Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f1c3730640cff981b26a31d45a759bae4339512b63ef57ad310cbe4df8d40a65
-
Size
839KB
-
Sample
250111-be4v5awmdx
-
MD5
b3c2d66e8359f2b7e6a28c82e69ce611
-
SHA1
6449776bcc2b76c5317471689b3e04b6c6183870
-
SHA256
f1c3730640cff981b26a31d45a759bae4339512b63ef57ad310cbe4df8d40a65
-
SHA512
8dd801ebe37e68f9c0d879d8cc33e2cc416d1417278632209d19411f02e2f371351678de498d940d66a491a3a374648e465a36541c2df9172f562ad5dc63785f
-
SSDEEP
24576:4mIS04YNEMuExDiU6E5R9s8xY/2l/detnIbt+rH:7Q4auS+UjfU2TedIbt+r
Behavioral task
behavioral1
Sample
f1c3730640cff981b26a31d45a759bae4339512b63ef57ad310cbe4df8d40a65.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f1c3730640cff981b26a31d45a759bae4339512b63ef57ad310cbe4df8d40a65.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
orcus
/make-tools.gl.at.ply.gg
cdafeab2496e4f5fb1ec06fc6b6df13f
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
01/10/2025 13:28:04
-
plugins
AgEAAA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
f1c3730640cff981b26a31d45a759bae4339512b63ef57ad310cbe4df8d40a65
-
Size
839KB
-
MD5
b3c2d66e8359f2b7e6a28c82e69ce611
-
SHA1
6449776bcc2b76c5317471689b3e04b6c6183870
-
SHA256
f1c3730640cff981b26a31d45a759bae4339512b63ef57ad310cbe4df8d40a65
-
SHA512
8dd801ebe37e68f9c0d879d8cc33e2cc416d1417278632209d19411f02e2f371351678de498d940d66a491a3a374648e465a36541c2df9172f562ad5dc63785f
-
SSDEEP
24576:4mIS04YNEMuExDiU6E5R9s8xY/2l/detnIbt+rH:7Q4auS+UjfU2TedIbt+r
-
Orcus family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-