Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe
Resource
win7-20240215-en
General
-
Target
368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe
-
Size
2.6MB
-
MD5
9fa6c75f691ff913ef2f95b906016a48
-
SHA1
ac863bdf74e86d7efea88af16011c63aa19e0ead
-
SHA256
368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a
-
SHA512
8d4eb29dc5c298fbf1960e3c4d651dd1f090cdf35470fc384a4c111c79b81012bd44cbc2c9b9a987a2b93779b3afe4f06f3d91d98c93a30409307fc1cddcf09d
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxx6:Hh+ZkldoPKiYdqd6S
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 6 IoCs
resource yara_rule behavioral1/memory/2956-3-0x00000000001D0000-0x00000000002BA000-memory.dmp orcus behavioral1/memory/2956-9-0x00000000001D0000-0x00000000002BA000-memory.dmp orcus behavioral1/memory/2956-10-0x00000000001D0000-0x00000000002BA000-memory.dmp orcus behavioral1/memory/1500-27-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1500-34-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1500-33-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Executes dropped EXE 2 IoCs
pid Process 1216 setspn.exe 2060 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1776-0-0x00000000011F0000-0x000000000149A000-memory.dmp autoit_exe behavioral1/memory/1216-25-0x0000000000B20000-0x0000000000DCA000-memory.dmp autoit_exe behavioral1/files/0x000b000000015cbd-24.dat autoit_exe behavioral1/memory/2060-39-0x0000000000FB0000-0x000000000125A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1776 set thread context of 2956 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 28 PID 1216 set thread context of 1500 1216 setspn.exe 33 PID 2060 set thread context of 2036 2060 setspn.exe 39 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2488 schtasks.exe 1480 schtasks.exe 988 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 1216 setspn.exe 1216 setspn.exe 2060 setspn.exe 2060 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2956 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2956 RegSvcs.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2956 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 28 PID 1776 wrote to memory of 2956 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 28 PID 1776 wrote to memory of 2956 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 28 PID 1776 wrote to memory of 2956 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 28 PID 1776 wrote to memory of 2956 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 28 PID 1776 wrote to memory of 2956 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 28 PID 1776 wrote to memory of 2956 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 28 PID 1776 wrote to memory of 2956 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 28 PID 1776 wrote to memory of 2956 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 28 PID 1776 wrote to memory of 2488 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 29 PID 1776 wrote to memory of 2488 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 29 PID 1776 wrote to memory of 2488 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 29 PID 1776 wrote to memory of 2488 1776 368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe 29 PID 2888 wrote to memory of 1216 2888 taskeng.exe 32 PID 2888 wrote to memory of 1216 2888 taskeng.exe 32 PID 2888 wrote to memory of 1216 2888 taskeng.exe 32 PID 2888 wrote to memory of 1216 2888 taskeng.exe 32 PID 1216 wrote to memory of 1500 1216 setspn.exe 33 PID 1216 wrote to memory of 1500 1216 setspn.exe 33 PID 1216 wrote to memory of 1500 1216 setspn.exe 33 PID 1216 wrote to memory of 1500 1216 setspn.exe 33 PID 1216 wrote to memory of 1500 1216 setspn.exe 33 PID 1216 wrote to memory of 1500 1216 setspn.exe 33 PID 1216 wrote to memory of 1500 1216 setspn.exe 33 PID 1216 wrote to memory of 1500 1216 setspn.exe 33 PID 1216 wrote to memory of 1500 1216 setspn.exe 33 PID 1216 wrote to memory of 1480 1216 setspn.exe 34 PID 1216 wrote to memory of 1480 1216 setspn.exe 34 PID 1216 wrote to memory of 1480 1216 setspn.exe 34 PID 1216 wrote to memory of 1480 1216 setspn.exe 34 PID 2888 wrote to memory of 2060 2888 taskeng.exe 38 PID 2888 wrote to memory of 2060 2888 taskeng.exe 38 PID 2888 wrote to memory of 2060 2888 taskeng.exe 38 PID 2888 wrote to memory of 2060 2888 taskeng.exe 38 PID 2060 wrote to memory of 2036 2060 setspn.exe 39 PID 2060 wrote to memory of 2036 2060 setspn.exe 39 PID 2060 wrote to memory of 2036 2060 setspn.exe 39 PID 2060 wrote to memory of 2036 2060 setspn.exe 39 PID 2060 wrote to memory of 2036 2060 setspn.exe 39 PID 2060 wrote to memory of 2036 2060 setspn.exe 39 PID 2060 wrote to memory of 2036 2060 setspn.exe 39 PID 2060 wrote to memory of 2036 2060 setspn.exe 39 PID 2060 wrote to memory of 2036 2060 setspn.exe 39 PID 2060 wrote to memory of 988 2060 setspn.exe 40 PID 2060 wrote to memory of 988 2060 setspn.exe 40 PID 2060 wrote to memory of 988 2060 setspn.exe 40 PID 2060 wrote to memory of 988 2060 setspn.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe"C:\Users\Admin\AppData\Local\Temp\368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2956
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2488
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {0C31D1AB-A9D4-47C4-ADAE-1DFCFAE80BAC} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1500
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1480
-
-
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2036
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:988
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD51f8f8926cdea593050446e70b43d9ef7
SHA1621e13ca9c6c65d3bc294db853ae34b7d8fb7106
SHA25661f8a6419725745cf396044c835d826f761a5e922b3a146b781f4387fe725a6c
SHA512eca81ecb7805f4512a05b003261ae0491df3f4d923a1373a14e48b04a827cb967968b621bc9b27d967729f07a399c2200b180c6beea08fda9b6b5ab2d5a1dd05