Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

Orbit.exe

windows10-1703-x64

7

Analysis

  • max time kernel
    9s
  • max time network
    7s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/10/2024, 19:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Orbit.exe

  • Size

    6.1MB

  • MD5

    c5a284f86ab09705d740e078dd2234fa

  • SHA1

    a687b49998e60b6f1007c1efb439f43a76751c0d

  • SHA256

    c518dd0c733979d19342438ebdcbb2b4048db263f7bcf109dded1ae040d1e8dd

  • SHA512

    f45d47c679ff37e0eb323ade59ff5537668f2f1481af490d0ff05679705ea238f2cdbd2f22b8262eb815e78ed1c2766dadae2a7f2beaf77b1700c8c8787e168a

  • SSDEEP

    98304:SCkUQdmsBO5sw/utgKOK7bev58rxc3rsUwyIO3ZCpbyCzPw:wZmAIWtrPa8r63rsNyIIZC1yIY

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Orbit.exe
    "C:\Users\Admin\AppData\Local\Temp\Orbit.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:5036
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4216
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:4592
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3840
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1308
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:2244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3IJIJAFG\favicon[1].ico
    Filesize

    23KB

    MD5

    ec2c34cadd4b5f4594415127380a85e6

    SHA1

    e7e129270da0153510ef04a148d08702b980b679

    SHA256

    128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

    SHA512

    c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

    Download Submit

  • memory/1308-49-0x000001C29EB00000-0x000001C29EC00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2244-77-0x0000026B21540000-0x0000026B21542000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2244-79-0x0000026B21880000-0x0000026B21882000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2244-81-0x0000026B219E0000-0x0000026B219E2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2244-66-0x0000026B10F00000-0x0000026B11000000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4216-42-0x000002AF493E0000-0x000002AF493E2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4216-7-0x000002AF4BE20000-0x000002AF4BE30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4216-23-0x000002AF4BF20000-0x000002AF4BF30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4216-133-0x000002AF53000000-0x000002AF53001000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4216-132-0x000002AF52DF0000-0x000002AF52DF1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5036-0-0x000000014027C000-0x00000001405C7000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/5036-4-0x0000000140000000-0x0000000140BEC000-memory.dmp

    Filesize

    11.9MB

    Download

  • memory/5036-1-0x00007FFDDCED0000-0x00007FFDDCED2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/5036-2-0x00007FFDDCEE0000-0x00007FFDDCEE2000-memory.dmp

    Filesize

    8KB

    Download