Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/04/2024, 02:14

General

  • Target

    4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe

  • Size

    2.6MB

  • MD5

    d06bd3e134e179556cde50e80e16187b

  • SHA1

    0fd150936733f3e74794d4b28696ef5877299e50

  • SHA256

    4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08

  • SHA512

    b22cd9a2f351b724df50e722210fef6ffd646f173574a8daac7e2ca81ef48b48003464127e2e0810ea5be657cb69aff7f307ec1beaf09ef1db7e88314ab85922

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxV:Hh+ZkldoPKiYdqd6N

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcurs Rat Executable 3 IoCs
  • Executes dropped EXE 3 IoCs
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe
    "C:\Users\Admin\AppData\Local\Temp\4548e35824d48a664a21f49c70239cb0b281e29a82b91a83fcbaf6ea192cba08.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2928
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
      2⤵
      • Creates scheduled task(s)
      PID:2716
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {46E6D2A5-474D-489D-904F-6D6D6027B098} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2640
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
          3⤵
          • Creates scheduled task(s)
          PID:2548
      • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1252
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
            PID:2372
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
            3⤵
            • Creates scheduled task(s)
            PID:1976
        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
          C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:832
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            3⤵
              PID:1856
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
              3⤵
              • Creates scheduled task(s)
              PID:1840

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe

          Filesize

          2.6MB

          MD5

          beeb7c413169fcd7959d5e44172b7eb2

          SHA1

          569e8a1bdb65463dd1a8583055ea442311ffa9c6

          SHA256

          9dad419e7cb59fce9d6215f21d7c72122331cf68cd06bfe95134f87f6416be92

          SHA512

          28df4dab603c76aee60d55da06da590a62e460c613cf01f0b6410da7830de5d4012482b882924d6bba1ff81fab906679646fbfa091fb9860e3b2fe6ec1736ba6

        • memory/832-54-0x0000000000A90000-0x0000000000D3A000-memory.dmp

          Filesize

          2.7MB

        • memory/1252-39-0x00000000002B0000-0x000000000055A000-memory.dmp

          Filesize

          2.7MB

        • memory/1856-64-0x0000000072C60000-0x000000007334E000-memory.dmp

          Filesize

          6.9MB

        • memory/1856-65-0x0000000001240000-0x0000000001280000-memory.dmp

          Filesize

          256KB

        • memory/1856-66-0x0000000072C60000-0x000000007334E000-memory.dmp

          Filesize

          6.9MB

        • memory/2140-1-0x00000000000B0000-0x00000000000B1000-memory.dmp

          Filesize

          4KB

        • memory/2140-0-0x0000000000A30000-0x0000000000CDA000-memory.dmp

          Filesize

          2.7MB

        • memory/2372-52-0x0000000072C60000-0x000000007334E000-memory.dmp

          Filesize

          6.9MB

        • memory/2372-51-0x0000000000770000-0x00000000007B0000-memory.dmp

          Filesize

          256KB

        • memory/2372-50-0x0000000072C60000-0x000000007334E000-memory.dmp

          Filesize

          6.9MB

        • memory/2592-19-0x0000000001160000-0x000000000140A000-memory.dmp

          Filesize

          2.7MB

        • memory/2640-34-0x0000000004B40000-0x0000000004B80000-memory.dmp

          Filesize

          256KB

        • memory/2640-35-0x0000000072C60000-0x000000007334E000-memory.dmp

          Filesize

          6.9MB

        • memory/2640-33-0x0000000072C60000-0x000000007334E000-memory.dmp

          Filesize

          6.9MB

        • memory/2928-21-0x0000000000810000-0x0000000000818000-memory.dmp

          Filesize

          32KB

        • memory/2928-23-0x0000000000D80000-0x0000000000D90000-memory.dmp

          Filesize

          64KB

        • memory/2928-22-0x0000000000BE0000-0x0000000000BF8000-memory.dmp

          Filesize

          96KB

        • memory/2928-20-0x0000000000550000-0x0000000000562000-memory.dmp

          Filesize

          72KB

        • memory/2928-16-0x0000000004720000-0x000000000477C000-memory.dmp

          Filesize

          368KB

        • memory/2928-36-0x0000000072C60000-0x000000007334E000-memory.dmp

          Filesize

          6.9MB

        • memory/2928-37-0x0000000001250000-0x0000000001290000-memory.dmp

          Filesize

          256KB

        • memory/2928-15-0x0000000000500000-0x000000000050E000-memory.dmp

          Filesize

          56KB

        • memory/2928-14-0x0000000001250000-0x0000000001290000-memory.dmp

          Filesize

          256KB

        • memory/2928-13-0x0000000072C60000-0x000000007334E000-memory.dmp

          Filesize

          6.9MB

        • memory/2928-10-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/2928-9-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/2928-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2928-3-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/2928-2-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB