Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe
Resource
win7-20240215-en
General
-
Target
fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe
-
Size
2.6MB
-
MD5
3801009a3db0d503d615cebcc452d959
-
SHA1
1336db15a0ebcd7b2fce2385aba5ee14956802b9
-
SHA256
fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862
-
SHA512
f78bec006c78d6e1817890ddee108b72720c8a7c2104e6c239f66520d6f479f2d5be1f146ec9db81eb9dcab1b2778d80b54e5c4989903d7f6f3e6c2c35093767
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxw:Hh+ZkldoPKiYdqd6I
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 2 IoCs
resource yara_rule behavioral2/memory/3880-2-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral2/memory/2728-26-0x0000000000600000-0x00000000006EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe -
Executes dropped EXE 2 IoCs
pid Process 4572 setspn.exe 3452 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3852-0-0x0000000000040000-0x00000000002EA000-memory.dmp autoit_exe behavioral2/files/0x000500000002296d-23.dat autoit_exe behavioral2/memory/4572-24-0x0000000000180000-0x000000000042A000-memory.dmp autoit_exe behavioral2/memory/3452-36-0x0000000000180000-0x000000000042A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3852 set thread context of 3880 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 91 PID 4572 set thread context of 2728 4572 setspn.exe 109 PID 3452 set thread context of 3536 3452 setspn.exe 120 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2644 schtasks.exe 3416 schtasks.exe 4772 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 4572 setspn.exe 4572 setspn.exe 4572 setspn.exe 4572 setspn.exe 3452 setspn.exe 3452 setspn.exe 3452 setspn.exe 3452 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3880 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3880 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3852 wrote to memory of 3880 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 91 PID 3852 wrote to memory of 3880 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 91 PID 3852 wrote to memory of 3880 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 91 PID 3852 wrote to memory of 3880 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 91 PID 3852 wrote to memory of 3880 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 91 PID 3852 wrote to memory of 2644 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 92 PID 3852 wrote to memory of 2644 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 92 PID 3852 wrote to memory of 2644 3852 fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe 92 PID 4572 wrote to memory of 2728 4572 setspn.exe 109 PID 4572 wrote to memory of 2728 4572 setspn.exe 109 PID 4572 wrote to memory of 2728 4572 setspn.exe 109 PID 4572 wrote to memory of 2728 4572 setspn.exe 109 PID 4572 wrote to memory of 2728 4572 setspn.exe 109 PID 4572 wrote to memory of 3416 4572 setspn.exe 110 PID 4572 wrote to memory of 3416 4572 setspn.exe 110 PID 4572 wrote to memory of 3416 4572 setspn.exe 110 PID 3452 wrote to memory of 3536 3452 setspn.exe 120 PID 3452 wrote to memory of 3536 3452 setspn.exe 120 PID 3452 wrote to memory of 3536 3452 setspn.exe 120 PID 3452 wrote to memory of 3536 3452 setspn.exe 120 PID 3452 wrote to memory of 3536 3452 setspn.exe 120 PID 3452 wrote to memory of 4772 3452 setspn.exe 121 PID 3452 wrote to memory of 4772 3452 setspn.exe 121 PID 3452 wrote to memory of 4772 3452 setspn.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe"C:\Users\Admin\AppData\Local\Temp\fedb5f5c2d97340253dcc78604c0c41215e22fc9dc5908b17cfacdb8b4fae862.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3880
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2644
-
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2728
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3416
-
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:3536
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
2.6MB
MD51348b3e4668c5774012cce8373735fb7
SHA1f440db9e0a63c3503dee29787e030f6027086d2c
SHA2563f4b40441df2b4210fb741c99796771007b5fa5c60a4b7a54a52ad373ff64a5f
SHA5122fc4d5b5af0e2c554df1ba3b6c5455e016beadca38935b186fbfd876453c8212ba877c5f71b982f02fa503f13146b57b3edd63fc2f1a14206e92c59acdae146c