Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2023, 14:59

General

  • Target

    b8a4b96e05940a81a14122f78a6fa3a796615c325a6d44c344fc83cf38100547.exe

  • Size

    911KB

  • MD5

    1b752392a6ce80a4fd406d61589396a3

  • SHA1

    d3394b46da9fa47263071971355c4cbf543c8f17

  • SHA256

    b8a4b96e05940a81a14122f78a6fa3a796615c325a6d44c344fc83cf38100547

  • SHA512

    3c9084d2eb4ef936e985316dd7250f68a1934d07332429c896cff7dc982513b02e643175ffc56b1341ea3027f99f251b42f717c630c3f6f76087d71cac6db878

  • SSDEEP

    12288:Hy50ed4DkhUo2y27dG1lFlWcYT70pxnnaaoawVm1aBGyrZNrI0AilFEvxHvBMMYO:8zA4MROxnFnaBrZlI0AilFEvxHiVez

Malware Config

Extracted

Family

orcus

Botnet

NewPro

C2

216.170.120.141:42069

Mutex

d3d52ea46f88416fac4938bc6eb0a5d0

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Taber LLC\RMM\rmm.exe

  • reconnect_delay

    10000

  • registry_keyname

    RMM

  • taskscheduler_taskname

    RMM

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 3 IoCs
  • Orcurs Rat Executable 4 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8a4b96e05940a81a14122f78a6fa3a796615c325a6d44c344fc83cf38100547.exe
    "C:\Users\Admin\AppData\Local\Temp\b8a4b96e05940a81a14122f78a6fa3a796615c325a6d44c344fc83cf38100547.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\atvwerh0.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES98F6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC98F5.tmp"
        3⤵
          PID:2368
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:2584
      • C:\Program Files\Taber LLC\RMM\rmm.exe
        "C:\Program Files\Taber LLC\RMM\rmm.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2424
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:2752
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {689BE8B3-724E-4FD9-AFF3-8DD842B09167} S-1-5-21-2085049433-1067986815-1244098655-1000:AHLBRYJO\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Program Files\Taber LLC\RMM\rmm.exe
        "C:\Program Files\Taber LLC\RMM\rmm.exe"
        2⤵
        • Executes dropped EXE
        PID:2004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Taber LLC\RMM\rmm.exe

      Filesize

      911KB

      MD5

      1b752392a6ce80a4fd406d61589396a3

      SHA1

      d3394b46da9fa47263071971355c4cbf543c8f17

      SHA256

      b8a4b96e05940a81a14122f78a6fa3a796615c325a6d44c344fc83cf38100547

      SHA512

      3c9084d2eb4ef936e985316dd7250f68a1934d07332429c896cff7dc982513b02e643175ffc56b1341ea3027f99f251b42f717c630c3f6f76087d71cac6db878

    • C:\Program Files\Taber LLC\RMM\rmm.exe

      Filesize

      911KB

      MD5

      1b752392a6ce80a4fd406d61589396a3

      SHA1

      d3394b46da9fa47263071971355c4cbf543c8f17

      SHA256

      b8a4b96e05940a81a14122f78a6fa3a796615c325a6d44c344fc83cf38100547

      SHA512

      3c9084d2eb4ef936e985316dd7250f68a1934d07332429c896cff7dc982513b02e643175ffc56b1341ea3027f99f251b42f717c630c3f6f76087d71cac6db878

    • C:\Program Files\Taber LLC\RMM\rmm.exe

      Filesize

      911KB

      MD5

      1b752392a6ce80a4fd406d61589396a3

      SHA1

      d3394b46da9fa47263071971355c4cbf543c8f17

      SHA256

      b8a4b96e05940a81a14122f78a6fa3a796615c325a6d44c344fc83cf38100547

      SHA512

      3c9084d2eb4ef936e985316dd7250f68a1934d07332429c896cff7dc982513b02e643175ffc56b1341ea3027f99f251b42f717c630c3f6f76087d71cac6db878

    • C:\Program Files\Taber LLC\RMM\rmm.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • C:\Users\Admin\AppData\Local\Temp\RES98F6.tmp

      Filesize

      1KB

      MD5

      85a49af7252828ce5393dc057fdde298

      SHA1

      21fefe1aacd728269565152b12802f60e715ab80

      SHA256

      60436d9e2e62fb5bfc3d721b3e7e80e75b6c88d1ef26a8be422f114b04f3c6e0

      SHA512

      49e179819791860830e94f17ccabfdc617b1d69be4cb6e36ecd548c75dc3ee575bcf5638d3c7e7ba09d95d3cfb4884279415a7c4faa12f949cd5adaa38eb0b2b

    • C:\Users\Admin\AppData\Local\Temp\atvwerh0.dll

      Filesize

      76KB

      MD5

      65c70a1bba89d0e15fedf098b6adc433

      SHA1

      aa1a98a7a6c161a84b3dd7dee5f6e85cf9ba7a43

      SHA256

      f202072de0f0914288bd5d68630eb5bbd22ac570ca59760de7d58f9cb29a063b

      SHA512

      7595e395e774566b4036d26648ea6392b0ebbc77cbe460af731772d3c05308cb479f1368288431f8b5105724d6f1e08a3dcf5e83af4600b20e02c8aacc2332e2

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC98F5.tmp

      Filesize

      676B

      MD5

      29597c927c9e70ed703a5fd8747e353b

      SHA1

      7d413d085a94a8bad878964adb00d5abf8046059

      SHA256

      fb9b4ebc95d71978da8eb1c679c4f90cf35a9595027beeb65e001791c2814ec7

      SHA512

      7e0a6eb8599a9607e8780e35ce55a4bbacf73d3d2f246ef721af855ab27891fba084281f4f9472fd746a580f11fe45eceeca45e202be5779bf8d7ce66c867dc3

    • \??\c:\Users\Admin\AppData\Local\Temp\atvwerh0.0.cs

      Filesize

      208KB

      MD5

      6011503497b1b9250a05debf9690e52c

      SHA1

      897aea61e9bffc82d7031f1b3da12fb83efc6d82

      SHA256

      08f42b8d57bb61bc8f9628c8a80953b06ca4149d50108083fca6dc26bdd49434

      SHA512

      604c33e82e8b5bb5c54389c2899c81e5482a06e69db08268173a5b4574327ee5de656d312011d07e50a2e398a4c9b0cd79029013f76e05e18cf67ce5a916ffd9

    • \??\c:\Users\Admin\AppData\Local\Temp\atvwerh0.cmdline

      Filesize

      349B

      MD5

      cb4bfd74272b946c47ee437cb3e36dd0

      SHA1

      f32b594580bcb3545a9753ace6f84bffc5eb4cc3

      SHA256

      83d1739a740dde70362af9162e75ff8854ac63e50495ba30d14fe4fdb6302e8d

      SHA512

      f913d554412a5d978d70133ae6cc5b713f159e2064db915cd4038a7defdad037fd45f8ea1983a4fb92865703d089942fbaa94544c349bcf828c6cbaa27c37757

    • memory/2004-56-0x000000001AD00000-0x000000001AD80000-memory.dmp

      Filesize

      512KB

    • memory/2004-58-0x000007FEEDF50000-0x000007FEEE93C000-memory.dmp

      Filesize

      9.9MB

    • memory/2004-54-0x000007FEEDF50000-0x000007FEEE93C000-memory.dmp

      Filesize

      9.9MB

    • memory/2424-52-0x000000001AF80000-0x000000001B000000-memory.dmp

      Filesize

      512KB

    • memory/2424-57-0x000000001AF80000-0x000000001B000000-memory.dmp

      Filesize

      512KB

    • memory/2424-50-0x0000000000B90000-0x0000000000BDE000-memory.dmp

      Filesize

      312KB

    • memory/2424-51-0x0000000000DA0000-0x0000000000DB8000-memory.dmp

      Filesize

      96KB

    • memory/2424-49-0x000000001AF80000-0x000000001B000000-memory.dmp

      Filesize

      512KB

    • memory/2424-63-0x000000001AF80000-0x000000001B000000-memory.dmp

      Filesize

      512KB

    • memory/2424-55-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

      Filesize

      64KB

    • memory/2424-60-0x000007FEEDF50000-0x000007FEEE93C000-memory.dmp

      Filesize

      9.9MB

    • memory/2424-46-0x0000000001370000-0x000000000145A000-memory.dmp

      Filesize

      936KB

    • memory/2424-61-0x000000001AF80000-0x000000001B000000-memory.dmp

      Filesize

      512KB

    • memory/2424-48-0x000007FEEDF50000-0x000007FEEE93C000-memory.dmp

      Filesize

      9.9MB

    • memory/2424-62-0x000000001AF80000-0x000000001B000000-memory.dmp

      Filesize

      512KB

    • memory/2584-29-0x000007FEEE940000-0x000007FEEF32C000-memory.dmp

      Filesize

      9.9MB

    • memory/2584-28-0x0000000000AB0000-0x0000000000ABC000-memory.dmp

      Filesize

      48KB

    • memory/2584-33-0x000007FEEE940000-0x000007FEEF32C000-memory.dmp

      Filesize

      9.9MB

    • memory/2584-30-0x000000001B090000-0x000000001B110000-memory.dmp

      Filesize

      512KB

    • memory/2752-36-0x000007FEEDF50000-0x000007FEEE93C000-memory.dmp

      Filesize

      9.9MB

    • memory/2752-37-0x00000000199F0000-0x0000000019A70000-memory.dmp

      Filesize

      512KB

    • memory/2752-35-0x0000000000290000-0x000000000029C000-memory.dmp

      Filesize

      48KB

    • memory/2752-59-0x000007FEEDF50000-0x000007FEEE93C000-memory.dmp

      Filesize

      9.9MB

    • memory/2776-10-0x00000000020D0000-0x0000000002150000-memory.dmp

      Filesize

      512KB

    • memory/2852-47-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

      Filesize

      9.6MB

    • memory/2852-0-0x00000000007D0000-0x000000000082C000-memory.dmp

      Filesize

      368KB

    • memory/2852-20-0x00000000002A0000-0x00000000002B2000-memory.dmp

      Filesize

      72KB

    • memory/2852-18-0x0000000002420000-0x0000000002436000-memory.dmp

      Filesize

      88KB

    • memory/2852-4-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

      Filesize

      9.6MB

    • memory/2852-2-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

      Filesize

      9.6MB

    • memory/2852-3-0x0000000002190000-0x0000000002210000-memory.dmp

      Filesize

      512KB

    • memory/2852-1-0x0000000000280000-0x000000000028E000-memory.dmp

      Filesize

      56KB