Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2023, 17:48

General

  • Target

    cheker.exe

  • Size

    921KB

  • MD5

    41394beb6f31b8215c7b9d0b8d412c3e

  • SHA1

    c0436e7d59d3be57a1edc94ce52a5e03312aa368

  • SHA256

    9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

  • SHA512

    dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

  • SSDEEP

    24576:n6A4MROxnF43F9MQrrZlI0AilFEvxHihrTE:n6jMiG4wrZlI0AilFEvxHih

Malware Config

Extracted

Family

orcus

C2

147.185.221.229:56094

Mutex

0a90560fd1de4ef0859fc02bececce78

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\svhost\svhost.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\svhost.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 3 IoCs
  • Orcurs Rat Executable 6 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cheker.exe
    "C:\Users\Admin\AppData\Local\Temp\cheker.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\atxprgob.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21E4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC21E3.tmp"
        3⤵
          PID:520
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:1864
      • C:\Program Files\svhost\svhost.exe
        "C:\Program Files\svhost\svhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Users\Admin\AppData\Roaming\svhost.exe
          "C:\Users\Admin\AppData\Roaming\svhost.exe" /launchSelfAndExit "C:\Program Files\svhost\svhost.exe" 432 /protectFile
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1356
          • C:\Users\Admin\AppData\Roaming\svhost.exe
            "C:\Users\Admin\AppData\Roaming\svhost.exe" /watchProcess "C:\Program Files\svhost\svhost.exe" 432 "/protectFile"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1324
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:1580
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {76B25619-7331-4FAC-B9AD-72650C9D435B} S-1-5-21-2647223082-2067913677-935928954-1000:BPOQNXYB\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Program Files\svhost\svhost.exe
        "C:\Program Files\svhost\svhost.exe"
        2⤵
        • Executes dropped EXE
        PID:2024

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\svhost\svhost.exe

      Filesize

      921KB

      MD5

      41394beb6f31b8215c7b9d0b8d412c3e

      SHA1

      c0436e7d59d3be57a1edc94ce52a5e03312aa368

      SHA256

      9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

      SHA512

      dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

    • C:\Program Files\svhost\svhost.exe

      Filesize

      921KB

      MD5

      41394beb6f31b8215c7b9d0b8d412c3e

      SHA1

      c0436e7d59d3be57a1edc94ce52a5e03312aa368

      SHA256

      9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

      SHA512

      dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

    • C:\Program Files\svhost\svhost.exe

      Filesize

      921KB

      MD5

      41394beb6f31b8215c7b9d0b8d412c3e

      SHA1

      c0436e7d59d3be57a1edc94ce52a5e03312aa368

      SHA256

      9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

      SHA512

      dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

    • C:\Program Files\svhost\svhost.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • C:\Users\Admin\AppData\Local\Temp\RES21E4.tmp

      Filesize

      1KB

      MD5

      e93be64e0f43931bd8f3d7ca0758fee1

      SHA1

      46483515b1eb439f033976e3dcad8d70abb56e65

      SHA256

      3936e3cefa3202cf23da5291377f864e6fb405d9dbd9113da8a40b4f3816c353

      SHA512

      f6cbb538f2f8ad92064464feb6be9aff6d83fdf13e1e65debaa5cf798023bedf9225d61fd24f23462554663eb749b543b3a2fb4997f450b24bedb0b5ff176771

    • C:\Users\Admin\AppData\Local\Temp\atxprgob.dll

      Filesize

      76KB

      MD5

      4394bcad1e3bcf018e52d17b3aade851

      SHA1

      0fb4adb69efa92c270a8f1d8408cae008ad93ecd

      SHA256

      401457397fcd335dfb25db09e1a62c92b3dfe59adb24dbf93ce66f01f2e7f283

      SHA512

      f6c09f517ec73c14fbacf4749d8add4c1f56bdef715fead5ab87375ece85ea970332a485ab4a2aea76fc34f3e269a180d65b3d7a7ff976d78371d9421c1aade9

    • C:\Users\Admin\AppData\Roaming\svhost.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Roaming\svhost.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Roaming\svhost.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Roaming\svhost.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • C:\Users\Admin\AppData\Roaming\svhost\err_0a90560fd1de4ef0859fc02bececce78.dat

      Filesize

      1KB

      MD5

      fe651dc08bf638a724d62f3e59bd7921

      SHA1

      206baef93bdd29ef1d5ade6355ba73248c05c756

      SHA256

      d4d2d213df7b6b1abad2c5615fe67e3ed2e00cc8278761cac139a1e61f86c2ac

      SHA512

      a6af48d2e7cb7f7ae52a270a6029cb55f73c2907fbfbe9b9d16406293ae1bae932172d21d617754d2e2575caa4594b2c32f47e2272468ec31c4a1365fe07bedd

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC21E3.tmp

      Filesize

      676B

      MD5

      e65ae450fd4a1d2c4c5c0983ae271305

      SHA1

      2f633194593b603ff6891e9667b64a374af460af

      SHA256

      56b0b809aa8fa7bb3ebe3e29d2047cb2870bb390bf84208c92f33526fcdcbe63

      SHA512

      14d2531589ef38e1802c294d1a33fdda99c6f0269693ce3026d7bb4568136195f0e98d35f0765f3c6e133280cc9c84993379077582899a3b363db4192843f4e6

    • \??\c:\Users\Admin\AppData\Local\Temp\atxprgob.0.cs

      Filesize

      208KB

      MD5

      c555d9796194c1d9a1310a05a2264e08

      SHA1

      82641fc4938680519c3b2e925e05e1001cbd71d7

      SHA256

      ccbb8fd27ab2f27fbbd871793886ff52ff1fbd9117c98b8d190c1a96b67e498a

      SHA512

      0b85ca22878998c7697c589739905b218f9b264a32c8f99a9f9dd73d0687a5de46cc7e851697ee16424baf94d301e411648aa2d061ac149a6d2e06b085e07090

    • \??\c:\Users\Admin\AppData\Local\Temp\atxprgob.cmdline

      Filesize

      349B

      MD5

      944f63e9d83c1b6f189474695c99bf90

      SHA1

      6b7c0905216a5caba3c18c6f6dcd28c775a698f0

      SHA256

      1c235c820cc54e13efc99f3e06990e370c900985eac0bfd6331a3387f111acf5

      SHA512

      57102d38fc12dbf7046da615eeb6a2ad73c73964b16204b04ecadc1870176d5002f27981ce5acda33d00afa3efb121a1c39b6cbf794f99b57895f5ef1bda880d

    • memory/432-113-0x000000001B1C0000-0x000000001B240000-memory.dmp

      Filesize

      512KB

    • memory/432-137-0x000000001B1C0000-0x000000001B240000-memory.dmp

      Filesize

      512KB

    • memory/432-102-0x000000001B1C0000-0x000000001B240000-memory.dmp

      Filesize

      512KB

    • memory/432-104-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

      Filesize

      64KB

    • memory/432-97-0x00000000011E0000-0x00000000012CC000-memory.dmp

      Filesize

      944KB

    • memory/432-103-0x0000000000B20000-0x0000000000B38000-memory.dmp

      Filesize

      96KB

    • memory/432-98-0x00000000008D0000-0x00000000008E2000-memory.dmp

      Filesize

      72KB

    • memory/432-138-0x000000001B1C0000-0x000000001B240000-memory.dmp

      Filesize

      512KB

    • memory/432-101-0x0000000000AB0000-0x0000000000AFE000-memory.dmp

      Filesize

      312KB

    • memory/1108-82-0x00000000020F0000-0x0000000002170000-memory.dmp

      Filesize

      512KB

    • memory/1108-56-0x00000000002A0000-0x00000000002AE000-memory.dmp

      Filesize

      56KB

    • memory/1108-54-0x00000000008D0000-0x00000000009BC000-memory.dmp

      Filesize

      944KB

    • memory/1108-55-0x0000000002170000-0x00000000021CC000-memory.dmp

      Filesize

      368KB

    • memory/1108-84-0x00000000020F0000-0x0000000002170000-memory.dmp

      Filesize

      512KB

    • memory/1108-72-0x00000000020F0000-0x0000000002170000-memory.dmp

      Filesize

      512KB

    • memory/1108-73-0x00000000021D0000-0x00000000021D8000-memory.dmp

      Filesize

      32KB

    • memory/1108-71-0x0000000000850000-0x0000000000862000-memory.dmp

      Filesize

      72KB

    • memory/1108-69-0x000000001AEA0000-0x000000001AEB6000-memory.dmp

      Filesize

      88KB

    • memory/1356-116-0x00000000003F0000-0x00000000003F8000-memory.dmp

      Filesize

      32KB

    • memory/1580-88-0x00000000001A0000-0x00000000001AC000-memory.dmp

      Filesize

      48KB

    • memory/1864-83-0x0000000000DE0000-0x0000000000DEC000-memory.dmp

      Filesize

      48KB

    • memory/2024-114-0x000000001B050000-0x000000001B0D0000-memory.dmp

      Filesize

      512KB