| File name: | CapturaMalware.pcapng |
| Full analysis: | https://app.any.run/tasks/b3a94bd7-b8c9-4d84-9884-cfecf7249d5a |
| Verdict: | Malicious activity |
| Analysis date: | September 12, 2024, 17:09:50 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| MIME: | application/octet-stream |
| File info: | pcapng capture file - version 1.0 |
| MD5: | F124D9C65D6826C69B3F9A20A29B7BCA |
| SHA1: | CD21E863BA60B1AF9BB73212E890D18F17209232 |
| SHA256: | 96986CBEAE86854556037E2E29553E4F4521D737C649DED619114434E5555B43 |
| SSDEEP: | 98304:forj7Pw3HA7ZovowfTbrcSr2ZrXzbpuP8Qas7U7m/oh6uuKpU966unjYaGhpTamu:Bo/yw |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- OneDrive.exe (PID: 1108)
Creates/Modifies COM task schedule object
- OneDrive.exe (PID: 1108)
Checks Windows Trust Settings
- OneDrive.exe (PID: 1108)
INFO
Checks supported languages
- OneDrive.exe (PID: 1108)
Manual execution by a user
- OneDrive.exe (PID: 1108)
Creates files or folders in the user directory
- OneDrive.exe (PID: 1108)
Reads Microsoft Office registry keys
- OpenWith.exe (PID: 3236)
Reads the time zone
- OneDrive.exe (PID: 1108)
Checks proxy server information
- OneDrive.exe (PID: 1108)
Reads the software policy settings
- OneDrive.exe (PID: 1108)
Reads CPU info
- OneDrive.exe (PID: 1108)
Reads the computer name
- OneDrive.exe (PID: 1108)
Reads the machine GUID from the registry
- OneDrive.exe (PID: 1108)
Create files in a temporary directory
- OneDrive.exe (PID: 1108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .pcapng | | | Wireshark PCAP Next Generation Dump File Format (Little Endian) (79.9) |
|---|---|---|
| .pcx | | | ZSoft PCX bitmap (20) |
Total processes
123
Monitored processes
3
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1108 | "C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" | C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft OneDrive Version: 19.043.0304.0013 Modules
| |||||||||||||||
| 3236 | "C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\AppData\Local\Temp\CapturaMalware.pcapng | C:\Windows\System32\OpenWith.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Pick an app Exit code: 2147943623 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7088 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
2 203
Read events
2 040
Write events
156
Delete events
7
Modification events
| (PID) Process: | (1108) OneDrive.exe | Key: | HKEY_CLASSES_ROOT\AppID\OneDrive.EXE |
| Operation: | write | Name: | AppID |
Value: {EEABD3A3-784D-4334-AAFC-BB13234F17CF} | |||
| (PID) Process: | (1108) OneDrive.exe | Key: | HKEY_CLASSES_ROOT\FileSyncClient.AutoPlayHandler\shell\import\DropTarget |
| Operation: | write | Name: | CLSID |
Value: {5999E1EE-711E-48D2-9884-851A709F543D} | |||
| (PID) Process: | (1108) OneDrive.exe | Key: | HKEY_CLASSES_ROOT\BannerNotificationHandler.BannerNotificationHandler\shell\import\DropTarget |
| Operation: | write | Name: | CLSID |
Value: {2e7c0a19-0438-41e9-81e3-3ad3d64f55ba} | |||
| (PID) Process: | (1108) OneDrive.exe | Key: | HKEY_CLASSES_ROOT\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
| (PID) Process: | (1108) OneDrive.exe | Key: | HKEY_CLASSES_ROOT\WOW6432Node\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
| (PID) Process: | (1108) OneDrive.exe | Key: | HKEY_CLASSES_ROOT\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
| (PID) Process: | (1108) OneDrive.exe | Key: | HKEY_CLASSES_ROOT\WOW6432Node\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
| (PID) Process: | (1108) OneDrive.exe | Key: | HKEY_CLASSES_ROOT\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
| (PID) Process: | (1108) OneDrive.exe | Key: | HKEY_CLASSES_ROOT\WOW6432Node\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
| (PID) Process: | (1108) OneDrive.exe | Key: | HKEY_CLASSES_ROOT\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
Executable files
0
Suspicious files
10
Text files
3
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1108 | OneDrive.exe | C:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc.session-journal | binary | |
MD5:BBC47408E3B3F093970915F371041F33 | SHA256:A838AAF8C4CA176EF9FCB1DC73B8BC2F15E33EA50B4334973F479FCFF798F054 | |||
| 1108 | OneDrive.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A | binary | |
MD5:B5F5C5F1DDBDA4ED003D5A5741912714 | SHA256:64A6EC2AFA4F9964782AE7DB751DC88FFA4BD183AEA5E41763438E8960E69D36 | |||
| 1108 | OneDrive.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A | der | |
MD5:AC79DCDA0DEA35DFAE3ADFBCA78DCF88 | SHA256:09BA21B3D5253B3513003D7F6D2F5459518885638BFC7F59403446F52865EB1B | |||
| 1108 | OneDrive.exe | C:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc.session | binary | |
MD5:580BD824DEBBA908591408D7A5A3D01F | SHA256:B3218FF93047231A34C6962C758A36D412C2EB928C33F7EE537023EB6E489974 | |||
| 1108 | OneDrive.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 | der | |
MD5:4CA172E9A28765F92A0DE62654E8631F | SHA256:270464D57123C9EB859DBF7B149BD8E32BCC6F6C4B407EB038E20816B9CD96A4 | |||
| 1108 | OneDrive.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\update100[1].xml | xml | |
MD5:53244E542DDF6D280A2B03E28F0646B7 | SHA256:36A6BD38A8A6F5A75B73CAFFAE5AE66DFABCAEFD83DA65B493FA881EA8A64E7D | |||
| 1108 | OneDrive.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 | binary | |
MD5:D14D79BA394C99C3F700187B71D5C6AD | SHA256:10149C1DB9D5C2AAE4C288D8CCA51E2845F5F761D09E118AE53ADB4C9A002680 | |||
| 1108 | OneDrive.exe | C:\Users\admin\AppData\Local\Microsoft\OneDrive\Update\update.xml | xml | |
MD5:53244E542DDF6D280A2B03E28F0646B7 | SHA256:36A6BD38A8A6F5A75B73CAFFAE5AE66DFABCAEFD83DA65B493FA881EA8A64E7D | |||
| 1108 | OneDrive.exe | C:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Personal\TraceArchive.0304.0013-36.etl | abr | |
MD5:97596EEBD1886A7637AEC1F4739959FC | SHA256:43A342C94BDA9B236D3D1F45711C0B2FB9FA179CF7E0C9252E6DB0EE1930811F | |||
| 1108 | OneDrive.exe | C:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Personal\SyncEngine-2024-09-12.1710.1108.1.aodl | binary | |
MD5:28DCA2FF4B34B5A52A2E59DF202A6ED3 | SHA256:33BACCB7296F1ED1F995FC77A23049F261CF391AC0388F9E8DD161F8C17B7F94 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
31
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2120 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1780 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
3160 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | whitelisted |
3160 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1108 | OneDrive.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | whitelisted |
1108 | OneDrive.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEASGp3XRNgzfylEWBFW6KKc%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2120 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1780 | svchost.exe | 20.190.160.20:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1780 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
6192 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5336 | SearchApp.exe | 104.126.37.176:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.bing.com |
| whitelisted |
fp.msedge.net |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |