Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    09/12/2023, 01:01

General

  • Target

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517.exe

  • Size

    3.0MB

  • MD5

    7d5a7a107e4ce99413bdc952655d4677

  • SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

  • SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

  • SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • SSDEEP

    49152:ZGX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:ZLHTPJg8z1mKnypSbRxo9JCm

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

C2

31.44.184.52:41931

Mutex

sudo_brh9yfqrylsu32h30zbtl42nzp7y8woo

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\providerjs\bigloadgeo.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 7 IoCs
  • Orcurs Rat Executable 16 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517.exe
    "C:\Users\Admin\AppData\Local\Temp\57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
      "C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2696
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {ACCF9067-0AD2-4236-90CB-A4676E9324FF} S-1-5-21-3425689832-2386927309-2650718742-1000:AWDHTXES\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
      C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
      2⤵
      • Executes dropped EXE
      PID:2664
    • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
      C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
      2⤵
      • Executes dropped EXE
      PID:2172
    • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
      C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
      2⤵
      • Executes dropped EXE
      PID:1932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe.config

    Filesize

    357B

    MD5

    a2b76cea3a59fa9af5ea21ff68139c98

    SHA1

    35d76475e6a54c168f536e30206578babff58274

    SHA256

    f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

    SHA512

    b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

  • \Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • memory/1932-76-0x0000000004FB0000-0x0000000004FF0000-memory.dmp

    Filesize

    256KB

  • memory/1932-75-0x00000000009A0000-0x0000000000C9E000-memory.dmp

    Filesize

    3.0MB

  • memory/1932-74-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/1932-77-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2104-2-0x0000000004B80000-0x0000000004BC0000-memory.dmp

    Filesize

    256KB

  • memory/2104-1-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2104-4-0x0000000000A20000-0x0000000000A7C000-memory.dmp

    Filesize

    368KB

  • memory/2104-17-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2104-3-0x0000000000510000-0x000000000051E000-memory.dmp

    Filesize

    56KB

  • memory/2104-5-0x00000000005B0000-0x00000000005C2000-memory.dmp

    Filesize

    72KB

  • memory/2104-0-0x0000000000BB0000-0x0000000000EAE000-memory.dmp

    Filesize

    3.0MB

  • memory/2172-69-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2172-71-0x0000000004C40000-0x0000000004C80000-memory.dmp

    Filesize

    256KB

  • memory/2172-70-0x0000000000350000-0x000000000064E000-memory.dmp

    Filesize

    3.0MB

  • memory/2172-72-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2664-39-0x0000000004E20000-0x0000000004E60000-memory.dmp

    Filesize

    256KB

  • memory/2664-25-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2664-62-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2696-63-0x0000000005460000-0x000000000546E000-memory.dmp

    Filesize

    56KB

  • memory/2696-66-0x00000000012A0000-0x00000000012E0000-memory.dmp

    Filesize

    256KB

  • memory/2696-38-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2696-32-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/2696-40-0x00000000012A0000-0x00000000012E0000-memory.dmp

    Filesize

    256KB

  • memory/2696-41-0x00000000003E0000-0x00000000003F2000-memory.dmp

    Filesize

    72KB

  • memory/2696-42-0x0000000000AD0000-0x0000000000AE8000-memory.dmp

    Filesize

    96KB

  • memory/2696-43-0x0000000000F20000-0x0000000000F30000-memory.dmp

    Filesize

    64KB

  • memory/2696-61-0x00000000012A0000-0x00000000012E0000-memory.dmp

    Filesize

    256KB

  • memory/2696-36-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/2696-34-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/2696-64-0x0000000005610000-0x0000000005612000-memory.dmp

    Filesize

    8KB

  • memory/2696-65-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2696-23-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/2696-67-0x00000000012A0000-0x00000000012E0000-memory.dmp

    Filesize

    256KB

  • memory/2696-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2696-29-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/2696-28-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/2696-26-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/3004-37-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/3004-21-0x0000000000AF0000-0x0000000000B3E000-memory.dmp

    Filesize

    312KB

  • memory/3004-20-0x00000000005E0000-0x00000000005F2000-memory.dmp

    Filesize

    72KB

  • memory/3004-16-0x00000000010D0000-0x00000000013CE000-memory.dmp

    Filesize

    3.0MB

  • memory/3004-19-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB

  • memory/3004-18-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB