Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/05/2024, 01:18

General

  • Target

    7735b9fa1bf55cf0c008e81deb1353cf6465a6a0513f00670fc3eb4254562763.exe

  • Size

    915KB

  • MD5

    f37bc9964f10880e3e89528cc4d1f677

  • SHA1

    3657ae613f45ae0609b0bea854104f1bd398b038

  • SHA256

    7735b9fa1bf55cf0c008e81deb1353cf6465a6a0513f00670fc3eb4254562763

  • SHA512

    a4dea6d511b8fd167f130a8e85a549a7f80869ca8584fd129437b991bab227823852b8e5274ec082714e0bf5388aefbd7a5f6ff17f15335ecb2b3ba634c0b450

  • SSDEEP

    24576:lBB4MROxnF033dkrrcI0AilFEvxHPmooo:lQMi+SrrcI0AilFEvxHP

Malware Config

Extracted

Family

orcus

C2

100.114.145.122:7777

Mutex

58040c8e707f46aeaa354c0509774164

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\userprofile

  • reconnect_delay

    10000

  • registry_keyname

    svchostt

  • taskscheduler_taskname

    svchostt

  • watchdog_path

    AppData\powershell.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7735b9fa1bf55cf0c008e81deb1353cf6465a6a0513f00670fc3eb4254562763.exe
    "C:\Users\Admin\AppData\Local\Temp\7735b9fa1bf55cf0c008e81deb1353cf6465a6a0513f00670fc3eb4254562763.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    PID:1424
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\userprofile

    Filesize

    915KB

    MD5

    f37bc9964f10880e3e89528cc4d1f677

    SHA1

    3657ae613f45ae0609b0bea854104f1bd398b038

    SHA256

    7735b9fa1bf55cf0c008e81deb1353cf6465a6a0513f00670fc3eb4254562763

    SHA512

    a4dea6d511b8fd167f130a8e85a549a7f80869ca8584fd129437b991bab227823852b8e5274ec082714e0bf5388aefbd7a5f6ff17f15335ecb2b3ba634c0b450

  • memory/1424-7-0x0000000005240000-0x0000000005252000-memory.dmp

    Filesize

    72KB

  • memory/1424-10-0x00000000058A0000-0x0000000005906000-memory.dmp

    Filesize

    408KB

  • memory/1424-4-0x0000000004B90000-0x0000000004BEC000-memory.dmp

    Filesize

    368KB

  • memory/1424-3-0x0000000074860000-0x0000000075010000-memory.dmp

    Filesize

    7.7MB

  • memory/1424-5-0x0000000005260000-0x0000000005804000-memory.dmp

    Filesize

    5.6MB

  • memory/1424-6-0x0000000004D50000-0x0000000004DE2000-memory.dmp

    Filesize

    584KB

  • memory/1424-8-0x0000000005250000-0x0000000005258000-memory.dmp

    Filesize

    32KB

  • memory/1424-0-0x000000007486E000-0x000000007486F000-memory.dmp

    Filesize

    4KB

  • memory/1424-2-0x0000000004B80000-0x0000000004B8E000-memory.dmp

    Filesize

    56KB

  • memory/1424-11-0x0000000005F30000-0x0000000006548000-memory.dmp

    Filesize

    6.1MB

  • memory/1424-9-0x0000000005810000-0x0000000005818000-memory.dmp

    Filesize

    32KB

  • memory/1424-12-0x0000000005970000-0x0000000005982000-memory.dmp

    Filesize

    72KB

  • memory/1424-13-0x00000000059D0000-0x0000000005A0C000-memory.dmp

    Filesize

    240KB

  • memory/1424-14-0x0000000005A10000-0x0000000005A5C000-memory.dmp

    Filesize

    304KB

  • memory/1424-15-0x0000000005B90000-0x0000000005C9A000-memory.dmp

    Filesize

    1.0MB

  • memory/1424-1-0x0000000000280000-0x000000000036A000-memory.dmp

    Filesize

    936KB

  • memory/1424-29-0x0000000074860000-0x0000000075010000-memory.dmp

    Filesize

    7.7MB