Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 02:06
Static task
static1
Behavioral task
behavioral1
Sample
e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe
Resource
win7-20240221-en
General
-
Target
e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe
-
Size
2.6MB
-
MD5
40926040980e5d4c8269d06c26d8982f
-
SHA1
034db414994319cc08ca6a29eea8227537ec4ee5
-
SHA256
e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1
-
SHA512
cf0209da22303a91e8bf487640f9dd38820017fb7a93dcc5dca809fc6290e0070ca10e801c7d0be49efcca5bf1eddf21708f8437516fb78648d5a67970cd4944
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxr:Hh+ZkldoPKiYdqd6z
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
resource yara_rule behavioral2/memory/3500-2-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 2 IoCs
pid Process 1176 setspn.exe 644 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2320-0-0x0000000000010000-0x00000000002BA000-memory.dmp autoit_exe behavioral2/files/0x000800000002325d-22.dat autoit_exe behavioral2/memory/1176-23-0x00000000000B0000-0x000000000035A000-memory.dmp autoit_exe behavioral2/memory/644-36-0x00000000000B0000-0x000000000035A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2320 set thread context of 3500 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 94 PID 1176 set thread context of 3172 1176 setspn.exe 105 PID 644 set thread context of 3140 644 setspn.exe 109 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1532 schtasks.exe 4432 schtasks.exe 3556 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 1176 setspn.exe 1176 setspn.exe 1176 setspn.exe 1176 setspn.exe 644 setspn.exe 644 setspn.exe 644 setspn.exe 644 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3500 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3500 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2320 wrote to memory of 3500 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 94 PID 2320 wrote to memory of 3500 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 94 PID 2320 wrote to memory of 3500 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 94 PID 2320 wrote to memory of 3500 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 94 PID 2320 wrote to memory of 3500 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 94 PID 2320 wrote to memory of 1532 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 98 PID 2320 wrote to memory of 1532 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 98 PID 2320 wrote to memory of 1532 2320 e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe 98 PID 1176 wrote to memory of 3172 1176 setspn.exe 105 PID 1176 wrote to memory of 3172 1176 setspn.exe 105 PID 1176 wrote to memory of 3172 1176 setspn.exe 105 PID 1176 wrote to memory of 3172 1176 setspn.exe 105 PID 1176 wrote to memory of 3172 1176 setspn.exe 105 PID 1176 wrote to memory of 4432 1176 setspn.exe 106 PID 1176 wrote to memory of 4432 1176 setspn.exe 106 PID 1176 wrote to memory of 4432 1176 setspn.exe 106 PID 644 wrote to memory of 3140 644 setspn.exe 109 PID 644 wrote to memory of 3140 644 setspn.exe 109 PID 644 wrote to memory of 3140 644 setspn.exe 109 PID 644 wrote to memory of 3140 644 setspn.exe 109 PID 644 wrote to memory of 3140 644 setspn.exe 109 PID 644 wrote to memory of 3556 644 setspn.exe 110 PID 644 wrote to memory of 3556 644 setspn.exe 110 PID 644 wrote to memory of 3556 644 setspn.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe"C:\Users\Admin\AppData\Local\Temp\e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3500
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:81⤵PID:3612
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:3172
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4432
-
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:3140
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
2.6MB
MD56be61a59a348c81e6a99c060e29a506c
SHA16cdb46ccdeba430daf17bae7d6045159db03de55
SHA256009b87bc7cdcc1b4a2cbbae64944dce0ecc23b5f611d749e8b1d1d78c4f2bb71
SHA5122349e9ced526db7abc90fe3df9cc6b93dec22be4734c962159ceff290dc95c0385aeb38e917d1ee874fdc3e385799337aa09993d815d2ab5ffdd60ab98c15f92