Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2024, 01:27 UTC

General

  • Target

    844723fe8d0dba68effa0969216be3c67133019f720396c47c8f57752d9c014c.exe

  • Size

    3.0MB

  • MD5

    a926645c212cd8d7667b2c0d91421bf8

  • SHA1

    042a63bb3bbdb79d81dc21b9517b213fa16ee9d4

  • SHA256

    844723fe8d0dba68effa0969216be3c67133019f720396c47c8f57752d9c014c

  • SHA512

    8c2557ff2bcd730f4a99306b19a6b05aaa30a2fc74d77a5d2c4f246bc12edb65c8acb270ce7e0016ea1884ddf9f3268403fc60f498fc6fae927d201aaa20e488

  • SSDEEP

    24576:wpP4MROxnFH3yRM4qrrcI0AilFEvxHPcdooV:w2MihylqrrcI0AilFEvxHPc

Malware Config

Extracted

Family

orcus

C2

venerra.ddns.net:1604

Mutex

8f144d586f97404d9cf70aca18e3708d

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %windir%/VMP/Protector/VMP Demo.exe

  • reconnect_delay

    10000

  • registry_keyname

    VMP Protect

  • taskscheduler_taskname

    VMP_Protect

  • watchdog_path

    AppData\VMP Https

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus family
  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 3 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\844723fe8d0dba68effa0969216be3c67133019f720396c47c8f57752d9c014c.exe
    "C:\Users\Admin\AppData\Local\Temp\844723fe8d0dba68effa0969216be3c67133019f720396c47c8f57752d9c014c.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe" --install
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:2700
    • C:\Windows\VMP\Protector\VMP Demo.exe
      "C:\Windows\VMP\Protector\VMP Demo.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3012
  • C:\Windows\SysWOW64\WindowsInput.exe
    "C:\Windows\SysWOW64\WindowsInput.exe"
    1⤵
    • Executes dropped EXE
    PID:760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\WindowsInput.exe.config

    Filesize

    357B

    MD5

    a2b76cea3a59fa9af5ea21ff68139c98

    SHA1

    35d76475e6a54c168f536e30206578babff58274

    SHA256

    f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

    SHA512

    b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

  • C:\Windows\VMP\Protector\VMP Demo.exe

    Filesize

    3.0MB

    MD5

    a926645c212cd8d7667b2c0d91421bf8

    SHA1

    042a63bb3bbdb79d81dc21b9517b213fa16ee9d4

    SHA256

    844723fe8d0dba68effa0969216be3c67133019f720396c47c8f57752d9c014c

    SHA512

    8c2557ff2bcd730f4a99306b19a6b05aaa30a2fc74d77a5d2c4f246bc12edb65c8acb270ce7e0016ea1884ddf9f3268403fc60f498fc6fae927d201aaa20e488

  • \Windows\SysWOW64\WindowsInput.exe

    Filesize

    21KB

    MD5

    e6fcf516d8ed8d0d4427f86e08d0d435

    SHA1

    c7691731583ab7890086635cb7f3e4c22ca5e409

    SHA256

    8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

    SHA512

    c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

  • memory/760-22-0x00000000010F0000-0x00000000010FC000-memory.dmp

    Filesize

    48KB

  • memory/1792-4-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB

  • memory/1792-1-0x0000000000220000-0x000000000030C000-memory.dmp

    Filesize

    944KB

  • memory/1792-6-0x0000000000650000-0x0000000000658000-memory.dmp

    Filesize

    32KB

  • memory/1792-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

    Filesize

    4KB

  • memory/1792-3-0x0000000002250000-0x00000000022AC000-memory.dmp

    Filesize

    368KB

  • memory/1792-34-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB

  • memory/1792-5-0x00000000005F0000-0x0000000000602000-memory.dmp

    Filesize

    72KB

  • memory/1792-2-0x00000000001C0000-0x00000000001CE000-memory.dmp

    Filesize

    56KB

  • memory/2700-20-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

    Filesize

    9.9MB

  • memory/2700-17-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

    Filesize

    9.9MB

  • memory/2700-16-0x0000000000D10000-0x0000000000D1C000-memory.dmp

    Filesize

    48KB

  • memory/2700-14-0x000007FEF5C03000-0x000007FEF5C04000-memory.dmp

    Filesize

    4KB

  • memory/3012-35-0x0000000001350000-0x000000000143C000-memory.dmp

    Filesize

    944KB

  • memory/3012-36-0x00000000003C0000-0x00000000003D2000-memory.dmp

    Filesize

    72KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.