Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2024, 01:04
Behavioral task
behavioral1
Sample
394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe
Resource
win7-20240903-en
General
-
Target
394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe
-
Size
1.1MB
-
MD5
54347e3ae6be9d69ed6e88015e8a2db6
-
SHA1
dc582adf052059014ec7fdf151ad191fa85175ed
-
SHA256
394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919
-
SHA512
3210978088b571bd9fe1d14f1a4b483af28436b5730850fcad4e171616cf52b0a40ac210cf0cc565e17788fa83f2d5bb0fc1ae38ee721e80a1ccfa871a26458c
-
SSDEEP
24576:/Wnsll7mfUe+VnaFCnIR7XSA3Kd4Mp+xnFl3U:fvhe+naFCnIR7XSA6qM6H
Malware Config
Signatures
-
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023c93-15.dat family_orcus -
Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions System Runner.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions System Runner.exe -
Orcurs Rat Executable 2 IoCs
resource yara_rule behavioral2/memory/1132-1-0x00000000002E0000-0x000000000040E000-memory.dmp orcus behavioral2/files/0x0007000000023c93-15.dat orcus -
Looks for VMWare Tools registry key 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools System Runner.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools System Runner.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion System Runner.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion System Runner.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion System Runner.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion System Runner.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation System Runner.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation System Interrupt Data.exe -
Executes dropped EXE 4 IoCs
pid Process 2980 System Runner.exe 2908 System Runner.exe 640 System Interrupt Data.exe 3724 System Interrupt Data.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum System Runner.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 System Runner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum System Runner.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 System Runner.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\windows\System Runner.exe 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe File opened for modification C:\Program Files (x86)\windows\System Runner.exe 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe File created C:\Program Files (x86)\windows\System Runner.exe.config 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language System Runner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language System Runner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language System Interrupt Data.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language System Interrupt Data.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1132 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe 1132 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe 1132 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe 1132 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe 2980 System Runner.exe 2980 System Runner.exe 2980 System Runner.exe 2908 System Runner.exe 2908 System Runner.exe 2908 System Runner.exe 2908 System Runner.exe 2980 System Runner.exe 2980 System Runner.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 3724 System Interrupt Data.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2908 System Runner.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe 3724 System Interrupt Data.exe 2980 System Runner.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1132 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe Token: SeDebugPrivilege 2980 System Runner.exe Token: SeDebugPrivilege 2908 System Runner.exe Token: SeDebugPrivilege 640 System Interrupt Data.exe Token: SeDebugPrivilege 3724 System Interrupt Data.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 System Runner.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2980 System Runner.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1132 wrote to memory of 2980 1132 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe 84 PID 1132 wrote to memory of 2980 1132 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe 84 PID 1132 wrote to memory of 2980 1132 394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe 84 PID 2980 wrote to memory of 640 2980 System Runner.exe 86 PID 2980 wrote to memory of 640 2980 System Runner.exe 86 PID 2980 wrote to memory of 640 2980 System Runner.exe 86 PID 640 wrote to memory of 3724 640 System Interrupt Data.exe 87 PID 640 wrote to memory of 3724 640 System Interrupt Data.exe 87 PID 640 wrote to memory of 3724 640 System Interrupt Data.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe"C:\Users\Admin\AppData\Local\Temp\394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Program Files (x86)\windows\System Runner.exe"C:\Program Files (x86)\windows\System Runner.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Roaming\System Interrupt Data.exe"C:\Users\Admin\AppData\Roaming\System Interrupt Data.exe" /launchSelfAndExit "C:\Program Files (x86)\windows\System Runner.exe" 2980 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Roaming\System Interrupt Data.exe"C:\Users\Admin\AppData\Roaming\System Interrupt Data.exe" /watchProcess "C:\Program Files (x86)\windows\System Runner.exe" 2980 "/protectFile"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724
-
-
-
-
C:\Program Files (x86)\windows\System Runner.exe"C:\Program Files (x86)\windows\System Runner.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD554347e3ae6be9d69ed6e88015e8a2db6
SHA1dc582adf052059014ec7fdf151ad191fa85175ed
SHA256394b08793f9fe3eb5fb28a5897ab9378eb8148139fd91644cc3f33c03f874919
SHA5123210978088b571bd9fe1d14f1a4b483af28436b5730850fcad4e171616cf52b0a40ac210cf0cc565e17788fa83f2d5bb0fc1ae38ee721e80a1ccfa871a26458c
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33