Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDriveSync' = '%APPDATA%\Microsoft\Vault\credential_manager.exe'
- [HKCU\Software\Classes\ms-settings\Shell\Open\command] '' = '"%APPDATA%\Microsoft\Vault\credential_manager.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\onedrivestandaloneupdater
- %APPDATA%\microsoft\windows\start menu\programs\startup\onedrive.lnk
Modifies file system
Creates the following files
- %APPDATA%\microsoft\vault\credential_manager.exe
- nul
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\vault\credential_manager.exe
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\vault\credential_manager.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /TN "OneDriveStandaloneUpdater" /TR "'%APPDATA%\Microsoft\Vault\credential_manager.exe'" /SC MINUTE /MO 15 /F >nul 2>&1
- '<SYSTEM32>\schtasks.exe' /Create /TN "OneDriveStandaloneUpdater" /TR "'%APPDATA%\Microsoft\Vault\credential_manager.exe'" /SC MINUTE /MO 15 /F
- '<SYSTEM32>\cmd.exe' /c powershell -c "$s=New-Object -ComObject WScript.Shell;$l=$s.CreateShortcut('%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk');$l.TargetPath='%APPDATA%\Microsoft\Vault\cr...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$s=New-Object -ComObject WScript.Shell;$l=$s.CreateShortcut('%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk');$l.TargetPath='%APPDATA%\Microsoft\Vault\credential_manag...
- '<SYSTEM32>\computerdefaults.exe'
- '<SYSTEM32>\computerdefaults.exe' ' (with hidden window)
- '%APPDATA%\microsoft\vault\credential_manager.exe' ' (with hidden window)
