Analysis

  • max time kernel
    132s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 08:28

General

  • Target

    Setup.exe

  • Size

    22.2MB

  • MD5

    34f2ef891525e09125f3ae9242e3977b

  • SHA1

    9797f1bed2e1a6d414eaf24d1a272ec8b4d27ed9

  • SHA256

    bf441553ee1ded29d0719a946eb12f2b69cf374814f82f4673eff46454bed183

  • SHA512

    575ea4bb5a24e1008813a196d080c47f21bb15dbbb01072ed72ff953c70146fb580e2e36af2a76043688fadf0bbd8b26b2d47f89eedb8cfe44725993b582ba5a

  • SSDEEP

    393216:tEKmSG9Yzv90ptmD3TwJZQ1wKun1EO54X1Ke6LE0CWVNseKnti5DpSKk:tEKa9Yzv9atK3MJSKJn1EO54sro0Ciqr

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4496
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5040
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:556

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Ethical Hacking\Orcus Rat\libraries\Orcus.Administration.Licensing.pdb

      Filesize

      80KB

      MD5

      70e207da89961cd32217eabbe3ac0791

      SHA1

      305ba309e762a128ae098e5bf0241ba71f3a331e

      SHA256

      83f968c6682b0e52b217daa6aa3da21be6967aa194a14631f43cc76c11a142e9

      SHA512

      8d9de9a9b3ad265a1df7bd7ab790db639d6ef4b871275a5b2fbb72f9b324cc3158d2073de2de78692fa7ffe64e78e31e7d7f75cb3b50c0d6513da21094bad075

    • C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp

      Filesize

      8.0MB

      MD5

      4d6f877098bd5380b41801007b389edc

      SHA1

      d5f4a5277f66158aa4073ec13e94a13fdda5e0a7

      SHA256

      d9b13d7f25761fb923aa1b630760a7779b93b93ba4978e429f13c1b22051c1da

      SHA512

      0204b530a7b8199efecb739823d0eb8fbb42b9e348aa3ec920c8ab4831f47cfccb51c00dcddc0fa05439134d60455fa6f98c28acaa98e9e9fea5ce7638b1deaf

    • C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmp

      Filesize

      5.9MB

      MD5

      09f93824b1cd2e99c1558553490e57ca

      SHA1

      f3caf991413a9638188af7a8840a360dd314e22b

      SHA256

      699eb437404697f9c57b5124c7c4760339eb313348903fd1d3d3e9c4b0139e54

      SHA512

      3c63f4b3dbf0ce43353c0668ec7f68f090b1d4a6a5458063dc052836e5c8b17a7299fcc7714dade54936640e1f96e4f224c86de60b9970b51f01f4656da6cf50

    • memory/556-332-0x000001F7417E0000-0x000001F7417E1000-memory.dmp

      Filesize

      4KB

    • memory/556-330-0x000001F7417E0000-0x000001F7417E1000-memory.dmp

      Filesize

      4KB

    • memory/556-331-0x000001F7417E0000-0x000001F7417E1000-memory.dmp

      Filesize

      4KB

    • memory/556-342-0x000001F7417E0000-0x000001F7417E1000-memory.dmp

      Filesize

      4KB

    • memory/556-341-0x000001F7417E0000-0x000001F7417E1000-memory.dmp

      Filesize

      4KB

    • memory/556-340-0x000001F7417E0000-0x000001F7417E1000-memory.dmp

      Filesize

      4KB

    • memory/556-339-0x000001F7417E0000-0x000001F7417E1000-memory.dmp

      Filesize

      4KB

    • memory/556-338-0x000001F7417E0000-0x000001F7417E1000-memory.dmp

      Filesize

      4KB

    • memory/556-337-0x000001F7417E0000-0x000001F7417E1000-memory.dmp

      Filesize

      4KB

    • memory/556-336-0x000001F7417E0000-0x000001F7417E1000-memory.dmp

      Filesize

      4KB

    • memory/4496-329-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4496-15-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB