4bd238af793445deb779e83f05915fc74ba980516aada1940bcab4d4e7608fcd

Analysis

max time kernel
44s
max time network
51s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Orcus RAT 1.9.1/Orcus.Administration/Orcus.Administration.exe
Size

3.9MB
MD5

37349777df1cc9c8d3d62eb733f7cd45
SHA1

456233fa947ab155dbe5636eda0a77346197bb4c
SHA256

0121f2d7ddc074ffa05619dbb2a4b555a4b550168a765b57fa8bd9298a7e4b52
SHA512

ca4e1a39dbb0fa0c6bbef7142cf457856cc2db14c03b5b9ea5c28811a3a70cc05505320f50e133e166aad25d779ac043b0f29b09bb34a342f5111603cc5dd074
SSDEEP

49152:VZV/t1QLjeVxAl40NVANW8cyTXTG1H66VbTWnepAl4:VZVDVxAl40NG48cyTKjVbTWnepAl4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000004ae00ca8813fc0b328782c6bfcf3ef064a1579d6df8283b80d77829c9e2a5dcc000000000e8000000002000020000000ad17afc440b3814a339e20dcf7151bf9934636a824d025ea2cc91d52f9591b6e90000000fa8546253248c56c213e2e9db656265b241923ed3e8eecae13e8736a6e4b1b12158523541125fe4509b1e17c39be8650660d4b62385cbec3efc9d2924e893612bc6657bcc8840bf0db7ea8177dfc75aabcae80197f6322de41c04321b321e2afaef1213047aa70e9bf2087912dacbe1c1f762a8f9513dd0ed9a40b70401a601976a66ec0d53ff531ae7b5d62f03c5eec40000000d5999534f9e986e72f9d5c4b8171f2bb6bbfaea3dbb093cc0dfaa0dada0f8f932c765c3b391b912dc45fbaeaf8fdef262d1ff791cf93edbd6fb961e6b2d3c618	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c278607cf68730e6e73efb3068d0ebec7e4aed4b4532474107d2a200c1895731000000000e800000000200002000000096bb4dae8a6b39e3292a4b4a2c7f83ed93c6ded516538452e92231eb6419f9e720000000bb5705d92230604501aa349fbf7944445fc6b7d79b23db840aaf3d8ebab1ff164000000009b6367d504a4325b604d61512592ac51d5ac9725a3fad711ff5489f1a663864062fff55066c46d37974a57133f429dd7e167e119da7dfbc2cc3d9fd0b716cd1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706eb984bddada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC2A8981-46B0-11EF-B3C2-F67F0CB12BFA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Orcus.Administration.exeiexplore.exe

description	pid	Process	procid_target
PID 2540 wrote to memory of 2376	2540	Orcus.Administration.exe	29
PID 2540 wrote to memory of 2376	2540	Orcus.Administration.exe	29
PID 2540 wrote to memory of 2376	2540	Orcus.Administration.exe	29
PID 2540 wrote to memory of 2376	2540	Orcus.Administration.exe	29
PID 2376 wrote to memory of 2268	2376	iexplore.exe	30
PID 2376 wrote to memory of 2268	2376	iexplore.exe	30
PID 2376 wrote to memory of 2268	2376	iexplore.exe	30
PID 2376 wrote to memory of 2268	2376	iexplore.exe	30
PID 2376 wrote to memory of 2200	2376	iexplore.exe	32
PID 2376 wrote to memory of 2200	2376	iexplore.exe	32
PID 2376 wrote to memory of 2200	2376	iexplore.exe	32
PID 2376 wrote to memory of 2200	2376	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\Orcus RAT 1.9.1\Orcus.Administration\Orcus.Administration.exe
"C:\Users\Admin\AppData\Local\Temp\Orcus RAT 1.9.1\Orcus.Administration\Orcus.Administration.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=Orcus.Administration.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2268
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:734213 /prefetch:2
    3⤵
    PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98662c494b2fa4dbb686fb6b9a3ef985

SHA1
322d565fdc101f5414180437c2e729dc23e4e458

SHA256
a2f0fc13d5449e6e3402917d4fd0f73a6791c7a007e4c1ce0bfb9ade401c2478

SHA512
b16f6945a52c6382c27460ed1ab16336474c09439639773f06e6973fc598eaac53e52dee5f9ae381d20eea9faac20b0f951bdaefa5496cc2a94150ab1339e4f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
031d377c0c796a6a22f2d3aea492dbc6

SHA1
20bdc4b891ed8e1844e0ada5beb4fca7a6d77c81

SHA256
73cba00b6e2357ccba86c2439932f5954c4cd83c43f73880de2814185af46138

SHA512
82c968af0289e878f8f38e7b8f73c7108a9107855d8c20083bc4c4207a15b51620e12385e9aff66c8cceddbf87a220bef792a30335b682aa500ba0576490b5c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c466089a2d446950c34fa984a306a866

SHA1
9de5e7e4a249afe3b43ad7b1c4d676c08a579037

SHA256
a0ddd95bb3b997cb3ede468583f9e2b1cf3c26bbd8c540b44628f620e85ad60e

SHA512
5d3b66d214f30c1da5ff364a7e59c19a4f80cee4831ee79737d69756e72993452d98927856bdf17d89c84f9887e5ecb0932c9e84c4d5641853427031baa1e502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0a87b6844727d8cfaeebd67d2d9405e

SHA1
b10c771052e3d8191a3c49f1311d71747a398ac0

SHA256
f04155bcff173afe031fc75f7f9c29a19fc0f3bb17a9e7a94c1024906b39f287

SHA512
9339e46a38a82ef34ded37ebdb094ff144be76890d80b6d779514329f2fb00f2ddc784ab97d94c85ecab93d3078cbd60d332902972c4a86a9703396371221b61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b40227992f318bd89a46192524690b7a

SHA1
d36eefec9be21eb44b9dcd80131508ac02e6dff7

SHA256
3cf742db4b9c7b2140b8cf491dd9420529fa37197f283c5f6a00f6d18b945746

SHA512
a448442ff2412b8e9037b44c719a7bfb4c89ee068023b2019b015dc0d16bced452f9a96ec877df618a8aae55af77c87b26fb6861b0ef709b165a3ec6eb7dda64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
284276d3d86f65ca820ec1ad104962b4

SHA1
22f0c4d215bd6b20d4c0df05d6808cf8e7c46649

SHA256
2ad40daf30c2633d8d572d8fc09a5b0d24cb95144e4fa7a540b7d647c53e73c8

SHA512
638a480f3b17e5b44ed95bb908767af7eedc117cd22a257c63a350195ac15235d79514c43e85310b12c3cbb947c862f3c0ec13a4dfc0e301424fa12175605cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3fb5e190f9ceb1fbdfa8ddd3a8160b8

SHA1
89d8b0e70af2edd99f84316d6fdb67ee5d2b9018

SHA256
f9b257b6b52453b0d0356c4694ef7043e20960c0b6a2e77a555a5f92d8d1d41a

SHA512
171bfbc2b9b162a66175d093d6fdddab5df8e6704e36124ba66715aedc0c91961cd0b5db4098493b732ff9aefc4842cb786e08ff65fc81ecaeba75dc6b4adbe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3cc72c56f6dd903acb320e1ea27554c

SHA1
7f0feffa8426a443b2cb8c6bc7a9a3acead50757

SHA256
09f78da08509b3d515317762497c4625ebff7c5c6c169507eff4a0b8d9fe39df

SHA512
7f354b8fca38353950d8ef34f4207aa1b3700f5e56894db9a282392124979961d7da2874480b9705e07717d102b68bc872a4133e23353e8f0c9baaa60527db32

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC33.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD10.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit