Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
11-01-2025 02:42
Behavioral task
behavioral1
Sample
idk.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral2
Sample
idk.exe
Resource
win11-20241007-en
General
-
Target
idk.exe
-
Size
845KB
-
MD5
cc2cf085bc4a4672c85e0fd612133609
-
SHA1
7f902447b5a545cd3a11973b76d6277a412aae3f
-
SHA256
8d087f55b6d2ba153890facd8974e023b4ba6eb7ebaadab807c2e5ff9fc0a2e5
-
SHA512
c1940cc42eab09ab48552e018ab0618d58b7078f878de2d5b4a6c0b86435cfb81f6418f501766f5f4ddf0943d5133a51a03802d0906cbff233418d76dab4bb49
-
SSDEEP
24576:qsS04YNEMuExDiU6E5R9s8xY/2l/dguIbt+ro:qE4auS+UjfU2TguIbt+r
Malware Config
Extracted
orcus
9across-entitled.gl.at.ply.gg
50016745d5814a2aa66680544dcfd5bd
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
01/11/2025 03:41:09
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgYwA1AGMAZQBkADkANQA2AGIAYgA3AGUANAAxADQAZAA5ADIAZgBjADEAYQAxAGIAMwA3ADIAOQAxAGIAMwA2AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIGYAYwA2ADcANgAxAGUAZgA4ADEAOAAwADQANgA4AGUAOQBhAGUAZAA5ADMANABhADMAYQBiAGIAYgA4ADAANQABAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Signatures
-
Orcus family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\Control Panel\International\Geo\Nation idk.exe -
Executes dropped EXE 2 IoCs
pid Process 5268 WindowsInput.exe 4504 AudioDriver.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini idk.exe File opened for modification C:\Windows\assembly\Desktop.ini idk.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsInput.InstallLog WindowsInput.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe File created C:\Windows\SysWOW64\WindowsInput.exe idk.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly idk.exe File created C:\Windows\assembly\Desktop.ini idk.exe File opened for modification C:\Windows\assembly\Desktop.ini idk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe 4504 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4504 AudioDriver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4504 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4504 AudioDriver.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1444 wrote to memory of 5268 1444 idk.exe 81 PID 1444 wrote to memory of 5268 1444 idk.exe 81 PID 1444 wrote to memory of 4504 1444 idk.exe 83 PID 1444 wrote to memory of 4504 1444 idk.exe 83 PID 1444 wrote to memory of 4504 1444 idk.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\idk.exe"C:\Users\Admin\AppData\Local\Temp\idk.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5268
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
845KB
MD5cc2cf085bc4a4672c85e0fd612133609
SHA17f902447b5a545cd3a11973b76d6277a412aae3f
SHA2568d087f55b6d2ba153890facd8974e023b4ba6eb7ebaadab807c2e5ff9fc0a2e5
SHA512c1940cc42eab09ab48552e018ab0618d58b7078f878de2d5b4a6c0b86435cfb81f6418f501766f5f4ddf0943d5133a51a03802d0906cbff233418d76dab4bb49
-
Filesize
224B
MD5e469dda91ae810a1f94c96060f3f8a65
SHA10b4b3b0f6f937016b1e045ce5313ee2a65a38630
SHA256d42fee8db8eb0e047ca53ad59b1c9bc69fe04993be36fec502e3532371908842
SHA5122eb4037361c03e195c642a53f55a3182a6df19903db503060e366f2394750e64ae04fdaace61ef5a6dba649defc88322d78edd2928bc53ebd1ce11d68cc88dac
-
Filesize
21KB
MD5e854a4636afc652b320e12e50ba4080e
SHA18a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc
SHA25694b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5
SHA51230aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118