Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Orcus Admi...on.exe

windows11-21h2-x64

10

Orcus Admi...ew.vbs

windows11-21h2-x64

1

Orcus Admi...er.vbs

windows11-21h2-x64

1

Orcus Admi...es.vbs

windows11-21h2-x64

1

Orcus Admi...ons.js

windows11-21h2-x64

3

Orcus Admi...er.dll

windows11-21h2-x64

1

Orcus Admi...il.dll

windows11-21h2-x64

1

Orcus Admi...ns.dll

windows11-21h2-x64

1

Orcus Admi...ns.dll

windows11-21h2-x64

1

Orcus Admi...ed.dll

windows11-21h2-x64

1

Orcus Admi...it.dll

windows11-21h2-x64

1

Orcus Admi...es.dll

windows11-21h2-x64

1

Orcus Admi...er.dll

windows11-21h2-x64

1

Orcus Admi...ent.js

windows11-21h2-x64

3

Orcus Admi...del.js

windows11-21h2-x64

3

Orcus Admi...gin.js

windows11-21h2-x64

3

Orcus Admi...er.vbs

windows11-21h2-x64

1

Orcus Admi...es.vbs

windows11-21h2-x64

1

Orcus Admi...ro.dll

windows11-21h2-x64

1

Orcus Admi...st.dll

windows11-21h2-x64

1

Orcus Admi...it.dll

windows11-21h2-x64

1

Orcus Admi...ty.dll

windows11-21h2-x64

1

Orcus Admi...es.dll

windows11-21h2-x64

1

Orcus Admi...il.dll

windows11-21h2-x64

1

Orcus Admi...ns.dll

windows11-21h2-x64

1

Orcus Admi...ns.dll

windows11-21h2-x64

1

Orcus Admi...ed.dll

windows11-21h2-x64

1

Orcus Admi...st.dll

windows11-21h2-x64

1

Orcus Admi...it.dll

windows11-21h2-x64

1

Orcus Admi...ty.dll

windows11-21h2-x64

1

Orcus Admi...es.dll

windows11-21h2-x64

1

Orcus Admi...cs.dll

windows11-21h2-x64

1

Analysis

  • max time kernel
    802s
  • max time network
    1527s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/11/2024, 18:42 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Orcus Administartion/Orcus.Plugins.ExtensionSpoofer-master/Source/bin/Debug/Sorzus.Wpf.Toolkit.dll

  • Size

    60KB

  • MD5

    ad100bd000dc8301a6caa9b6426ae5da

  • SHA1

    b29863359973f228f11c1c567c5c5c2b98e373cb

  • SHA256

    4d9b236309b7c2ea4f824a2d301c9b7b09733ba1c08c7824d435c4afe5de9886

  • SHA512

    9855648988d4bc65612a9bb3b8800db4a0b4e4b0e27e03d3836c852060f65698a2cd3a64aad8e7657ec6798b0959c9832f979411923a8d41ba6cbb43505787f7

  • SSDEEP

    768:J81CdXuEcPnppfpH55IMrngVXpuwai8FLivooAzoy7TfsXjcgpH5puq:GjfaMEXuwMLie0yyjcgpHb

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Orcus Administartion\Orcus.Plugins.ExtensionSpoofer-master\Source\bin\Debug\Sorzus.Wpf.Toolkit.dll",#1
    1⤵
      PID:3948

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      self.events.data.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      self.events.data.microsoft.com
      IN A
      Response
      self.events.data.microsoft.com
      IN CNAME
      self-events-data.trafficmanager.net
      self-events-data.trafficmanager.net
      IN CNAME
      onedscolprdeus20.eastus.cloudapp.azure.com
      onedscolprdeus20.eastus.cloudapp.azure.com
      IN A
      20.42.65.93
    • flag-us
      DNS
      ctldl.windowsupdate.com
      Remote address:
      8.8.8.8:53
      Request
      ctldl.windowsupdate.com
      IN A
      Response
      ctldl.windowsupdate.com
      IN CNAME
      ctldl.windowsupdate.com.delivery.microsoft.com
      ctldl.windowsupdate.com.delivery.microsoft.com
      IN CNAME
      wu-b-net.trafficmanager.net
      wu-b-net.trafficmanager.net
      IN CNAME
      download.windowsupdate.com.edgesuite.net
      download.windowsupdate.com.edgesuite.net
      IN CNAME
      a767.dspw65.akamai.net
      a767.dspw65.akamai.net
      IN A
      2.23.210.83
      a767.dspw65.akamai.net
      IN A
      2.23.210.88
    • flag-us
      DNS
      83.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      83.210.23.2.in-addr.arpa
      IN PTR
      Response
      83.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-83deploystaticakamaitechnologiescom
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      355 B
       828 B
       5
      5

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      self.events.data.microsoft.com

      DNS Response

      20.42.65.93

      DNS Request

      ctldl.windowsupdate.com

      DNS Response

      2.23.210.83
      2.23.210.88

      DNS Request

      83.210.23.2.in-addr.arpa

      DNS Request

      172.210.232.199.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.