Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

idk.exe

windows7-x64

10

idk.exe

windows10-2004-x64

7

idk.exe

android-9-x86

idk.exe

android-10-x64

idk.exe

android-11-x64

idk.exe

macos-10.15-amd64

idk.exe

ubuntu-18.04-amd64

idk.exe

debian-9-armhf

idk.exe

debian-9-mips

idk.exe

debian-9-mipsel

Resubmissions

13/01/2025, 03:26 UTC

250113-dzd7batldw 10

12/01/2025, 13:15 UTC

250112-qhatsatlfz 10

Analysis

  • max time kernel
    899s
  • max time network
    896s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 03:26 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    idk.exe

  • Size

    839KB

  • MD5

    cc5e9089906ca9cd8c76688d62be4e1c

  • SHA1

    9fde92321e5939592d8eea3997b83167f232473e

  • SHA256

    44ad3ca81f002ab0dd559453f60ce86c7608649962c42ca2ece930ed2ff1116e

  • SHA512

    1e0c556a3ef3f272c0a91d0463ebf93819711fc1e3fb309b4b1f3a1f7b2358a46c6b6ec6b708074e6ae3178b5272bfb6c0581a2b58f11105d44b1ad04dfee3b3

  • SSDEEP

    24576:+xdS04YNEMuExDiU6E5R9s8xY/2l/d2tnIbt+rM:qP4auS+UjfU2T2dIbt+r

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

C2

9across-entitled.gl.at.ply.gg

Mutex

1d3ad2e8915c495cbc7efe28a9032f13

Attributes
  • administration_rights_required

    false

  • anti_debugger

    false

  • anti_tcp_analyzer

    false

  • antivm

    false

  • autostart_method

    1

  • change_creation_date

    false

  • force_installer_administrator_privileges

    false

  • hide_file

    false

  • install

    false

  • installation_folder

    %appdata%\Microsoft\Speech\AudioDriver.exe

  • installservice

    false

  • keylogger_enabled

    false

  • newcreationdate

    01/12/2025 14:14:22

  • plugins

    AgEAAA==

  • reconnect_delay

    10000

  • registry_autostart_keyname

    Audio HD Driver

  • registry_hidden_autostart

    false

  • set_admin_flag

    false

  • tasksch_name

    Audio HD Driver

  • tasksch_request_highest_privileges

    false

  • try_other_autostart_onfail

    false

aes.plain
1
CrackedByWardow

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus
  • Orcus family
    orcus
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\idk.exe
    C:\Users\Admin\AppData\Local\Temp\idk.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2748

Network

  • flag-us
    DNS
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    Remote address:
    8.8.8.8:53
    Request
    across-entitled.gl.at.ply.gg
    IN A
    Response
    across-entitled.gl.at.ply.gg
    IN A
    147.185.221.25
  • flag-us
    DNS
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    Remote address:
    8.8.8.8:53
    Request
    across-entitled.gl.at.ply.gg
    IN A
    Response
    across-entitled.gl.at.ply.gg
    IN A
    147.185.221.25
  • flag-us
    DNS
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    Remote address:
    8.8.8.8:53
    Request
    across-entitled.gl.at.ply.gg
    IN A
    Response
    across-entitled.gl.at.ply.gg
    IN A
    147.185.221.25
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    across-entitled.gl.at.ply.gg
    AudioDriver.exe
    152 B
     3
  • 147.185.221.25:7354
    AudioDriver.exe
  • 8.8.8.8:53
    across-entitled.gl.at.ply.gg
    dns
    AudioDriver.exe
    74 B
     90 B
     1
    1

    DNS Request

    across-entitled.gl.at.ply.gg

    DNS Response

    147.185.221.25

  • 8.8.8.8:53
    across-entitled.gl.at.ply.gg
    dns
    AudioDriver.exe
    74 B
     90 B
     1
    1

    DNS Request

    across-entitled.gl.at.ply.gg

    DNS Response

    147.185.221.25

  • 8.8.8.8:53
    across-entitled.gl.at.ply.gg
    dns
    AudioDriver.exe
    74 B
     90 B
     1
    1

    DNS Request

    across-entitled.gl.at.ply.gg

    DNS Response

    147.185.221.25

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
    Filesize

    839KB

    MD5

    cc5e9089906ca9cd8c76688d62be4e1c

    SHA1

    9fde92321e5939592d8eea3997b83167f232473e

    SHA256

    44ad3ca81f002ab0dd559453f60ce86c7608649962c42ca2ece930ed2ff1116e

    SHA512

    1e0c556a3ef3f272c0a91d0463ebf93819711fc1e3fb309b4b1f3a1f7b2358a46c6b6ec6b708074e6ae3178b5272bfb6c0581a2b58f11105d44b1ad04dfee3b3

    Download Submit

  • memory/2748-11-0x0000000074740000-0x0000000074CEB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2748-13-0x0000000074740000-0x0000000074CEB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2748-14-0x0000000074740000-0x0000000074CEB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2748-15-0x0000000074740000-0x0000000074CEB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2888-0-0x0000000074741000-0x0000000074742000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2888-1-0x0000000074740000-0x0000000074CEB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2888-2-0x0000000074740000-0x0000000074CEB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2888-12-0x0000000074740000-0x0000000074CEB000-memory.dmp

    Filesize

    5.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.