Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2023, 17:48

General

  • Target

    cheker.exe

  • Size

    921KB

  • MD5

    41394beb6f31b8215c7b9d0b8d412c3e

  • SHA1

    c0436e7d59d3be57a1edc94ce52a5e03312aa368

  • SHA256

    9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

  • SHA512

    dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

  • SSDEEP

    24576:n6A4MROxnF43F9MQrrZlI0AilFEvxHihrTE:n6jMiG4wrZlI0AilFEvxHih

Malware Config

Extracted

Family

orcus

C2

147.185.221.229:56094

Mutex

0a90560fd1de4ef0859fc02bececce78

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\svhost\svhost.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\svhost.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 4 IoCs
  • Orcurs Rat Executable 5 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cheker.exe
    "C:\Users\Admin\AppData\Local\Temp\cheker.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fiyddxsp.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7092.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7091.tmp"
        3⤵
          PID:516
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:3696
      • C:\Program Files\svhost\svhost.exe
        "C:\Program Files\svhost\svhost.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Users\Admin\AppData\Roaming\svhost.exe
          "C:\Users\Admin\AppData\Roaming\svhost.exe" /launchSelfAndExit "C:\Program Files\svhost\svhost.exe" 4424 /protectFile
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3680
          • C:\Users\Admin\AppData\Roaming\svhost.exe
            "C:\Users\Admin\AppData\Roaming\svhost.exe" /watchProcess "C:\Program Files\svhost\svhost.exe" 4424 "/protectFile"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1876
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:4004
    • C:\Program Files\svhost\svhost.exe
      "C:\Program Files\svhost\svhost.exe"
      1⤵
      • Executes dropped EXE
      PID:1172

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\svhost\svhost.exe

      Filesize

      921KB

      MD5

      41394beb6f31b8215c7b9d0b8d412c3e

      SHA1

      c0436e7d59d3be57a1edc94ce52a5e03312aa368

      SHA256

      9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

      SHA512

      dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

    • C:\Program Files\svhost\svhost.exe

      Filesize

      921KB

      MD5

      41394beb6f31b8215c7b9d0b8d412c3e

      SHA1

      c0436e7d59d3be57a1edc94ce52a5e03312aa368

      SHA256

      9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

      SHA512

      dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

    • C:\Program Files\svhost\svhost.exe

      Filesize

      921KB

      MD5

      41394beb6f31b8215c7b9d0b8d412c3e

      SHA1

      c0436e7d59d3be57a1edc94ce52a5e03312aa368

      SHA256

      9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

      SHA512

      dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

    • C:\Program Files\svhost\svhost.exe

      Filesize

      921KB

      MD5

      41394beb6f31b8215c7b9d0b8d412c3e

      SHA1

      c0436e7d59d3be57a1edc94ce52a5e03312aa368

      SHA256

      9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

      SHA512

      dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

    • C:\Program Files\svhost\svhost.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svhost.exe.log

      Filesize

      425B

      MD5

      4eaca4566b22b01cd3bc115b9b0b2196

      SHA1

      e743e0792c19f71740416e7b3c061d9f1336bf94

      SHA256

      34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

      SHA512

      bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

    • C:\Users\Admin\AppData\Local\Temp\RES7092.tmp

      Filesize

      1KB

      MD5

      e5599ec3756d9d4578987818f06f7fae

      SHA1

      decd56068b0d383821c10c96ccf6ccca83e379ec

      SHA256

      962ed9d0d51d6d7cba753e00a24cc53b0803ef6d9494e7fa18dfd4d39f40c682

      SHA512

      3ec2fd146428198d6367a50404b0ede4682fec8637154cfd5dd386c10f51d5436baa17a29c95e71cf249f9ef540fd74899d50223b5eeba77a6a6a5aa926abfaa

    • C:\Users\Admin\AppData\Local\Temp\fiyddxsp.dll

      Filesize

      76KB

      MD5

      9584bda64fe97162484b2a1dbc92fd31

      SHA1

      90bbf1bec446b1d44bc2702fa93f2ca3fa719146

      SHA256

      d7907e76da26317f8fc88aec7953f46f0a6d98f16a5e3e1fe456c817af608ea6

      SHA512

      e200c3ad7d201e918bdb663b662513d1fc526bc02130d82c62e6c9e393f54bf8ba053a2be132ba7c4b8f5bad3fb0752251ef19fa14cd1534edbf63872e3008f0

    • C:\Users\Admin\AppData\Roaming\svhost.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Roaming\svhost.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Roaming\svhost.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Roaming\svhost.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Roaming\svhost.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • C:\Users\Admin\AppData\Roaming\svhost\err_0a90560fd1de4ef0859fc02bececce78.dat

      Filesize

      1KB

      MD5

      f94ed2aab1920e149aa554b0a9fefd6d

      SHA1

      accf059bf73e2c33c71953742bbfbfb0e3ed584a

      SHA256

      fee1200c5e16bbbda66d761ce481162c4e15eb110142e386ac27281c5f49abdf

      SHA512

      5bf9218917b751f503f08a76e06f62324da1eb097c3d80e15103beb3ca19b74b3dda70c89b56d64e7e97ba1a0321ef90c69b71e016ac308e3c8ba7b29fe087d1

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC7091.tmp

      Filesize

      676B

      MD5

      03b34b13abfd358c63bf78af89d1033c

      SHA1

      c4676167b5745dc2cda0e2f7396cacd6c39b27cf

      SHA256

      b024c0855ca6639616416a387a38aff07605c94895a0f3bfed97138f234b84c2

      SHA512

      8d4911b330ef77bf46fdd2515d42346cb47d9a4f0b81d07e92ff6dc849abc5ceb3e71fe2559f8db6312f9c46c7bc00a7629e2a5544220b88d710f2e0bc8d2d8e

    • \??\c:\Users\Admin\AppData\Local\Temp\fiyddxsp.0.cs

      Filesize

      208KB

      MD5

      7f692bf08fcef7d0093a44c9323492fc

      SHA1

      6db49df61b132af5fdc05cb920abb33baa9dc503

      SHA256

      e8d6053a3c72e43bcfd45a74906a6eeea57a80224b175f364e9f0d3a9f91f485

      SHA512

      5ca9560fbf5f0475e0b2f4cb0cf7c1b2565b111a8783b6759c08f03cc239a57b62e1b4e388534aefb94d58b384576ace88775e762f5d7178078648e1b5ce8084

    • \??\c:\Users\Admin\AppData\Local\Temp\fiyddxsp.cmdline

      Filesize

      349B

      MD5

      60c4dc6068385e0e2e79fe82f5cd9dd7

      SHA1

      4a67a92a1ce70b38a6c0e64119c12467725daf25

      SHA256

      c62ceeb6a559bb7cdce0456b6e44ab3182dd8edfffba8f2e41b07faefd082202

      SHA512

      4e0d86bc20fba9ec072d433ab3f5bbd6193c2d0259541416dcb50121b18ed7208e3f05b50a820720d49b97f30f873237f4f41a6115123c9f43fddd97cb2992ca

    • memory/1172-211-0x0000000002C50000-0x0000000002C60000-memory.dmp

      Filesize

      64KB

    • memory/1300-155-0x000000001B0B0000-0x000000001B0C2000-memory.dmp

      Filesize

      72KB

    • memory/1300-139-0x000000001B840000-0x000000001BD0E000-memory.dmp

      Filesize

      4.8MB

    • memory/1300-133-0x0000000000090000-0x000000000017C000-memory.dmp

      Filesize

      944KB

    • memory/1300-159-0x000000001D740000-0x000000001D830000-memory.dmp

      Filesize

      960KB

    • memory/1300-134-0x0000000000690000-0x00000000006A0000-memory.dmp

      Filesize

      64KB

    • memory/1300-135-0x000000001B150000-0x000000001B1AC000-memory.dmp

      Filesize

      368KB

    • memory/1300-138-0x000000001B310000-0x000000001B31E000-memory.dmp

      Filesize

      56KB

    • memory/1300-158-0x000000001D180000-0x000000001D73A000-memory.dmp

      Filesize

      5.7MB

    • memory/1300-160-0x000000001C980000-0x000000001C99E000-memory.dmp

      Filesize

      120KB

    • memory/1300-140-0x000000001BDB0000-0x000000001BE4C000-memory.dmp

      Filesize

      624KB

    • memory/1300-157-0x000000001C820000-0x000000001C882000-memory.dmp

      Filesize

      392KB

    • memory/1300-156-0x0000000000C50000-0x0000000000C58000-memory.dmp

      Filesize

      32KB

    • memory/1300-162-0x000000001D910000-0x000000001D980000-memory.dmp

      Filesize

      448KB

    • memory/1300-153-0x000000001C430000-0x000000001C446000-memory.dmp

      Filesize

      88KB

    • memory/1300-163-0x0000000000690000-0x00000000006A0000-memory.dmp

      Filesize

      64KB

    • memory/1300-161-0x000000001D830000-0x000000001D879000-memory.dmp

      Filesize

      292KB

    • memory/1300-166-0x0000000000690000-0x00000000006A0000-memory.dmp

      Filesize

      64KB

    • memory/1300-165-0x000000001DBC0000-0x000000001DBE0000-memory.dmp

      Filesize

      128KB

    • memory/3680-224-0x0000000000290000-0x0000000000298000-memory.dmp

      Filesize

      32KB

    • memory/3696-182-0x000000001B360000-0x000000001B39C000-memory.dmp

      Filesize

      240KB

    • memory/3696-181-0x0000000002910000-0x0000000002922000-memory.dmp

      Filesize

      72KB

    • memory/3696-180-0x00000000007D0000-0x00000000007DC000-memory.dmp

      Filesize

      48KB

    • memory/4004-188-0x0000000019EE0000-0x0000000019EF0000-memory.dmp

      Filesize

      64KB

    • memory/4004-187-0x000000001A300000-0x000000001A40A000-memory.dmp

      Filesize

      1.0MB

    • memory/4004-231-0x0000000019EE0000-0x0000000019EF0000-memory.dmp

      Filesize

      64KB

    • memory/4424-208-0x000000001C870000-0x000000001CA32000-memory.dmp

      Filesize

      1.8MB

    • memory/4424-212-0x000000001BA00000-0x000000001BA10000-memory.dmp

      Filesize

      64KB

    • memory/4424-204-0x000000001BA00000-0x000000001BA10000-memory.dmp

      Filesize

      64KB

    • memory/4424-232-0x000000001BA00000-0x000000001BA10000-memory.dmp

      Filesize

      64KB

    • memory/4424-233-0x000000001BA00000-0x000000001BA10000-memory.dmp

      Filesize

      64KB