Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
scvhost.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
General
-
Target
scvhost.exe
-
Size
3.4MB
-
MD5
9ab1178a5c70cf83d7b40db848ff8ee0
-
SHA1
43a888f1028252adf023110315807fb80c7113c1
-
SHA256
0558fd9738cc4cb59130fa161c0ef401c189bf99958315fd2c6e218c10f26dcf
-
SHA512
7a3fe0a7cc0839fbdf6693a09d752bb27757e2a38e0b8d86424c5e9850420c0300ac310d34dabbb8acbc559e469dcabbcb10084887c01b178412e766b14360a3
-
SSDEEP
98304:6VOK0lWByzgx5x4z5ErcbFyDNesFQ561tozkMzXu7khZF:vluyzUQ5Er+H6GzkMQkhT
Malware Config
Signatures
-
Orcurs Rat Executable 2 IoCs
resource yara_rule behavioral1/memory/2528-2-0x000000001ADE0000-0x000000001B1AC000-memory.dmp orcus behavioral1/memory/2268-6-0x0000000140000000-0x00000001405E8000-memory.dmp orcus -
Enumerates system info in registry 2 TTPs 32 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2268 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2268 taskmgr.exe Token: SeDebugPrivilege 312 taskmgr.exe Token: SeShutdownPrivilege 1964 LogonUI.exe Token: SeShutdownPrivilege 1964 LogonUI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe 2268 taskmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2588 2268 taskmgr.exe 32 PID 2268 wrote to memory of 2588 2268 taskmgr.exe 32 PID 2268 wrote to memory of 2588 2268 taskmgr.exe 32 PID 2112 wrote to memory of 1964 2112 csrss.exe 40 PID 2112 wrote to memory of 1964 2112 csrss.exe 40 PID 2068 wrote to memory of 1964 2068 winlogon.exe 40 PID 2068 wrote to memory of 1964 2068 winlogon.exe 40 PID 2068 wrote to memory of 1964 2068 winlogon.exe 40 PID 2112 wrote to memory of 1964 2112 csrss.exe 40 PID 2112 wrote to memory of 1964 2112 csrss.exe 40 PID 2112 wrote to memory of 1964 2112 csrss.exe 40 PID 2112 wrote to memory of 1964 2112 csrss.exe 40 PID 2112 wrote to memory of 1964 2112 csrss.exe 40 PID 2112 wrote to memory of 1964 2112 csrss.exe 40 PID 2112 wrote to memory of 1964 2112 csrss.exe 40 PID 2112 wrote to memory of 1964 2112 csrss.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\scvhost.exe"C:\Users\Admin\AppData\Local\Temp\scvhost.exe"1⤵PID:2528
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵PID:2588
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:2212
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious use of AdjustPrivilegeToken
PID:312
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2112
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-