Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
03-01-2025 22:55
Behavioral task
behavioral1
Sample
idk.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
idk.exe
Resource
win11-20241007-en
windows11-21h2-x64
10 signatures
150 seconds
General
-
Target
idk.exe
-
Size
839KB
-
MD5
ad5002dd9cd3b252b7c275a2dd79d775
-
SHA1
91a727e5c9f05221b156ab3e1193ae59272e0cfd
-
SHA256
0c358b071f65736dd2fb78a93bd8336c5798a880ffbccbe477eaf6068dff29e1
-
SHA512
d40cdd28a69d54895e826cb5c2fb19312f246bd8602856f951468e221c257abbfd795ec6ce71e9490d18caf545a9bd1f18101f42683735ea5f28e7226aab5bd3
-
SSDEEP
24576:EmIS04YNEMuExDiU6E5R9s8xY/2l/detnIbt+rM:PQ4auS+UjfU2TedIbt+r
Malware Config
Extracted
Family
orcus
C2
147.185.221.22
Mutex
23916b7f8d59419db18ccb87d0eaa124
Attributes
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
01/03/2025 23:54:21
-
plugins
AgEAAA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
aes.plain
Signatures
-
Orcus family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation idk.exe -
Executes dropped EXE 1 IoCs
pid Process 5064 AudioDriver.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini idk.exe File created C:\Windows\assembly\Desktop.ini idk.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly idk.exe File created C:\Windows\assembly\Desktop.ini idk.exe File opened for modification C:\Windows\assembly\Desktop.ini idk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5064 AudioDriver.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5064 AudioDriver.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5056 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5064 AudioDriver.exe Token: SeDebugPrivilege 5056 taskmgr.exe Token: SeSystemProfilePrivilege 5056 taskmgr.exe Token: SeCreateGlobalPrivilege 5056 taskmgr.exe Token: SeSecurityPrivilege 5056 taskmgr.exe Token: SeTakeOwnershipPrivilege 5056 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5064 AudioDriver.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5064 AudioDriver.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3764 wrote to memory of 5064 3764 idk.exe 81 PID 3764 wrote to memory of 5064 3764 idk.exe 81 PID 3764 wrote to memory of 5064 3764 idk.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\idk.exe"C:\Users\Admin\AppData\Local\Temp\idk.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5064
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5056
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
839KB
MD5ad5002dd9cd3b252b7c275a2dd79d775
SHA191a727e5c9f05221b156ab3e1193ae59272e0cfd
SHA2560c358b071f65736dd2fb78a93bd8336c5798a880ffbccbe477eaf6068dff29e1
SHA512d40cdd28a69d54895e826cb5c2fb19312f246bd8602856f951468e221c257abbfd795ec6ce71e9490d18caf545a9bd1f18101f42683735ea5f28e7226aab5bd3
-
Filesize
7.2MB
MD5f6d8913637f1d5d2dc846de70ce02dc5
SHA15fc9c6ab334db1f875fbc59a03f5506c478c6c3e
SHA2564e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187
SHA51221217a0a0eca58fc6058101aa69cf30d5dbe419c21fa7a160f44d8ebbcf5f4011203542c8f400a9bb8ee3826706417f2939c402f605817df597b7ff812b43036