Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe
Resource
win7-20240221-en
General
-
Target
00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe
-
Size
2.6MB
-
MD5
fddf433f759f354b7fcffbbb11196661
-
SHA1
41ec7591ef29b5d855fa85adfecd6eea1bcf259a
-
SHA256
00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5
-
SHA512
cb6a969f87c67b4f03b50af305a734add9b4c41048f5b6b4e8988287ac43eecb1821d345d44bd5fc9116cc5b6de0a03d7ad48ef27047435899b5a69d47ecd2b9
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxU:Hh+ZkldoPKiYdqd68
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 2 IoCs
resource yara_rule behavioral2/memory/2092-2-0x00000000005A0000-0x000000000068A000-memory.dmp orcus behavioral2/memory/316-26-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 2 IoCs
pid Process 4792 setspn.exe 4176 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/5040-0-0x0000000000F90000-0x000000000123A000-memory.dmp autoit_exe behavioral2/files/0x00090000000233ec-23.dat autoit_exe behavioral2/memory/4792-24-0x0000000000A20000-0x0000000000CCA000-memory.dmp autoit_exe behavioral2/memory/4176-36-0x0000000000A20000-0x0000000000CCA000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5040 set thread context of 2092 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 87 PID 4792 set thread context of 316 4792 setspn.exe 102 PID 4176 set thread context of 2308 4176 setspn.exe 117 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4040 schtasks.exe 924 schtasks.exe 4372 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 4792 setspn.exe 4792 setspn.exe 4792 setspn.exe 4792 setspn.exe 4176 setspn.exe 4176 setspn.exe 4176 setspn.exe 4176 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2092 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2092 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 5040 wrote to memory of 2092 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 87 PID 5040 wrote to memory of 2092 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 87 PID 5040 wrote to memory of 2092 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 87 PID 5040 wrote to memory of 2092 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 87 PID 5040 wrote to memory of 2092 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 87 PID 5040 wrote to memory of 4040 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 88 PID 5040 wrote to memory of 4040 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 88 PID 5040 wrote to memory of 4040 5040 00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe 88 PID 4792 wrote to memory of 316 4792 setspn.exe 102 PID 4792 wrote to memory of 316 4792 setspn.exe 102 PID 4792 wrote to memory of 316 4792 setspn.exe 102 PID 4792 wrote to memory of 316 4792 setspn.exe 102 PID 4792 wrote to memory of 316 4792 setspn.exe 102 PID 4792 wrote to memory of 924 4792 setspn.exe 103 PID 4792 wrote to memory of 924 4792 setspn.exe 103 PID 4792 wrote to memory of 924 4792 setspn.exe 103 PID 4176 wrote to memory of 2308 4176 setspn.exe 117 PID 4176 wrote to memory of 2308 4176 setspn.exe 117 PID 4176 wrote to memory of 2308 4176 setspn.exe 117 PID 4176 wrote to memory of 2308 4176 setspn.exe 117 PID 4176 wrote to memory of 2308 4176 setspn.exe 117 PID 4176 wrote to memory of 4372 4176 setspn.exe 118 PID 4176 wrote to memory of 4372 4176 setspn.exe 118 PID 4176 wrote to memory of 4372 4176 setspn.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe"C:\Users\Admin\AppData\Local\Temp\00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2092
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4040
-
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:316
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:924
-
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2308
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
2.6MB
MD5ea1b676c91e2b470a79982b61c7810cf
SHA16e7c9b45cb5b94540f3d6f40c2c9efaa0f6b8955
SHA256adf57f490d0a7ef61f44c7a18597160a5d14278b1045f40ae18f5884ee0c276c
SHA5127172a152093331d1d22aae4114a114feeb73f732bbe61c0fe6cb0896546b1ccab320f822926bebb0c7b17629aa6e8bcb7a85a27156b5d323b17ed53b00fef61a