Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
14/01/2025, 09:15
Behavioral task
behavioral1
Sample
idk.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral2
Sample
idk.exe
Resource
win11-20241007-en
General
-
Target
idk.exe
-
Size
845KB
-
MD5
4430b4864bdb0536bb555c64f90a6fdf
-
SHA1
9692cd79639a1f228a389472b65ab04f3c016536
-
SHA256
bbc6bbbf62040d31c403ebb6cc1fde194f4676c3f7dde52af531d88aefc0238b
-
SHA512
b030596c8e6d605088f8bc503f0fe012cdf2398109459766dfbaf647070fe1cac3940292bd0089e334da309989129df0f6577fcfdbda58e0d15a10a8d43a436b
-
SSDEEP
24576:tvS04YNEMuExDiU6E5R9s8xY/2l/dHMIbt+rm:tF4auS+UjfU2THMIbt+r
Malware Config
Extracted
orcus
6.tcp.eu.ngrok.io
e0891e9c4f9f4554bd4e9011ead35949
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
01/14/2025 10:14:36
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgMgA0AGIAOQAxAGIAYwBjADcAZgA0AGUANAA0ADgANgBiADEAZgA2ADYAMgAxAGIAYwBjADYAYQAyAGYAOAA2AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDkAMAA3AGEAYQBiADAAMAAxAGQAYQBhADQAYgA5AGIAOQBmAGQAYwAwAGUAMgAxAGYAYQAwADMAOQBlAGQAOQABAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Signatures
-
Orcus family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation idk.exe -
Executes dropped EXE 1 IoCs
pid Process 1752 AudioDriver.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini idk.exe File created C:\Windows\assembly\Desktop.ini idk.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 6.tcp.eu.ngrok.io 25 6.tcp.eu.ngrok.io -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly idk.exe File created C:\Windows\assembly\Desktop.ini idk.exe File opened for modification C:\Windows\assembly\Desktop.ini idk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1752 AudioDriver.exe 1752 AudioDriver.exe 1752 AudioDriver.exe 1752 AudioDriver.exe 1752 AudioDriver.exe 1752 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1752 AudioDriver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1752 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1752 AudioDriver.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4508 wrote to memory of 1752 4508 idk.exe 81 PID 4508 wrote to memory of 1752 4508 idk.exe 81 PID 4508 wrote to memory of 1752 4508 idk.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\idk.exe"C:\Users\Admin\AppData\Local\Temp\idk.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
845KB
MD54430b4864bdb0536bb555c64f90a6fdf
SHA19692cd79639a1f228a389472b65ab04f3c016536
SHA256bbc6bbbf62040d31c403ebb6cc1fde194f4676c3f7dde52af531d88aefc0238b
SHA512b030596c8e6d605088f8bc503f0fe012cdf2398109459766dfbaf647070fe1cac3940292bd0089e334da309989129df0f6577fcfdbda58e0d15a10a8d43a436b