Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 03:43

General

  • Target

    28260a8f637d0d6dfdad0461e24eacac_JaffaCakes118.exe

  • Size

    917KB

  • MD5

    28260a8f637d0d6dfdad0461e24eacac

  • SHA1

    14e42641eb6cd50a37fea63bf7c11b69f30eb3a6

  • SHA256

    a58d0d19ebeb7f3ff0ad74eb9606a71a7d3960099ba5de5b295f79dcd4216a2d

  • SHA512

    3a29c8a837f225c64534bd786ae6d935f857fb94b5a9f44ae8e56a3f2d3e6d6175ca0d60f4bc7c5cce441bbb4e49a1ef0ae1334e5ede8e836da7e618a3b2246d

  • SSDEEP

    24576:oBT4MROxnFD3XEsYxrZlI0AilFEvxHi0/:oB0MiJirZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

0.tcp.ngrok.io:10836

Mutex

f3b2c54fefc748608450f2a783561b9b

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\sysfiles\svchost.exe

  • reconnect_delay

    10000

  • registry_keyname

    OWO

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\wd.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\28260a8f637d0d6dfdad0461e24eacac_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\28260a8f637d0d6dfdad0461e24eacac_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\edjt1h-y.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES147B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC147A.tmp"
        3⤵
          PID:2116
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:2712
      • C:\Program Files\sysfiles\svchost.exe
        "C:\Program Files\sysfiles\svchost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Users\Admin\AppData\Roaming\wd.exe
          "C:\Users\Admin\AppData\Roaming\wd.exe" /launchSelfAndExit "C:\Program Files\sysfiles\svchost.exe" 2464
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2936
          • C:\Users\Admin\AppData\Roaming\wd.exe
            "C:\Users\Admin\AppData\Roaming\wd.exe" /watchProcess "C:\Program Files\sysfiles\svchost.exe" 2464
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2352
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:2740
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {2A1B3741-57A0-497D-9058-1948543930B0} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:556
      • C:\Program Files\sysfiles\svchost.exe
        "C:\Program Files\sysfiles\svchost.exe"
        2⤵
        • Executes dropped EXE
        PID:2996

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\sysfiles\svchost.exe

      Filesize

      917KB

      MD5

      28260a8f637d0d6dfdad0461e24eacac

      SHA1

      14e42641eb6cd50a37fea63bf7c11b69f30eb3a6

      SHA256

      a58d0d19ebeb7f3ff0ad74eb9606a71a7d3960099ba5de5b295f79dcd4216a2d

      SHA512

      3a29c8a837f225c64534bd786ae6d935f857fb94b5a9f44ae8e56a3f2d3e6d6175ca0d60f4bc7c5cce441bbb4e49a1ef0ae1334e5ede8e836da7e618a3b2246d

    • C:\Users\Admin\AppData\Local\Temp\RES147B.tmp

      Filesize

      1KB

      MD5

      ba49c59bee6614eea0669b52b7f4fe06

      SHA1

      8c7c25d989782854277a42f47406b0ef6f107ea0

      SHA256

      005ce981357f9fc99f3ccd0af52ec654558e7f02ee1376533f6ab89e403a8e22

      SHA512

      d46394a8abae13755b2cd8f89f9869c48d71e4a312fceb045c2a50b9ea43e7bf84ac49809fd427b3d5a160a80c9270f0a57a25f29dee92fcd6d389e98d5a9e91

    • C:\Users\Admin\AppData\Local\Temp\edjt1h-y.dll

      Filesize

      76KB

      MD5

      9dc5b6294543a5dae558536fc314e178

      SHA1

      c07936d0779ffb359607329b7e602bb96b5c2cf2

      SHA256

      bda6c5eb0c2a5fcb060b4b1c27a15ee054700c4d15bd4d7c5f6640520457b219

      SHA512

      eadbb2ec54e6927d3d1a8c6979ebbe44b599fef0d900d9c4b4c700fcaab25e99cd0376c0cf0c23db4daee4bcea9f80305315a52cd066db6cf2b1ae2bfc389805

    • C:\Users\Admin\AppData\Roaming\wd.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC147A.tmp

      Filesize

      676B

      MD5

      0e722fcc3447d91bde191485603fb762

      SHA1

      dc7d1fbd05c74c99002431d874d453aa39ba546d

      SHA256

      801292bdbadd8a7dd9b70020b7db18f09dab07e68a23855983611d5cb8e9b4f3

      SHA512

      8265ca8747e78617bc7a6c75b983e5b4d0a9f14de0b73cf53128ff24ddd647d2acf0303f2b943f2dc09c73fc905f813f31f23c351848b2b384e68f72c0c94ab6

    • \??\c:\Users\Admin\AppData\Local\Temp\edjt1h-y.0.cs

      Filesize

      208KB

      MD5

      c555d9796194c1d9a1310a05a2264e08

      SHA1

      82641fc4938680519c3b2e925e05e1001cbd71d7

      SHA256

      ccbb8fd27ab2f27fbbd871793886ff52ff1fbd9117c98b8d190c1a96b67e498a

      SHA512

      0b85ca22878998c7697c589739905b218f9b264a32c8f99a9f9dd73d0687a5de46cc7e851697ee16424baf94d301e411648aa2d061ac149a6d2e06b085e07090

    • \??\c:\Users\Admin\AppData\Local\Temp\edjt1h-y.cmdline

      Filesize

      349B

      MD5

      ab80ee41a1d7553579bf4adb25c7c89a

      SHA1

      eee019e68dd86e34c7526692d93e93e9858c6f78

      SHA256

      76afa9ee6715ace824ab3bf5646ecbdab3a53ec70948fbea49571f5285f0bb31

      SHA512

      7ff1786adda3204f786270260fd7c5a3e3bcb0c8ccd467327c6b243ddd9f3c282170837005a0e314a2233bb3099a792b250374bc4836ea2c2bb333ccc27d49c0

    • memory/912-20-0x0000000000520000-0x0000000000532000-memory.dmp

      Filesize

      72KB

    • memory/912-2-0x0000000000500000-0x000000000050E000-memory.dmp

      Filesize

      56KB

    • memory/912-1-0x0000000002180000-0x00000000021DC000-memory.dmp

      Filesize

      368KB

    • memory/912-17-0x000000001AFA0000-0x000000001AFB6000-memory.dmp

      Filesize

      88KB

    • memory/912-0-0x000007FEF5B6E000-0x000007FEF5B6F000-memory.dmp

      Filesize

      4KB

    • memory/912-42-0x000007FEF58B0000-0x000007FEF624D000-memory.dmp

      Filesize

      9.6MB

    • memory/912-4-0x000007FEF58B0000-0x000007FEF624D000-memory.dmp

      Filesize

      9.6MB

    • memory/912-3-0x000007FEF58B0000-0x000007FEF624D000-memory.dmp

      Filesize

      9.6MB

    • memory/2308-57-0x000007FEF58B0000-0x000007FEF624D000-memory.dmp

      Filesize

      9.6MB

    • memory/2308-19-0x000007FEF58B0000-0x000007FEF624D000-memory.dmp

      Filesize

      9.6MB

    • memory/2464-43-0x00000000007B0000-0x00000000007FE000-memory.dmp

      Filesize

      312KB

    • memory/2464-44-0x00000000020C0000-0x00000000020D8000-memory.dmp

      Filesize

      96KB

    • memory/2464-45-0x0000000002100000-0x0000000002110000-memory.dmp

      Filesize

      64KB

    • memory/2464-41-0x0000000000800000-0x00000000008EA000-memory.dmp

      Filesize

      936KB

    • memory/2712-28-0x00000000002E0000-0x00000000002EC000-memory.dmp

      Filesize

      48KB

    • memory/2740-32-0x00000000008F0000-0x00000000008FC000-memory.dmp

      Filesize

      48KB

    • memory/2936-55-0x0000000001020000-0x0000000001028000-memory.dmp

      Filesize

      32KB