Analysis Overview
SHA256
92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb
Threat Level: Known bad
The file 92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb was found to be: Known bad.
Malicious Activity Summary
Orcus family
Orcus
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Drops file in System32 directory
System Location Discovery: System Language Discovery
Unsigned PE
Enumerates physical storage devices
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-01-14 01:02
Signatures
Orcus family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-01-14 01:02
Reported
2025-01-14 01:05
Platform
win7-20241010-en
Max time kernel
148s
Max time network
123s
Command Line
Signatures
Orcus
Orcus family
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\WindowsInput.exe | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsInput.InstallLog | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
| File created | C:\Windows\SysWOW64\WindowsInput.InstallState | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe
"C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe"
C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe" --install
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp |
Files
memory/2272-0-0x00000000748FE000-0x00000000748FF000-memory.dmp
memory/2272-1-0x0000000000110000-0x0000000000202000-memory.dmp
memory/2272-2-0x00000000002C0000-0x00000000002CA000-memory.dmp
memory/2272-3-0x00000000748F0000-0x0000000074FDE000-memory.dmp
memory/2272-4-0x0000000000790000-0x00000000007DC000-memory.dmp
memory/2272-5-0x0000000000440000-0x0000000000448000-memory.dmp
memory/2272-6-0x00000000004A0000-0x00000000004AC000-memory.dmp
\Windows\SysWOW64\WindowsInput.exe
| MD5 | e854a4636afc652b320e12e50ba4080e |
| SHA1 | 8a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc |
| SHA256 | 94b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5 |
| SHA512 | 30aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118 |
memory/1356-13-0x000007FEF5E1E000-0x000007FEF5E1F000-memory.dmp
C:\Windows\SysWOW64\WindowsInput.InstallLog
| MD5 | e469dda91ae810a1f94c96060f3f8a65 |
| SHA1 | 0b4b3b0f6f937016b1e045ce5313ee2a65a38630 |
| SHA256 | d42fee8db8eb0e047ca53ad59b1c9bc69fe04993be36fec502e3532371908842 |
| SHA512 | 2eb4037361c03e195c642a53f55a3182a6df19903db503060e366f2394750e64ae04fdaace61ef5a6dba649defc88322d78edd2928bc53ebd1ce11d68cc88dac |
memory/1356-23-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp
memory/1356-25-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp
C:\Windows\SysWOW64\WindowsInput.InstallLog
| MD5 | c2291863df7c2d3038ce3c22fa276506 |
| SHA1 | 7b7d2bc07a6c35523807342c747c9b6a19f3184e |
| SHA256 | 14504199bede3f46129969dbd2b7680f2e5b7fcd73a3e427ce1bb6217a6d13da |
| SHA512 | 00bf40174a67e3e663d18a887c5b461a1e5ead0b27f0a139d87969158c58f4ca72cfa5a731dda239356192ca4cb5ac6ae2b0e37401d534e686cabacd3cbee8fa |
memory/1356-40-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp
memory/2272-43-0x0000000004AA0000-0x0000000004AEE000-memory.dmp
\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
| MD5 | 7e20fb5ccb4ee4d082463bf93676609f |
| SHA1 | 3d19d8c3c110c51f00d8acfa409a03f2b1d4ada3 |
| SHA256 | 92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb |
| SHA512 | 070aa0312e44063ca03bb38e19153840cc38ab76f291a3db701c52d58a69e1c43223cfce3cedfc1933c0ba472513473d63ac926abc13aa589cff19377a7f33a1 |
memory/2272-49-0x00000000748F0000-0x0000000074FDE000-memory.dmp
memory/2892-51-0x0000000000F50000-0x0000000001042000-memory.dmp
memory/2892-52-0x0000000000320000-0x0000000000330000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2025-01-14 01:02
Reported
2025-01-14 01:04
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Orcus
Orcus family
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\WindowsInput.exe | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsInput.InstallLog | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
| File created | C:\Windows\SysWOW64\WindowsInput.InstallState | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe
"C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe"
C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe" --install
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 60.153.16.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 167.173.78.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.71.91.104.in-addr.arpa | udp |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| US | 8.8.8.8:53 | 26.73.42.20.in-addr.arpa | udp |
Files
memory/1940-0-0x0000000074FBE000-0x0000000074FBF000-memory.dmp
memory/1940-1-0x0000000000120000-0x0000000000212000-memory.dmp
memory/1940-3-0x0000000074FB0000-0x0000000075760000-memory.dmp
memory/1940-4-0x0000000005180000-0x0000000005724000-memory.dmp
memory/1940-6-0x0000000004FF0000-0x000000000503C000-memory.dmp
memory/1940-5-0x0000000005080000-0x0000000005112000-memory.dmp
memory/1940-9-0x0000000005140000-0x000000000514C000-memory.dmp
memory/1940-8-0x0000000005730000-0x0000000005752000-memory.dmp
memory/1940-7-0x0000000005070000-0x0000000005078000-memory.dmp
memory/1940-2-0x0000000002480000-0x000000000248A000-memory.dmp
C:\Windows\SysWOW64\WindowsInput.exe
| MD5 | e854a4636afc652b320e12e50ba4080e |
| SHA1 | 8a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc |
| SHA256 | 94b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5 |
| SHA512 | 30aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118 |
memory/3532-21-0x00007FFA20D15000-0x00007FFA20D16000-memory.dmp
memory/3532-23-0x0000000001390000-0x00000000013B0000-memory.dmp
memory/3532-24-0x00007FFA20A60000-0x00007FFA21401000-memory.dmp
memory/3532-22-0x0000000001350000-0x0000000001368000-memory.dmp
memory/3532-25-0x00007FFA20A60000-0x00007FFA21401000-memory.dmp
C:\Windows\SysWOW64\WindowsInput.InstallLog
| MD5 | e469dda91ae810a1f94c96060f3f8a65 |
| SHA1 | 0b4b3b0f6f937016b1e045ce5313ee2a65a38630 |
| SHA256 | d42fee8db8eb0e047ca53ad59b1c9bc69fe04993be36fec502e3532371908842 |
| SHA512 | 2eb4037361c03e195c642a53f55a3182a6df19903db503060e366f2394750e64ae04fdaace61ef5a6dba649defc88322d78edd2928bc53ebd1ce11d68cc88dac |
memory/3532-28-0x000000001BC70000-0x000000001BC94000-memory.dmp
memory/3532-36-0x000000001C5D0000-0x000000001CA9E000-memory.dmp
memory/3532-37-0x000000001CB40000-0x000000001CBDC000-memory.dmp
memory/3532-54-0x00007FFA20A60000-0x00007FFA21401000-memory.dmp
memory/1940-57-0x0000000005D70000-0x0000000005DBE000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
| MD5 | 7e20fb5ccb4ee4d082463bf93676609f |
| SHA1 | 3d19d8c3c110c51f00d8acfa409a03f2b1d4ada3 |
| SHA256 | 92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb |
| SHA512 | 070aa0312e44063ca03bb38e19153840cc38ab76f291a3db701c52d58a69e1c43223cfce3cedfc1933c0ba472513473d63ac926abc13aa589cff19377a7f33a1 |
memory/4696-70-0x0000000074FB0000-0x0000000075760000-memory.dmp
memory/1940-69-0x0000000074FB0000-0x0000000075760000-memory.dmp
memory/4696-72-0x0000000005C50000-0x0000000005C60000-memory.dmp
memory/4696-71-0x0000000006420000-0x00000000065E2000-memory.dmp
memory/4696-73-0x0000000006720000-0x000000000672A000-memory.dmp
memory/4696-74-0x0000000074FBE000-0x0000000074FBF000-memory.dmp
memory/4696-75-0x0000000074FB0000-0x0000000075760000-memory.dmp