Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/12/2024, 01:02
Behavioral task
behavioral1
Sample
790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe
Resource
win7-20241010-en
General
-
Target
790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe
-
Size
3.0MB
-
MD5
a5c760e458503463ed3902bdbf605e4e
-
SHA1
2fb83c914783070267e42dbad89fd2c7afc9d9af
-
SHA256
790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32
-
SHA512
5b905facc4db2afb1dec0460b965c705c2566d91e2db7a95bc23cbd7dc8cbdb9414d4b4a6306e7a57d5ff4eb658910f12497608d5442cc5d8c740dc5be446b5b
-
SSDEEP
49152:XP7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpiu/nRFfjI7L0qb:XPHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Mamont
31.44.184.52:38135
sudo_hukjod904skbxj09l4njrec7guj3gu0r
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
C:\ProgramData\$77RegAsm.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023b4f-13.dat family_orcus -
Orcurs Rat Executable 2 IoCs
resource yara_rule behavioral2/memory/1920-1-0x0000000000980000-0x0000000000C7E000-memory.dmp orcus behavioral2/files/0x000c000000023b4f-13.dat orcus -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe -
Executes dropped EXE 4 IoCs
pid Process 4692 $77RegAsm.exe 1136 $77RegAsm.exe 3536 $77RegAsm.exe 4744 $77RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4692 set thread context of 1300 4692 $77RegAsm.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language $77RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language $77RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language $77RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language $77RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caspol.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1920 790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe 4692 $77RegAsm.exe 4692 $77RegAsm.exe 4692 $77RegAsm.exe 4692 $77RegAsm.exe 4692 $77RegAsm.exe 4692 $77RegAsm.exe 1300 caspol.exe 1300 caspol.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1920 790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe Token: SeDebugPrivilege 4692 $77RegAsm.exe Token: SeDebugPrivilege 1300 caspol.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1920 wrote to memory of 4692 1920 790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe 83 PID 1920 wrote to memory of 4692 1920 790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe 83 PID 1920 wrote to memory of 4692 1920 790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe 83 PID 4692 wrote to memory of 4340 4692 $77RegAsm.exe 85 PID 4692 wrote to memory of 4340 4692 $77RegAsm.exe 85 PID 4692 wrote to memory of 4340 4692 $77RegAsm.exe 85 PID 4692 wrote to memory of 2024 4692 $77RegAsm.exe 86 PID 4692 wrote to memory of 2024 4692 $77RegAsm.exe 86 PID 4692 wrote to memory of 2024 4692 $77RegAsm.exe 86 PID 4692 wrote to memory of 1300 4692 $77RegAsm.exe 87 PID 4692 wrote to memory of 1300 4692 $77RegAsm.exe 87 PID 4692 wrote to memory of 1300 4692 $77RegAsm.exe 87 PID 4692 wrote to memory of 1300 4692 $77RegAsm.exe 87 PID 4692 wrote to memory of 1300 4692 $77RegAsm.exe 87 PID 4692 wrote to memory of 1300 4692 $77RegAsm.exe 87 PID 4692 wrote to memory of 1300 4692 $77RegAsm.exe 87 PID 4692 wrote to memory of 1300 4692 $77RegAsm.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe"C:\Users\Admin\AppData\Local\Temp\790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\ProgramData\$77RegAsm.exe"C:\ProgramData\$77RegAsm.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"3⤵PID:4340
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"3⤵PID:2024
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
-
C:\ProgramData\$77RegAsm.exeC:\ProgramData\$77RegAsm.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1136
-
C:\ProgramData\$77RegAsm.exeC:\ProgramData\$77RegAsm.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3536
-
C:\ProgramData\$77RegAsm.exeC:\ProgramData\$77RegAsm.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5a5c760e458503463ed3902bdbf605e4e
SHA12fb83c914783070267e42dbad89fd2c7afc9d9af
SHA256790c0d272971a137154f73bb6cb829ac88a9fa9dceaee1e656392dc8bc1e0c32
SHA5125b905facc4db2afb1dec0460b965c705c2566d91e2db7a95bc23cbd7dc8cbdb9414d4b4a6306e7a57d5ff4eb658910f12497608d5442cc5d8c740dc5be446b5b
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
1KB
MD5663b8d5469caa4489d463aa9bc18124f
SHA1e57123a7d969115853ea631a3b33826335025d28
SHA2567b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8
SHA51245e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55