Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    253s
  • max time network
    304s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2023, 15:08

General

  • Target

    78978a36b56e68b07d49c3e380f30c7c12668edc3bb71761c2bd8b05b416fcb1.exe

  • Size

    911KB

  • MD5

    4e959e6b6bcb3b88d1b791f397009ace

  • SHA1

    03c6825264db0b9f7e84984e4833fa3450f11a9d

  • SHA256

    78978a36b56e68b07d49c3e380f30c7c12668edc3bb71761c2bd8b05b416fcb1

  • SHA512

    646b91c8ef0b1ef51c9473ce8ac21a91f0596433604c8afdf1bef76c980190a60172cc1c50dec92d5c9eeb726e0c771f186254ce1e499c5992848d1c202f0188

  • SSDEEP

    12288:cy50ed4DkhUo2y27dG1lFlWcYT70pxnnaaoawVm1aBGyrZNrI0AilFEvxHvBMTLG:pzA4MROxnFnaBrZlI0AilFEvxHiCz

Malware Config

Extracted

Family

orcus

Botnet

Default

C2

216.170.120.141:42069

Mutex

c9015774f0ad4366bafd53ee00a5ef2f

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Taber LLC\RMM\rmm.exe

  • reconnect_delay

    10000

  • registry_keyname

    RMM

  • taskscheduler_taskname

    RMM

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 3 IoCs
  • Orcurs Rat Executable 4 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\78978a36b56e68b07d49c3e380f30c7c12668edc3bb71761c2bd8b05b416fcb1.exe
    "C:\Users\Admin\AppData\Local\Temp\78978a36b56e68b07d49c3e380f30c7c12668edc3bb71761c2bd8b05b416fcb1.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kwydawnv.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1009.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1008.tmp"
        3⤵
          PID:2652
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:2556
      • C:\Program Files\Taber LLC\RMM\rmm.exe
        "C:\Program Files\Taber LLC\RMM\rmm.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2876
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:3064
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {E02CB8D9-5935-4132-B69F-C27F92D3AC54} S-1-5-21-3425689832-2386927309-2650718742-1000:AWDHTXES\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Program Files\Taber LLC\RMM\rmm.exe
        "C:\Program Files\Taber LLC\RMM\rmm.exe"
        2⤵
        • Executes dropped EXE
        PID:2800

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Taber LLC\RMM\rmm.exe

      Filesize

      911KB

      MD5

      4e959e6b6bcb3b88d1b791f397009ace

      SHA1

      03c6825264db0b9f7e84984e4833fa3450f11a9d

      SHA256

      78978a36b56e68b07d49c3e380f30c7c12668edc3bb71761c2bd8b05b416fcb1

      SHA512

      646b91c8ef0b1ef51c9473ce8ac21a91f0596433604c8afdf1bef76c980190a60172cc1c50dec92d5c9eeb726e0c771f186254ce1e499c5992848d1c202f0188

    • C:\Program Files\Taber LLC\RMM\rmm.exe

      Filesize

      911KB

      MD5

      4e959e6b6bcb3b88d1b791f397009ace

      SHA1

      03c6825264db0b9f7e84984e4833fa3450f11a9d

      SHA256

      78978a36b56e68b07d49c3e380f30c7c12668edc3bb71761c2bd8b05b416fcb1

      SHA512

      646b91c8ef0b1ef51c9473ce8ac21a91f0596433604c8afdf1bef76c980190a60172cc1c50dec92d5c9eeb726e0c771f186254ce1e499c5992848d1c202f0188

    • C:\Program Files\Taber LLC\RMM\rmm.exe

      Filesize

      911KB

      MD5

      4e959e6b6bcb3b88d1b791f397009ace

      SHA1

      03c6825264db0b9f7e84984e4833fa3450f11a9d

      SHA256

      78978a36b56e68b07d49c3e380f30c7c12668edc3bb71761c2bd8b05b416fcb1

      SHA512

      646b91c8ef0b1ef51c9473ce8ac21a91f0596433604c8afdf1bef76c980190a60172cc1c50dec92d5c9eeb726e0c771f186254ce1e499c5992848d1c202f0188

    • C:\Program Files\Taber LLC\RMM\rmm.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • C:\Users\Admin\AppData\Local\Temp\RES1009.tmp

      Filesize

      1KB

      MD5

      da8ef203933c7695a718ce1cd3a7a752

      SHA1

      f201e88556c09dce532f8868fcfba4ed7b9cf191

      SHA256

      cba90c4076ad69d475eb2382cad107c6770cbd65a862fde1f4ca74ca1c7ea00f

      SHA512

      9c61cedbbe5b8893e77a7fe8a2d83a3027a8e5c6b7d7d7c567963de5262c36804cb0267e86ae6a1e55ca4dacc3ab55ec60b05628e9e30c3309949dbd5863a19e

    • C:\Users\Admin\AppData\Local\Temp\kwydawnv.dll

      Filesize

      76KB

      MD5

      b47a86fd1aedca0be836be66f865b63f

      SHA1

      5019c7ad4a334da3a0a32290fdf0cfa78a596828

      SHA256

      b102906dd820ac9c594e76d5edb69f26fd4247cac7ebec65f8ac514188158cef

      SHA512

      da4417db1b233964a0c676a8e6649054eddc6637017d4fbb02d14bb5b5929c6f6956d2c40905ab58f82c7caa5606302de12d48e0424199fae7eb6b14187f1112

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC1008.tmp

      Filesize

      676B

      MD5

      07fd38a6173a015867486f54a8214e6c

      SHA1

      c0cd2db4be0a94813ca4668052cda6e3c41b4172

      SHA256

      c682383c3d12658a64df0f2626b03e4d0b6bb09bdf07ed21773a1c72769f8268

      SHA512

      a55af99a86cfdb5e68d36e0b83d25804b48c6f5853cea4d03aae583c55674b7ca4605f8ce8e398610477f6672005feee71afd8ea030ff0edee7b8afa385986ca

    • \??\c:\Users\Admin\AppData\Local\Temp\kwydawnv.0.cs

      Filesize

      208KB

      MD5

      93d26a810d7ff3f695cb1baab0dc139f

      SHA1

      53160d8bd8ef01018ad2e196fa12486eacb0901c

      SHA256

      8e3249583a776f03a5c62855321d7ef00b38d6869a1de47b0498ead8520f0f36

      SHA512

      020dfa4d66b4732d3df8453342069126c8607e1ea8a71e1879a231901e0941b56f39cb5fcc3dcf736005cb2f1cef27c26b549fe5554037cd2f7318cbe1594631

    • \??\c:\Users\Admin\AppData\Local\Temp\kwydawnv.cmdline

      Filesize

      349B

      MD5

      089b82db18c352b7fdf28ffd26729f6a

      SHA1

      b5413e5359a220fbabcb67cf42c0350afaa2e9ed

      SHA256

      441e90c06e1eefafd20caba314474f4162aa1149a6e02f570a4b550c54891839

      SHA512

      fcb7deb2b17de5831950149384f7aa572dc071c4332205291490f57d09220693d8045a0c461612e9b3053f061492550b2332051bd3fde273d215746439fcdf97

    • memory/2556-32-0x000000001B310000-0x000000001B390000-memory.dmp

      Filesize

      512KB

    • memory/2556-30-0x000007FEEEED0000-0x000007FEEF8BC000-memory.dmp

      Filesize

      9.9MB

    • memory/2556-50-0x000007FEEEED0000-0x000007FEEF8BC000-memory.dmp

      Filesize

      9.9MB

    • memory/2556-31-0x000007FEEEED0000-0x000007FEEF8BC000-memory.dmp

      Filesize

      9.9MB

    • memory/2556-29-0x0000000000990000-0x000000000099C000-memory.dmp

      Filesize

      48KB

    • memory/2700-21-0x0000000000430000-0x0000000000442000-memory.dmp

      Filesize

      72KB

    • memory/2700-9-0x00000000021F0000-0x0000000002270000-memory.dmp

      Filesize

      512KB

    • memory/2700-1-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2700-7-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2700-4-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2700-2-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2700-3-0x00000000021F0000-0x0000000002270000-memory.dmp

      Filesize

      512KB

    • memory/2700-19-0x0000000000AC0000-0x0000000000AD6000-memory.dmp

      Filesize

      88KB

    • memory/2700-45-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2700-0-0x0000000000A40000-0x0000000000A9C000-memory.dmp

      Filesize

      368KB

    • memory/2800-59-0x000007FEEEED0000-0x000007FEEF8BC000-memory.dmp

      Filesize

      9.9MB

    • memory/2800-57-0x000000001AE10000-0x000000001AE90000-memory.dmp

      Filesize

      512KB

    • memory/2800-55-0x000007FEEEED0000-0x000007FEEF8BC000-memory.dmp

      Filesize

      9.9MB

    • memory/2876-43-0x0000000000980000-0x0000000000A6A000-memory.dmp

      Filesize

      936KB

    • memory/2876-51-0x000007FEEEED0000-0x000007FEEF8BC000-memory.dmp

      Filesize

      9.9MB

    • memory/2876-52-0x000000001AF00000-0x000000001AF80000-memory.dmp

      Filesize

      512KB

    • memory/2876-53-0x0000000002020000-0x0000000002038000-memory.dmp

      Filesize

      96KB

    • memory/2876-47-0x0000000000670000-0x00000000006BE000-memory.dmp

      Filesize

      312KB

    • memory/2876-56-0x0000000002050000-0x0000000002060000-memory.dmp

      Filesize

      64KB

    • memory/2876-44-0x000007FEEEED0000-0x000007FEEF8BC000-memory.dmp

      Filesize

      9.9MB

    • memory/2876-58-0x000000001AF00000-0x000000001AF80000-memory.dmp

      Filesize

      512KB

    • memory/3064-46-0x000007FEEEED0000-0x000007FEEF8BC000-memory.dmp

      Filesize

      9.9MB

    • memory/3064-34-0x000007FEEEED0000-0x000007FEEF8BC000-memory.dmp

      Filesize

      9.9MB