Analysis Overview
SHA256
92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb
Threat Level: Known bad
The file 92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb was found to be: Known bad.
Malicious Activity Summary
Orcus family
Orcus
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Drops file in System32 directory
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Unsigned PE
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-01-14 01:09
Signatures
Orcus family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-01-14 01:09
Reported
2025-01-14 01:12
Platform
win7-20240729-en
Max time kernel
148s
Max time network
17s
Command Line
Signatures
Orcus
Orcus family
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\WindowsInput.exe | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsInput.InstallLog | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
| File created | C:\Windows\SysWOW64\WindowsInput.InstallState | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe
"C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe"
C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe" --install
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp |
Files
memory/640-0-0x0000000073C4E000-0x0000000073C4F000-memory.dmp
memory/640-1-0x0000000000370000-0x0000000000462000-memory.dmp
memory/640-2-0x0000000000470000-0x000000000047A000-memory.dmp
memory/640-3-0x0000000073C40000-0x000000007432E000-memory.dmp
memory/640-4-0x0000000000580000-0x00000000005CC000-memory.dmp
memory/640-5-0x00000000004C0000-0x00000000004C8000-memory.dmp
memory/640-6-0x0000000000520000-0x000000000052C000-memory.dmp
\Windows\SysWOW64\WindowsInput.exe
| MD5 | e854a4636afc652b320e12e50ba4080e |
| SHA1 | 8a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc |
| SHA256 | 94b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5 |
| SHA512 | 30aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118 |
memory/2100-13-0x000007FEF594E000-0x000007FEF594F000-memory.dmp
C:\Windows\SysWOW64\WindowsInput.InstallLog
| MD5 | e469dda91ae810a1f94c96060f3f8a65 |
| SHA1 | 0b4b3b0f6f937016b1e045ce5313ee2a65a38630 |
| SHA256 | d42fee8db8eb0e047ca53ad59b1c9bc69fe04993be36fec502e3532371908842 |
| SHA512 | 2eb4037361c03e195c642a53f55a3182a6df19903db503060e366f2394750e64ae04fdaace61ef5a6dba649defc88322d78edd2928bc53ebd1ce11d68cc88dac |
memory/2100-24-0x000007FEF5690000-0x000007FEF602D000-memory.dmp
C:\Windows\SysWOW64\WindowsInput.InstallLog
| MD5 | c2291863df7c2d3038ce3c22fa276506 |
| SHA1 | 7b7d2bc07a6c35523807342c747c9b6a19f3184e |
| SHA256 | 14504199bede3f46129969dbd2b7680f2e5b7fcd73a3e427ce1bb6217a6d13da |
| SHA512 | 00bf40174a67e3e663d18a887c5b461a1e5ead0b27f0a139d87969158c58f4ca72cfa5a731dda239356192ca4cb5ac6ae2b0e37401d534e686cabacd3cbee8fa |
memory/2100-27-0x000007FEF5690000-0x000007FEF602D000-memory.dmp
memory/2100-40-0x000007FEF5690000-0x000007FEF602D000-memory.dmp
memory/640-43-0x00000000048A0000-0x00000000048EE000-memory.dmp
\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
| MD5 | 7e20fb5ccb4ee4d082463bf93676609f |
| SHA1 | 3d19d8c3c110c51f00d8acfa409a03f2b1d4ada3 |
| SHA256 | 92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb |
| SHA512 | 070aa0312e44063ca03bb38e19153840cc38ab76f291a3db701c52d58a69e1c43223cfce3cedfc1933c0ba472513473d63ac926abc13aa589cff19377a7f33a1 |
memory/2784-51-0x0000000000DD0000-0x0000000000EC2000-memory.dmp
memory/640-50-0x0000000073C40000-0x000000007432E000-memory.dmp
memory/2784-52-0x0000000000D80000-0x0000000000D90000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2025-01-14 01:09
Reported
2025-01-14 01:12
Platform
win10v2004-20241007-en
Max time kernel
138s
Max time network
141s
Command Line
Signatures
Orcus
Orcus family
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\WindowsInput.exe | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsInput.InstallLog | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
| File created | C:\Windows\SysWOW64\WindowsInput.InstallState | C:\Windows\SysWOW64\WindowsInput.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe
"C:\Users\Admin\AppData\Local\Temp\92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb.exe"
C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe" --install
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 167.173.78.104.in-addr.arpa | udp |
| N/A | 127.0.0.1:10134 | tcp | |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.49.80.91.in-addr.arpa | udp |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| US | 8.8.8.8:53 | 60.153.16.2.in-addr.arpa | udp |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp | |
| N/A | 127.0.0.1:10134 | tcp |
Files
memory/5012-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp
memory/5012-1-0x0000000000F20000-0x0000000001012000-memory.dmp
memory/5012-2-0x0000000003290000-0x000000000329A000-memory.dmp
memory/5012-3-0x0000000074A00000-0x00000000751B0000-memory.dmp
memory/5012-4-0x0000000005F50000-0x00000000064F4000-memory.dmp
memory/5012-5-0x0000000005D40000-0x0000000005DD2000-memory.dmp
memory/5012-6-0x0000000005CB0000-0x0000000005CFC000-memory.dmp
memory/5012-7-0x0000000005D30000-0x0000000005D38000-memory.dmp
memory/5012-8-0x0000000005E30000-0x0000000005E52000-memory.dmp
memory/5012-9-0x0000000005E00000-0x0000000005E0C000-memory.dmp
C:\Windows\SysWOW64\WindowsInput.exe
| MD5 | e854a4636afc652b320e12e50ba4080e |
| SHA1 | 8a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc |
| SHA256 | 94b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5 |
| SHA512 | 30aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118 |
memory/1912-21-0x00007FFEF72D5000-0x00007FFEF72D6000-memory.dmp
memory/1912-23-0x000000001BD30000-0x000000001BD50000-memory.dmp
memory/1912-22-0x000000001BCF0000-0x000000001BD08000-memory.dmp
memory/1912-24-0x00007FFEF7020000-0x00007FFEF79C1000-memory.dmp
memory/1912-25-0x00007FFEF7020000-0x00007FFEF79C1000-memory.dmp
memory/1912-28-0x000000001C040000-0x000000001C064000-memory.dmp
memory/1912-36-0x000000001C9A0000-0x000000001CE6E000-memory.dmp
memory/1912-37-0x000000001CF10000-0x000000001CFAC000-memory.dmp
memory/1912-54-0x00007FFEF7020000-0x00007FFEF79C1000-memory.dmp
memory/5012-57-0x0000000006BA0000-0x0000000006BEE000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
| MD5 | 7e20fb5ccb4ee4d082463bf93676609f |
| SHA1 | 3d19d8c3c110c51f00d8acfa409a03f2b1d4ada3 |
| SHA256 | 92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb |
| SHA512 | 070aa0312e44063ca03bb38e19153840cc38ab76f291a3db701c52d58a69e1c43223cfce3cedfc1933c0ba472513473d63ac926abc13aa589cff19377a7f33a1 |
memory/3132-69-0x0000000074A0E000-0x0000000074A0F000-memory.dmp
memory/5012-70-0x0000000074A00000-0x00000000751B0000-memory.dmp
memory/3132-71-0x0000000074A00000-0x00000000751B0000-memory.dmp
memory/3132-72-0x0000000005F40000-0x0000000006102000-memory.dmp
memory/3132-73-0x0000000005E70000-0x0000000005E80000-memory.dmp
memory/3132-74-0x00000000064A0000-0x00000000064AA000-memory.dmp
memory/3132-75-0x0000000074A00000-0x00000000751B0000-memory.dmp