Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 01:07
Behavioral task
behavioral1
Sample
a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe
Resource
win7-20240708-en
General
-
Target
a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe
-
Size
3.0MB
-
MD5
62b979701e8d5ff4c7c49af4c4b69dca
-
SHA1
ff23caf424ade62e9d789cb823cbf9eb0fc3d9ed
-
SHA256
a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c
-
SHA512
d6d747f94e1b82d4f7b701bceeb2f0d2e02858dd08e50d38272a457554063ebbfecbf368c4298e6a83fa36a9d1cd73949bbe7683248802405672a2f9591e85b6
-
SSDEEP
49152:ys7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpau/nRFfjI7L0qb:ysHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
packlab
31.44.184.52:50079
sudo_ld91xbpc2kl6yn2iq5m7rnm9wlvhevm0
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\geoprivateline\wpwordpress.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule behavioral1/files/0x0008000000016c7c-10.dat family_orcus -
Orcurs Rat Executable 11 IoCs
resource yara_rule behavioral1/memory/1916-1-0x00000000013B0000-0x00000000016AE000-memory.dmp orcus behavioral1/files/0x0008000000016c7c-10.dat orcus behavioral1/memory/2936-17-0x00000000001F0000-0x00000000004EE000-memory.dmp orcus behavioral1/memory/2820-31-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2724-37-0x0000000000010000-0x000000000030E000-memory.dmp orcus behavioral1/memory/2820-33-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2820-30-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2820-27-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2820-26-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2856-40-0x00000000000B0000-0x00000000003AE000-memory.dmp orcus behavioral1/memory/1804-42-0x0000000000F60000-0x000000000125E000-memory.dmp orcus -
Executes dropped EXE 4 IoCs
pid Process 2936 wpwordpress.exe 2724 wpwordpress.exe 2856 wpwordpress.exe 1804 wpwordpress.exe -
Loads dropped DLL 1 IoCs
pid Process 1916 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2936 set thread context of 2820 2936 wpwordpress.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1916 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe 2936 wpwordpress.exe 2936 wpwordpress.exe 2820 regasm.exe 2820 regasm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1916 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe Token: SeDebugPrivilege 2936 wpwordpress.exe Token: SeDebugPrivilege 2820 regasm.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2936 1916 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe 30 PID 1916 wrote to memory of 2936 1916 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe 30 PID 1916 wrote to memory of 2936 1916 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe 30 PID 1916 wrote to memory of 2936 1916 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe 30 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2936 wrote to memory of 2820 2936 wpwordpress.exe 32 PID 2736 wrote to memory of 2724 2736 taskeng.exe 33 PID 2736 wrote to memory of 2724 2736 taskeng.exe 33 PID 2736 wrote to memory of 2724 2736 taskeng.exe 33 PID 2736 wrote to memory of 2724 2736 taskeng.exe 33 PID 2736 wrote to memory of 2856 2736 taskeng.exe 35 PID 2736 wrote to memory of 2856 2736 taskeng.exe 35 PID 2736 wrote to memory of 2856 2736 taskeng.exe 35 PID 2736 wrote to memory of 2856 2736 taskeng.exe 35 PID 2736 wrote to memory of 1804 2736 taskeng.exe 36 PID 2736 wrote to memory of 1804 2736 taskeng.exe 36 PID 2736 wrote to memory of 1804 2736 taskeng.exe 36 PID 2736 wrote to memory of 1804 2736 taskeng.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe"C:\Users\Admin\AppData\Local\Temp\a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe"C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {8ED4C929-B5AF-4994-B49F-5E66336DC382} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exeC:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2724
-
-
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exeC:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856
-
-
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exeC:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
3.0MB
MD562b979701e8d5ff4c7c49af4c4b69dca
SHA1ff23caf424ade62e9d789cb823cbf9eb0fc3d9ed
SHA256a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c
SHA512d6d747f94e1b82d4f7b701bceeb2f0d2e02858dd08e50d38272a457554063ebbfecbf368c4298e6a83fa36a9d1cd73949bbe7683248802405672a2f9591e85b6