
trusted library allocation
|
page read and write
|
||
|
6ED0000
|
trusted library allocation
|
page read and write
|
||
|
6BA8000
|
unkown
|
page read and write
|
||
|
8390000
|
trusted library allocation
|
page read and write
|
||
|
8640000
|
trusted library allocation
|
page read and write
|
||
|
8850000
|
trusted library allocation
|
page read and write
|
||
|
8A30000
|
unkown
|
page execute and read and write
|
||
|
8850000
|
trusted library allocation
|
page read and write
|
||
|
6BC6000
|
trusted library allocation
|
page read and write
|
||
|
6BC0000
|
trusted library allocation
|
page read and write
|
||
|
7E50000
|
trusted library allocation
|
page read and write
|
||
|
43CE000
|
stack
|
page read and write
|
||
|
6960000
|
trusted library allocation
|
page read and write
|
||
|
6B70000
|
trusted library allocation
|
page read and write
|
||
|
6BC5000
|
trusted library allocation
|
page read and write
|
||
|
82E0000
|
trusted library allocation
|
page read and write
|
||
|
8390000
|
trusted library allocation
|
page read and write
|
||
|
8850000
|
trusted library allocation
|
page read and write
|
||
|
7E70000
|
unkown
|
page read and write
|
||
|
8650000
|
trusted library allocation
|
page read and write
|
||
|
85E0000
|
trusted library allocation
|
page read and write
|
||
|
7D58000
|
trusted library allocation
|
page read and write
|
||
|
8670000
|
trusted library allocation
|
page read and write
|
||
|
7CF0000
|
trusted library allocation
|
page read and write
|
||
|
85E0000
|
trusted library allocation
|
page read and write
|
||
|
8850000
|
trusted library allocation
|
page read and write
|
||
|
6B70000
|
trusted library allocation
|
page read and write
|
||
|
86A0000
|
trusted library allocation
|
page read and write
|
||
|
7738000
|
heap
|
page read and write
|
||
|
6980000
|
heap
|
page execute and read and write
|
||
|
8680000
|
trusted library allocation
|
page read and write
|
||
|
7665000
|
trusted library allocation
|
page read and write
|
||
|
6BC0000
|
trusted library allocation
|
page read and write
|
||
|
8380000
|
trusted library allocation
|
page read and write
|
||
|
2890000
|
heap
|
page read and write
|
||
|
8391000
|
trusted library allocation
|
page read and write
|
||
|
86B0000
|
trusted library allocation
|
page read and write
|
||
|
8A30000
|
trusted library allocation
|
page read and write
|
||
|
8660000
|
trusted library allocation
|
page read and write
|
||
|
8390000
|
trusted library allocation
|
page read and write
|
||
|
6B60000
|
trusted library allocation
|
page read and write
|
||
|
8390000
|
trusted library allocation
|
page read and write
|
||
|
8930000
|
unkown
|
page read and write
|
||
|
6B60000
|
trusted library allocation
|
page read and write
|
||
|
7DA0000
|
trusted library allocation
|
page read and write
|
||
|
6B70000
|
trusted library allocation
|
page read and write
|
||
|
8710000
|
trusted library allocation
|
page read and write
|
||
|
8710000
|
trusted library allocation
|
page read and write
|
||
|
6B79000
|
trusted library allocation
|
page read and write
|
||
|
7EE8000
|
trusted library allocation
|
page read and write
|
||
|
7E3C000
|
stack
|
page read and write
|
||
|
42A7000
|
heap
|
page read and write
|
||
|
8710000
|
trusted library allocation
|
page read and write
|
||
|
496D000
|
trusted library allocation
|
page read and write
|
||
|
82E1000
|
trusted library allocation
|
page read and write
|
||
|
8670000
|
trusted library allocation
|
page read and write
|
||
|
6BC0000
|
trusted library allocation
|
page read and write
|
||
|
7E70000
|
trusted library allocation
|
page read and write
|
||
|
89A0000
|
trusted library allocation
|
page read and write
|
||
|
8820000
|
trusted library allocation
|
page read and write
|
||
|
82E0000
|
trusted library allocation
|
page read and write
|
||
|
82E0000
|
trusted library allocation
|
page read and write
|
||
|
83B0000
|
unkown
|
page read and write
|
||
|
8850000
|
trusted library allocation
|
page read and write
|
||
|
7EE0000
|
trusted library allocation
|
page read and write
|