Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe
Resource
win7-20240221-en
General
-
Target
4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe
-
Size
2.6MB
-
MD5
d06bd3e134e179556cde50e80e16187b
-
SHA1
0fd150936733f3e74794d4b28696ef5877299e50
-
SHA256
4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08
-
SHA512
b22cd9a2f351b724df50e722210fef6ffd646f173574a8daac7e2ca81ef48b48003464127e2e0810ea5be657cb69aff7f307ec1beaf09ef1db7e88314ab85922
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxV:Hh+ZkldoPKiYdqd6N
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 3 IoCs
resource yara_rule behavioral1/memory/2928-3-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/2928-9-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/2928-10-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Executes dropped EXE 3 IoCs
pid Process 2592 setspn.exe 1252 setspn.exe 832 setspn.exe -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2140-0-0x0000000000A30000-0x0000000000CDA000-memory.dmp autoit_exe behavioral1/files/0x000d0000000122b8-17.dat autoit_exe behavioral1/memory/2592-19-0x0000000001160000-0x000000000140A000-memory.dmp autoit_exe behavioral1/memory/1252-39-0x00000000002B0000-0x000000000055A000-memory.dmp autoit_exe behavioral1/memory/832-54-0x0000000000A90000-0x0000000000D3A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2140 set thread context of 2928 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 28 PID 2592 set thread context of 2640 2592 setspn.exe 35 PID 1252 set thread context of 2372 1252 setspn.exe 39 PID 832 set thread context of 1856 832 setspn.exe 43 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1840 schtasks.exe 2716 schtasks.exe 2548 schtasks.exe 1976 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 2592 setspn.exe 2592 setspn.exe 1252 setspn.exe 1252 setspn.exe 832 setspn.exe 832 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2928 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2928 RegSvcs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2928 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 28 PID 2140 wrote to memory of 2928 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 28 PID 2140 wrote to memory of 2928 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 28 PID 2140 wrote to memory of 2928 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 28 PID 2140 wrote to memory of 2928 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 28 PID 2140 wrote to memory of 2928 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 28 PID 2140 wrote to memory of 2928 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 28 PID 2140 wrote to memory of 2928 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 28 PID 2140 wrote to memory of 2928 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 28 PID 2140 wrote to memory of 2716 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 29 PID 2140 wrote to memory of 2716 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 29 PID 2140 wrote to memory of 2716 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 29 PID 2140 wrote to memory of 2716 2140 4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe 29 PID 2948 wrote to memory of 2592 2948 taskeng.exe 34 PID 2948 wrote to memory of 2592 2948 taskeng.exe 34 PID 2948 wrote to memory of 2592 2948 taskeng.exe 34 PID 2948 wrote to memory of 2592 2948 taskeng.exe 34 PID 2592 wrote to memory of 2640 2592 setspn.exe 35 PID 2592 wrote to memory of 2640 2592 setspn.exe 35 PID 2592 wrote to memory of 2640 2592 setspn.exe 35 PID 2592 wrote to memory of 2640 2592 setspn.exe 35 PID 2592 wrote to memory of 2640 2592 setspn.exe 35 PID 2592 wrote to memory of 2640 2592 setspn.exe 35 PID 2592 wrote to memory of 2640 2592 setspn.exe 35 PID 2592 wrote to memory of 2640 2592 setspn.exe 35 PID 2592 wrote to memory of 2640 2592 setspn.exe 35 PID 2592 wrote to memory of 2548 2592 setspn.exe 36 PID 2592 wrote to memory of 2548 2592 setspn.exe 36 PID 2592 wrote to memory of 2548 2592 setspn.exe 36 PID 2592 wrote to memory of 2548 2592 setspn.exe 36 PID 2948 wrote to memory of 1252 2948 taskeng.exe 38 PID 2948 wrote to memory of 1252 2948 taskeng.exe 38 PID 2948 wrote to memory of 1252 2948 taskeng.exe 38 PID 2948 wrote to memory of 1252 2948 taskeng.exe 38 PID 1252 wrote to memory of 2372 1252 setspn.exe 39 PID 1252 wrote to memory of 2372 1252 setspn.exe 39 PID 1252 wrote to memory of 2372 1252 setspn.exe 39 PID 1252 wrote to memory of 2372 1252 setspn.exe 39 PID 1252 wrote to memory of 2372 1252 setspn.exe 39 PID 1252 wrote to memory of 2372 1252 setspn.exe 39 PID 1252 wrote to memory of 2372 1252 setspn.exe 39 PID 1252 wrote to memory of 2372 1252 setspn.exe 39 PID 1252 wrote to memory of 2372 1252 setspn.exe 39 PID 1252 wrote to memory of 1976 1252 setspn.exe 40 PID 1252 wrote to memory of 1976 1252 setspn.exe 40 PID 1252 wrote to memory of 1976 1252 setspn.exe 40 PID 1252 wrote to memory of 1976 1252 setspn.exe 40 PID 2948 wrote to memory of 832 2948 taskeng.exe 42 PID 2948 wrote to memory of 832 2948 taskeng.exe 42 PID 2948 wrote to memory of 832 2948 taskeng.exe 42 PID 2948 wrote to memory of 832 2948 taskeng.exe 42 PID 832 wrote to memory of 1856 832 setspn.exe 43 PID 832 wrote to memory of 1856 832 setspn.exe 43 PID 832 wrote to memory of 1856 832 setspn.exe 43 PID 832 wrote to memory of 1856 832 setspn.exe 43 PID 832 wrote to memory of 1856 832 setspn.exe 43 PID 832 wrote to memory of 1856 832 setspn.exe 43 PID 832 wrote to memory of 1856 832 setspn.exe 43 PID 832 wrote to memory of 1856 832 setspn.exe 43 PID 832 wrote to memory of 1856 832 setspn.exe 43 PID 832 wrote to memory of 1840 832 setspn.exe 44 PID 832 wrote to memory of 1840 832 setspn.exe 44 PID 832 wrote to memory of 1840 832 setspn.exe 44 PID 832 wrote to memory of 1840 832 setspn.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe"C:\Users\Admin\AppData\Local\Temp\4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2928
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2716
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {46E6D2A5-474D-489D-904F-6D6D6027B098} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2640
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2548
-
-
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2372
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1976
-
-
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1856
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1840
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5beeb7c413169fcd7959d5e44172b7eb2
SHA1569e8a1bdb65463dd1a8583055ea442311ffa9c6
SHA2569dad419e7cb59fce9d6215f21d7c72122331cf68cd06bfe95134f87f6416be92
SHA51228df4dab603c76aee60d55da06da590a62e460c613cf01f0b6410da7830de5d4012482b882924d6bba1ff81fab906679646fbfa091fb9860e3b2fe6ec1736ba6