Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 01:07
Static task
static1
Behavioral task
behavioral1
Sample
05b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab.exe
Resource
win7-20240903-en
General
-
Target
05b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab.exe
-
Size
21.0MB
-
MD5
5fe163ee7dfb0c1040fa5b9ef8bfd223
-
SHA1
1b9e236e6da779fe668e89cb876999ec3663a2da
-
SHA256
05b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab
-
SHA512
455b1d68b5d70614dc121f914805713d93b9e4016a79cdf5bd97ff1e76e951f36595e6b91d41048f852d904d6fc6ac843408c52c510a6a6179e20482520baa3b
-
SSDEEP
24576:Y9KS04YNEMuExDiU6E5R9s8xY/2l/dO5Ibt+r/:Y9G4auS+UjfU2TQIbt+r
Malware Config
Extracted
orcus
1337
5email-hitting.gl.at.ply.gg
807fd7820d59421db89058305773b035
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
10/22/2024 21:07:12
-
plugins
AgEAAA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 05b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab.exe -
Executes dropped EXE 1 IoCs
pid Process 1636 AudioDriver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 05b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe 1636 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1636 AudioDriver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1636 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1636 AudioDriver.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1636 AudioDriver.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2900 wrote to memory of 1636 2900 05b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab.exe 90 PID 2900 wrote to memory of 1636 2900 05b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab.exe 90 PID 2900 wrote to memory of 1636 2900 05b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\05b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab.exe"C:\Users\Admin\AppData\Local\Temp\05b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21.0MB
MD55fe163ee7dfb0c1040fa5b9ef8bfd223
SHA11b9e236e6da779fe668e89cb876999ec3663a2da
SHA25605b28d33d1c01b663799fa4b17405436cb8831dd19f9846ab4c1f01b6c7983ab
SHA512455b1d68b5d70614dc121f914805713d93b9e4016a79cdf5bd97ff1e76e951f36595e6b91d41048f852d904d6fc6ac843408c52c510a6a6179e20482520baa3b