Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
08/12/2023, 01:07
Behavioral task
behavioral1
Sample
a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe
Resource
win7-20231201-en
General
-
Target
a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe
-
Size
3.0MB
-
MD5
46c99087ac08294ad362ad6e78f9a2f2
-
SHA1
d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
-
SHA256
a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
-
SHA512
594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
SSDEEP
49152:Cs7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpau/nRFfjI7L0qb:CsHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:41931
sudo_sgzwhpv7vdckstvvkmsb2i0hvuy5syfv
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\phpdb\sqldb.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus main payload 7 IoCs
resource yara_rule behavioral2/files/0x0006000000023216-13.dat family_orcus behavioral2/files/0x0006000000023216-19.dat family_orcus behavioral2/files/0x0006000000023216-22.dat family_orcus behavioral2/files/0x0006000000023216-27.dat family_orcus behavioral2/files/0x0006000000023216-35.dat family_orcus behavioral2/files/0x0006000000023216-61.dat family_orcus behavioral2/files/0x0006000000023216-65.dat family_orcus -
Orcurs Rat Executable 8 IoCs
resource yara_rule behavioral2/memory/3768-1-0x0000000000710000-0x0000000000A0E000-memory.dmp orcus behavioral2/files/0x0006000000023216-13.dat orcus behavioral2/files/0x0006000000023216-19.dat orcus behavioral2/files/0x0006000000023216-22.dat orcus behavioral2/files/0x0006000000023216-27.dat orcus behavioral2/files/0x0006000000023216-35.dat orcus behavioral2/files/0x0006000000023216-61.dat orcus behavioral2/files/0x0006000000023216-65.dat orcus -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\International\Geo\Nation a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe -
Executes dropped EXE 5 IoCs
pid Process 4788 sqldb.exe 3992 sqldb.exe 1572 sqldb.exe 1796 sqldb.exe 2176 sqldb.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4788 set thread context of 1568 4788 sqldb.exe 93 PID 3992 set thread context of 4564 3992 sqldb.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 3768 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe 4788 sqldb.exe 4788 sqldb.exe 3992 sqldb.exe 3992 sqldb.exe 3992 sqldb.exe 3992 sqldb.exe 3992 sqldb.exe 3992 sqldb.exe 3992 sqldb.exe 3992 sqldb.exe 3992 sqldb.exe 3992 sqldb.exe 1568 msbuild.exe 1568 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3768 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe Token: SeDebugPrivilege 4788 sqldb.exe Token: SeDebugPrivilege 3992 sqldb.exe Token: SeDebugPrivilege 1568 msbuild.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 3768 wrote to memory of 4788 3768 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe 90 PID 3768 wrote to memory of 4788 3768 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe 90 PID 3768 wrote to memory of 4788 3768 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe 90 PID 4788 wrote to memory of 1568 4788 sqldb.exe 93 PID 4788 wrote to memory of 1568 4788 sqldb.exe 93 PID 4788 wrote to memory of 1568 4788 sqldb.exe 93 PID 4788 wrote to memory of 1568 4788 sqldb.exe 93 PID 4788 wrote to memory of 1568 4788 sqldb.exe 93 PID 4788 wrote to memory of 1568 4788 sqldb.exe 93 PID 4788 wrote to memory of 1568 4788 sqldb.exe 93 PID 4788 wrote to memory of 1568 4788 sqldb.exe 93 PID 3992 wrote to memory of 1428 3992 sqldb.exe 97 PID 3992 wrote to memory of 1428 3992 sqldb.exe 97 PID 3992 wrote to memory of 1428 3992 sqldb.exe 97 PID 3992 wrote to memory of 408 3992 sqldb.exe 99 PID 3992 wrote to memory of 408 3992 sqldb.exe 99 PID 3992 wrote to memory of 408 3992 sqldb.exe 99 PID 3992 wrote to memory of 912 3992 sqldb.exe 98 PID 3992 wrote to memory of 912 3992 sqldb.exe 98 PID 3992 wrote to memory of 912 3992 sqldb.exe 98 PID 3992 wrote to memory of 4748 3992 sqldb.exe 100 PID 3992 wrote to memory of 4748 3992 sqldb.exe 100 PID 3992 wrote to memory of 4748 3992 sqldb.exe 100 PID 3992 wrote to memory of 4564 3992 sqldb.exe 101 PID 3992 wrote to memory of 4564 3992 sqldb.exe 101 PID 3992 wrote to memory of 4564 3992 sqldb.exe 101 PID 3992 wrote to memory of 4564 3992 sqldb.exe 101 PID 3992 wrote to memory of 4564 3992 sqldb.exe 101 PID 3992 wrote to memory of 4564 3992 sqldb.exe 101 PID 3992 wrote to memory of 4564 3992 sqldb.exe 101 PID 3992 wrote to memory of 4564 3992 sqldb.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe"C:\Users\Admin\AppData\Local\Temp\a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe"C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
-
C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exeC:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵PID:1428
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵PID:912
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵PID:408
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵PID:4748
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵PID:4564
-
-
C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exeC:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe1⤵
- Executes dropped EXE
PID:1572
-
C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exeC:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe1⤵
- Executes dropped EXE
PID:1796
-
C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exeC:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe1⤵
- Executes dropped EXE
PID:2176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5663b8d5469caa4489d463aa9bc18124f
SHA1e57123a7d969115853ea631a3b33826335025d28
SHA2567b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8
SHA51245e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad