Analysis
-
max time kernel
34s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 08:46
Static task
static1
Behavioral task
behavioral1
Sample
yef.exe
Resource
win7-20240729-en
General
-
Target
yef.exe
-
Size
1.2MB
-
MD5
58991bbcf8a974e128ba64f3bcb31e6e
-
SHA1
645a5096283c1f0b63ff07f3927534e44804114d
-
SHA256
d05f328df78420b8d97cb7205cccee30617ebeff333ac8d5ed32f6da69563baa
-
SHA512
76c35a2b6b787ded9c049b189b8844019720f47c0f2e07ced1c9b9b7622382d50062770f222ad1a0a626e66498be3d3e6cc22ca9c7fbf72d3b29b7f59e881eb6
-
SSDEEP
24576:rwVTXJvatkjAE+k/7aygMpbUdtoQVj020iDqxJooLUcdJYRk:KTQujL+hMyhVj8y8J7UcG
Malware Config
Extracted
orcus
cuties
5virginia-evil.gl.at.ply.gg
c75fa2addeaf42abb9797c0d693eca2b
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
10/27/2024 02:14:09
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgNwA2ADkAMwA2AGQAMQAzAGMAYQAwAGMANAA5ADQANgA5AGIAMgBkAGUAOAA5ADQAMAAxADkANABiAGEAMAAzAAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDAAYQA4ADAANgA5AGMAZAA2AGUAMwA1ADQANAA1ADQAYQBkADMAOAAwAGQANABjAGIAYQA4ADYANQA2ADAANwABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIDQAZAA0ADEAYQAwADEAMgBkADgAMwBlADQAOABmADQAYQAxADEAYQBiAGYAYwA3ADMAMQBkADIAOQAwAGEAYwACAAYG
-
reconnect_delay
10000
-
registry_autostart_keyname
cmd
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Signatures
-
Orcus family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation yef.exe -
Executes dropped EXE 4 IoCs
pid Process 3624 AudioDriver.exe 4340 AudioDriver.exe 3680 AudioDriver.exe 212 AudioDriver.exe -
Loads dropped DLL 1 IoCs
pid Process 212 AudioDriver.exe -
pid Process 3244 powershell.exe 668 powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4608 set thread context of 3452 4608 yef.exe 87 PID 3624 set thread context of 212 3624 AudioDriver.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3244 powershell.exe 3244 powershell.exe 3624 AudioDriver.exe 3624 AudioDriver.exe 3624 AudioDriver.exe 3624 AudioDriver.exe 668 powershell.exe 212 AudioDriver.exe 212 AudioDriver.exe 212 AudioDriver.exe 668 powershell.exe 212 AudioDriver.exe 212 AudioDriver.exe 212 AudioDriver.exe 212 AudioDriver.exe 212 AudioDriver.exe 212 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3244 powershell.exe Token: SeDebugPrivilege 3624 AudioDriver.exe Token: SeDebugPrivilege 668 powershell.exe Token: SeDebugPrivilege 212 AudioDriver.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 212 AudioDriver.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4608 wrote to memory of 3244 4608 yef.exe 85 PID 4608 wrote to memory of 3244 4608 yef.exe 85 PID 4608 wrote to memory of 3244 4608 yef.exe 85 PID 4608 wrote to memory of 3452 4608 yef.exe 87 PID 4608 wrote to memory of 3452 4608 yef.exe 87 PID 4608 wrote to memory of 3452 4608 yef.exe 87 PID 4608 wrote to memory of 3452 4608 yef.exe 87 PID 4608 wrote to memory of 3452 4608 yef.exe 87 PID 4608 wrote to memory of 3452 4608 yef.exe 87 PID 4608 wrote to memory of 3452 4608 yef.exe 87 PID 4608 wrote to memory of 3452 4608 yef.exe 87 PID 3452 wrote to memory of 3624 3452 yef.exe 88 PID 3452 wrote to memory of 3624 3452 yef.exe 88 PID 3452 wrote to memory of 3624 3452 yef.exe 88 PID 3624 wrote to memory of 668 3624 AudioDriver.exe 89 PID 3624 wrote to memory of 668 3624 AudioDriver.exe 89 PID 3624 wrote to memory of 668 3624 AudioDriver.exe 89 PID 3624 wrote to memory of 4340 3624 AudioDriver.exe 92 PID 3624 wrote to memory of 4340 3624 AudioDriver.exe 92 PID 3624 wrote to memory of 4340 3624 AudioDriver.exe 92 PID 3624 wrote to memory of 3680 3624 AudioDriver.exe 93 PID 3624 wrote to memory of 3680 3624 AudioDriver.exe 93 PID 3624 wrote to memory of 3680 3624 AudioDriver.exe 93 PID 3624 wrote to memory of 212 3624 AudioDriver.exe 94 PID 3624 wrote to memory of 212 3624 AudioDriver.exe 94 PID 3624 wrote to memory of 212 3624 AudioDriver.exe 94 PID 3624 wrote to memory of 212 3624 AudioDriver.exe 94 PID 3624 wrote to memory of 212 3624 AudioDriver.exe 94 PID 3624 wrote to memory of 212 3624 AudioDriver.exe 94 PID 3624 wrote to memory of 212 3624 AudioDriver.exe 94 PID 3624 wrote to memory of 212 3624 AudioDriver.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\yef.exe"C:\Users\Admin\AppData\Local\Temp\yef.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\.exe"' -PropertyType 'String'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
-
C:\Users\Admin\AppData\Local\Temp\yef.exe#cmd2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\.exe"' -PropertyType 'String'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe#cmd4⤵
- Executes dropped EXE
PID:4340
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe#cmd4⤵
- Executes dropped EXE
PID:3680
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe#cmd4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:212
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5fb1df442f2cee34456c6ed9064318559
SHA1729e8f61f181b303d25e1f709399db242d82c6c2
SHA25675207b26127c0778928b2c0ce51d371a1b4f5a4c47596902f88dbff9ddd16a79
SHA512d6df1b8e17733d65ae332d20a22fcbc2cdec8df38a705b694b4d87b2f0c9c287378791c3da2cb2142e95f31df1b4209e01a17a83eabfcb2175f38a9207ad0294
-
Filesize
321B
MD5baf5d1398fdb79e947b60fe51e45397f
SHA149e7b8389f47b93509d621b8030b75e96bb577af
SHA25610c8c7b5fa58f8c6b69f44e92a4e2af111b59fcf4f21a07e04b19e14876ccdf8
SHA512b2c9ef5581d5eae7c17ae260fe9f52344ed737fa851cb44d1cea58a32359d0ac5d0ca3099c970209bd30a0d4af6e504101f21b7054cf5eca91c0831cf12fb413
-
Filesize
18KB
MD5d46db50f2af614023ab1167a03479c48
SHA19da855378a77a4b4c73dbb5e1edab5c36a3ba36c
SHA25638c2fedf6a94c82552be3169e62da9767604e0bcdaf3b40ddc507d527b17f739
SHA5122fe4a40b87143c09e74710adf67661a0a2b05aa87a0f94fb06fbde1904997bc807a5dc0a8a78c06f6915c2ce7c35842b30c1b4c0461f81e4fd073ab0be881c74
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
626KB
MD5d8aec01ff14e3e7ad43a4b71e30482e4
SHA1e3015f56f17d845ec7eef11d41bbbc28cc16d096
SHA256da1d608be064555ab3d3d35e6db64527b8c44f3fa5ddd7c3ec723f80fc99736e
SHA512f5b2f4bda0cc13e1d1c541fb0caea14081ee4daffd497e31a3d4d55d5f9d85a61158b4891a6527efe623b2f32b697ac912320d9be5c0303812ca98dcc8866fcf
-
Filesize
1.2MB
MD558991bbcf8a974e128ba64f3bcb31e6e
SHA1645a5096283c1f0b63ff07f3927534e44804114d
SHA256d05f328df78420b8d97cb7205cccee30617ebeff333ac8d5ed32f6da69563baa
SHA51276c35a2b6b787ded9c049b189b8844019720f47c0f2e07ced1c9b9b7622382d50062770f222ad1a0a626e66498be3d3e6cc22ca9c7fbf72d3b29b7f59e881eb6