Analysis
-
max time kernel
207s -
max time network
224s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
10-11-2024 18:37
General
-
Target
Orcus Administartion/Orcus.Administration.exe
-
Size
4.5MB
-
MD5
0ba76b40f0aab5ed75feb24c5119874e
-
SHA1
515bd47fe5d4dd4e3a9d9cfdb5003101923c936c
-
SHA256
f3b78d3d11e6f223dd2ddddc55acfc33eaed900b74f274baea2c682716f0d55d
-
SHA512
8e34e600016ad23cfd1924f1eaa4b64d13617a6a82220d6ad2857a07e8292c1533900169f8d40384359a111f712c85554d8948b797c8d762fae057e375439d0b
-
SSDEEP
49152:OGZeMQLKNBJAl40NVANW8cyTAiE99TIWttF5UoFtAl4:OGVBJAl40NG48cyTOkWttF5UoFtAl4
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Orcus Administartion\Orcus.Administration.exe"C:\Users\Admin\AppData\Local\Temp\Orcus Administartion\Orcus.Administration.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 25722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4272 -ip 42721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4.5MB
-
Filesize
760KB
-
Filesize
2.6MB
-
Filesize
7.7MB
-
Filesize
1.0MB
-
Filesize
1.2MB
-
Filesize
144KB
-
Filesize
7.7MB
-
Filesize
1.1MB
-
Filesize
112KB
-
Filesize
216KB
-
Filesize
88KB
-
Filesize
584KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
376KB
-
Filesize
56KB
-
Filesize
704KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
880KB
-
Filesize
72KB
-
Filesize
984KB
-
Filesize
18.4MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
1.6MB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
3.4MB
-
Filesize
20.1MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
6.1MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
80KB
-
Filesize
5.2MB
-
Filesize
7.7MB