File name:

OneDriveStandaloneUpdater.exe

Full analysis: https://app.any.run/tasks/4de9e9a6-8988-4189-b338-d56e97720f46
Verdict: Malicious activity
Analysis date: November 20, 2019, 06:57:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E904257FBE9422E5424688FF2A3F220B

SHA1:

8E6B744B7F220CCA396CAED8282E186F87DB5FC3

SHA256:

0E820752BE14BA43E6818795DC01E97FF26C49EB05E28EFBA81B8B9586DD4399

SSDEEP:

49152:s7KAfl4bRzDpS0DNDVFzu3Z9Z2my15ihnDCER8UFtD5XCW3lqaD1i54JWTrmBpIq:s7BKRXpS0DNDVVuh2myf2tVXz3Ljg6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • OneDriveSetup.exe (PID: 1504)

    • Loads the Task Scheduler COM API

      • OneDriveSetup.exe (PID: 1504)

    • Loads dropped or rewritten executable

      • FileSyncConfig.exe (PID: 3124)

    • Application was dropped or rewritten from another process

      • FileSyncConfig.exe (PID: 3124)

  • SUSPICIOUS

    • Creates files in the program directory

      • OneDriveSetup.exe (PID: 2232)

    • Application launched itself

      • OneDriveSetup.exe (PID: 2232)

    • Reads Internet Cache Settings

      • OneDriveSetup.exe (PID: 2232)

    • Creates COM task schedule object

      • OneDriveSetup.exe (PID: 1504)

    • Changes IE settings (feature browser emulation)

      • OneDriveSetup.exe (PID: 1504)

    • Modifies the open verb of a shell class

      • OneDriveSetup.exe (PID: 1504)

    • Creates a software uninstall entry

      • OneDriveSetup.exe (PID: 1504)

    • Creates files in the user directory

      • OneDriveSetup.exe (PID: 1504)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • FileSyncConfig.exe (PID: 3124)

    • Executable content was dropped or overwritten

      • OneDriveSetup.exe (PID: 1504)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • OneDriveSetup.exe (PID: 1504)
      • OneDriveSetup.exe (PID: 2232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (83)
.exe | Win32 Executable (generic) (9)
.exe | Generic Win/DOS Executable (3.9)
.exe | DOS Executable Generic (3.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:10:17 19:23:03+02:00
PEType: PE32
LinkerVersion: 14.16
CodeSize: 1922560
InitializedDataSize: 794112
UninitializedDataSize: -
EntryPoint: 0x80300
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 19.174.902.13
ProductVersionNumber: 19.174.902.13
FileFlagsMask: 0x003f
FileFlags: Special build
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Standalone Updater
InternalName: OneDriveStandaloneUpdater.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: OneDriveStandaloneUpdater.exe
ProductName: Microsoft OneDrive
FileVersion: 19.174.0902.0013
ProductVersion: 19.174.0902.0013
SpecialBuild: b/build/179d15c3-2fa2-5e1e-6604-ecc065df4d94

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 17-Oct-2019 17:23:03
Detected languages:
  • English - United States
Debug artifacts:
  • d:\dbs\sh\odct\1017_101750_1\client\onedrive\Product\StandaloneUpdater\exe\obj\i386\OneDriveStandaloneUpdater.pdb
CompanyName: Microsoft Corporation
FileDescription: Standalone Updater
InternalName: OneDriveStandaloneUpdater.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: OneDriveStandaloneUpdater.exe
ProductName: Microsoft OneDrive
FileVersion: 19.174.0902.0013
ProductVersion: 19.174.0902.0013
SpecialBuild: b/build/179d15c3-2fa2-5e1e-6604-ecc065df4d94

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 17-Oct-2019 17:23:03
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x001D54EA
0x001D5600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.67123
.rdata
0x001D7000
0x0008D730
0x0008D800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.20757
.data
0x00265000
0x00018F48
0x00015A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.15623
.didat
0x0027E000
0x00000024
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.35032
.rsrc
0x0027F000
0x00000B60
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.65018
.reloc
0x00280000
0x0001A60C
0x0001A800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.64778

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.23485
1331
UNKNOWN
English - United States
RT_MANIFEST
MICROSOFTEDPENLIGHTENEDAPPINFO
1
2
UNKNOWN
English - United States
EDPENLIGHTENEDAPPINFOID
MICROSOFTEDPPERMISSIVEAPPINFO
1
2
UNKNOWN
English - United States
EDPPERMISSIVEAPPINFOID

Imports

ADVAPI32.dll
CRYPT32.dll
IPHLPAPI.DLL
KERNEL32.dll
OLEAUT32.dll
PSAPI.DLL
RPCRT4.dll
SHELL32.dll
SHLWAPI.dll
Secur32.dll

Exports

Title
Ordinal
Address
??0EventProperties@Telemetry@Applications@Microsoft@@QAE@ABV0123@@Z
1
0x000AF5A0
??0EventProperties@Telemetry@Applications@Microsoft@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
2
0x000AF630
??0EventProperties@Telemetry@Applications@Microsoft@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Telemetry@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Telemetry@Applications@Microsoft@@@std@@@2@@5@@Z
3
0x000AF710
??0EventProperties@Telemetry@Applications@Microsoft@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Telemetry@Applications@Microsoft@@@std@@@5@@Z
4
0x000AF750
??0EventProperty@Telemetry@Applications@Microsoft@@QAE@$QAU0123@@Z
5
0x000AF7B0
??0EventProperty@Telemetry@Applications@Microsoft@@QAE@ABU0123@@Z
6
0x000AF7B0
??0EventProperty@Telemetry@Applications@Microsoft@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@@Z
7
0x000AF7F0
??0EventProperty@Telemetry@Applications@Microsoft@@QAE@CW4PiiKind@123@@Z
8
0x000AF830
??0EventProperty@Telemetry@Applications@Microsoft@@QAE@EW4PiiKind@123@@Z
9
0x000AF860
??0EventProperty@Telemetry@Applications@Microsoft@@QAE@FW4PiiKind@123@@Z
10
0x000AF890
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start onedrivestandaloneupdater.exe no specs onedrivesetup.exe onedrivesetup.exe filesyncconfig.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1504C:\Users\admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /enableExtractCabV2 C:\Users\admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
OneDriveSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive (32 bit) Setup
Exit code:
0
Version:
19.174.0902.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\standaloneupdater\onedrivesetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wer.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2232"C:\Users\admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update /updateSource:ODSUC:\Users\admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
OneDriveStandaloneUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive (32 bit) Setup
Exit code:
0
Version:
19.174.0902.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\standaloneupdater\onedrivesetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wer.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2828"C:\Users\admin\AppData\Local\Temp\OneDriveStandaloneUpdater.exe" C:\Users\admin\AppData\Local\Temp\OneDriveStandaloneUpdater.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Standalone Updater
Exit code:
0
Version:
19.174.0902.0013
Modules
Images
c:\users\admin\appdata\local\temp\onedrivestandaloneupdater.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3124"C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.174.0902.0013\FileSyncConfig.exe" C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.174.0902.0013\FileSyncConfig.exe—OneDriveSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive Configuration Application
Exit code:
0
Version:
19.174.0902.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.174.0902.0013\filesyncconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\onedrive\19.174.0902.0013\updateringsettings.dll
c:\users\admin\appdata\local\microsoft\onedrive\19.174.0902.0013\loggingplatform.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
1 966
Read events
1 179
Write events
772
Delete events
15

Modification events

(PID) Process:(2828) OneDriveStandaloneUpdater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive
Operation:writeName:StandaloneUpdaterSafeMode
Value:
1
(PID) Process:(2828) OneDriveStandaloneUpdater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive\Installer\BITS\PreSignInSettingsConfigJSON
Operation:writeName:GUID
Value:
D0A51EACD6BB0D4CA666E3306AD6F57D
(PID) Process:(2828) OneDriveStandaloneUpdater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive\Installer\BITS\PreSignInSettingsConfigJSON
Operation:writeName:File
Value:
wctADAF.tmp
(PID) Process:(2828) OneDriveStandaloneUpdater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive\Installer\BITS\PreSignInSettingsConfigJSON
Operation:delete valueName:GUID
Value:
D0A51EACD6BB0D4CA666E3306AD6F57D
(PID) Process:(2828) OneDriveStandaloneUpdater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive\Installer\BITS\PreSignInSettingsConfigJSON
Operation:delete valueName:File
Value:
wctADAF.tmp
(PID) Process:(2828) OneDriveStandaloneUpdater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive\Installer\BITS\PreSignInSettingsConfigJSON
Operation:delete keyName:
Value:
(PID) Process:(2828) OneDriveStandaloneUpdater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive
Operation:writeName:OSVerODRanFirstTime
Value:
6.1.7601
(PID) Process:(2828) OneDriveStandaloneUpdater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive\Installer\BITS\UpdateDescriptionXml
Operation:writeName:GUID
Value:
23E3B1BB925A3549A060C1020F3A8DD2
(PID) Process:(2828) OneDriveStandaloneUpdater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive\Installer\BITS\UpdateDescriptionXml
Operation:writeName:File
Value:
wctDA2F.tmp
(PID) Process:(2828) OneDriveStandaloneUpdater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive\Installer\BITS\UpdateDescriptionXml
Operation:delete valueName:GUID
Value:
23E3B1BB925A3549A060C1020F3A8DD2
Executable files
221
Suspicious files
10
Text files
310
Unknown types
9

Dropped files

PID
Process
Filename
Type
2828OneDriveStandaloneUpdater.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe —
MD5:—
SHA256:—
2828OneDriveStandaloneUpdater.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2019-11-20.0658.2828.1.aodl —
MD5:—
SHA256:—
2232OneDriveSetup.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session-journal —
MD5:—
SHA256:—
2232OneDriveSetup.exeC:\Users\admin\AppData\Local\Temp\tmp3426.tmp —
MD5:—
SHA256:—
1504OneDriveSetup.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session-journal —
MD5:—
SHA256:—
1504OneDriveSetup.exeC:\Users\admin\AppData\Local\Temp\tmp3686.tmp —
MD5:—
SHA256:—
2828OneDriveStandaloneUpdater.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2019-11-20.0658.2828.1.odlbinary
MD5:—
SHA256:—
2232OneDriveSetup.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2019-11-20.0658.2232.1.aodlbinary
MD5:—
SHA256:—
2828OneDriveStandaloneUpdater.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\Update.xmlxml
MD5:—
SHA256:—
2828OneDriveStandaloneUpdater.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.jsontext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.36.252.129:443
g.live.com
—
US
whitelisted
—
—
2.18.234.129:443
oneclient.sfx.ms
Akamai International B.V.
—
whitelisted
1504
OneDriveSetup.exe
52.114.77.34:443
mobile.pipe.aria.microsoft.com
Microsoft Corporation
IE
unknown
2232
OneDriveSetup.exe
52.114.77.34:443
mobile.pipe.aria.microsoft.com
Microsoft Corporation
IE
unknown

DNS requests

Domain
IP
Reputation
g.live.com
  • 20.36.252.129
whitelisted
oneclient.sfx.ms
  • 2.18.234.129
suspicious
mobile.pipe.aria.microsoft.com
  • 52.114.77.34
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
OneDriveStandaloneUpdater.exe