Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2025, 01:07
Behavioral task
behavioral1
Sample
a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe
Resource
win7-20240708-en
General
-
Target
a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe
-
Size
3.0MB
-
MD5
62b979701e8d5ff4c7c49af4c4b69dca
-
SHA1
ff23caf424ade62e9d789cb823cbf9eb0fc3d9ed
-
SHA256
a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c
-
SHA512
d6d747f94e1b82d4f7b701bceeb2f0d2e02858dd08e50d38272a457554063ebbfecbf368c4298e6a83fa36a9d1cd73949bbe7683248802405672a2f9591e85b6
-
SSDEEP
49152:ys7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpau/nRFfjI7L0qb:ysHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
packlab
31.44.184.52:50079
sudo_ld91xbpc2kl6yn2iq5m7rnm9wlvhevm0
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\geoprivateline\wpwordpress.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b9d-13.dat family_orcus -
Orcurs Rat Executable 2 IoCs
resource yara_rule behavioral2/memory/3852-1-0x0000000000FE0000-0x00000000012DE000-memory.dmp orcus behavioral2/files/0x000a000000023b9d-13.dat orcus -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe -
Executes dropped EXE 8 IoCs
pid Process 2736 wpwordpress.exe 2536 wpwordpress.exe 2400 wpwordpress.exe 1980 wpwordpress.exe 3912 wpwordpress.exe 2168 wpwordpress.exe 3960 wpwordpress.exe 732 wpwordpress.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2736 set thread context of 2416 2736 wpwordpress.exe 85 PID 2536 set thread context of 1812 2536 wpwordpress.exe 87 PID 2400 set thread context of 5076 2400 wpwordpress.exe 92 PID 1980 set thread context of 2772 1980 wpwordpress.exe 94 PID 3912 set thread context of 2656 3912 wpwordpress.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caspol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caspol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpwordpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language installutil.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 3852 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe 2736 wpwordpress.exe 2736 wpwordpress.exe 2736 wpwordpress.exe 2736 wpwordpress.exe 2536 wpwordpress.exe 2536 wpwordpress.exe 2400 wpwordpress.exe 2400 wpwordpress.exe 2400 wpwordpress.exe 2400 wpwordpress.exe 2400 wpwordpress.exe 2400 wpwordpress.exe 2400 wpwordpress.exe 2400 wpwordpress.exe 1980 wpwordpress.exe 1980 wpwordpress.exe 3912 wpwordpress.exe 3912 wpwordpress.exe 1812 regasm.exe 1812 regasm.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3852 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe Token: SeDebugPrivilege 2736 wpwordpress.exe Token: SeDebugPrivilege 2536 wpwordpress.exe Token: SeDebugPrivilege 2400 wpwordpress.exe Token: SeDebugPrivilege 1980 wpwordpress.exe Token: SeDebugPrivilege 3912 wpwordpress.exe Token: SeDebugPrivilege 1812 regasm.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 3852 wrote to memory of 2736 3852 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe 82 PID 3852 wrote to memory of 2736 3852 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe 82 PID 3852 wrote to memory of 2736 3852 a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe 82 PID 2736 wrote to memory of 1292 2736 wpwordpress.exe 84 PID 2736 wrote to memory of 1292 2736 wpwordpress.exe 84 PID 2736 wrote to memory of 1292 2736 wpwordpress.exe 84 PID 2736 wrote to memory of 2416 2736 wpwordpress.exe 85 PID 2736 wrote to memory of 2416 2736 wpwordpress.exe 85 PID 2736 wrote to memory of 2416 2736 wpwordpress.exe 85 PID 2736 wrote to memory of 2416 2736 wpwordpress.exe 85 PID 2736 wrote to memory of 2416 2736 wpwordpress.exe 85 PID 2736 wrote to memory of 2416 2736 wpwordpress.exe 85 PID 2736 wrote to memory of 2416 2736 wpwordpress.exe 85 PID 2736 wrote to memory of 2416 2736 wpwordpress.exe 85 PID 2536 wrote to memory of 1812 2536 wpwordpress.exe 87 PID 2536 wrote to memory of 1812 2536 wpwordpress.exe 87 PID 2536 wrote to memory of 1812 2536 wpwordpress.exe 87 PID 2536 wrote to memory of 1812 2536 wpwordpress.exe 87 PID 2536 wrote to memory of 1812 2536 wpwordpress.exe 87 PID 2536 wrote to memory of 1812 2536 wpwordpress.exe 87 PID 2536 wrote to memory of 1812 2536 wpwordpress.exe 87 PID 2536 wrote to memory of 1812 2536 wpwordpress.exe 87 PID 2400 wrote to memory of 3284 2400 wpwordpress.exe 89 PID 2400 wrote to memory of 3284 2400 wpwordpress.exe 89 PID 2400 wrote to memory of 3284 2400 wpwordpress.exe 89 PID 2400 wrote to memory of 232 2400 wpwordpress.exe 90 PID 2400 wrote to memory of 232 2400 wpwordpress.exe 90 PID 2400 wrote to memory of 232 2400 wpwordpress.exe 90 PID 2400 wrote to memory of 4928 2400 wpwordpress.exe 91 PID 2400 wrote to memory of 4928 2400 wpwordpress.exe 91 PID 2400 wrote to memory of 4928 2400 wpwordpress.exe 91 PID 2400 wrote to memory of 5076 2400 wpwordpress.exe 92 PID 2400 wrote to memory of 5076 2400 wpwordpress.exe 92 PID 2400 wrote to memory of 5076 2400 wpwordpress.exe 92 PID 2400 wrote to memory of 5076 2400 wpwordpress.exe 92 PID 2400 wrote to memory of 5076 2400 wpwordpress.exe 92 PID 2400 wrote to memory of 5076 2400 wpwordpress.exe 92 PID 2400 wrote to memory of 5076 2400 wpwordpress.exe 92 PID 2400 wrote to memory of 5076 2400 wpwordpress.exe 92 PID 1980 wrote to memory of 2772 1980 wpwordpress.exe 94 PID 1980 wrote to memory of 2772 1980 wpwordpress.exe 94 PID 1980 wrote to memory of 2772 1980 wpwordpress.exe 94 PID 1980 wrote to memory of 2772 1980 wpwordpress.exe 94 PID 1980 wrote to memory of 2772 1980 wpwordpress.exe 94 PID 1980 wrote to memory of 2772 1980 wpwordpress.exe 94 PID 1980 wrote to memory of 2772 1980 wpwordpress.exe 94 PID 1980 wrote to memory of 2772 1980 wpwordpress.exe 94 PID 3912 wrote to memory of 2656 3912 wpwordpress.exe 96 PID 3912 wrote to memory of 2656 3912 wpwordpress.exe 96 PID 3912 wrote to memory of 2656 3912 wpwordpress.exe 96 PID 3912 wrote to memory of 2656 3912 wpwordpress.exe 96 PID 3912 wrote to memory of 2656 3912 wpwordpress.exe 96 PID 3912 wrote to memory of 2656 3912 wpwordpress.exe 96 PID 3912 wrote to memory of 2656 3912 wpwordpress.exe 96 PID 3912 wrote to memory of 2656 3912 wpwordpress.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe"C:\Users\Admin\AppData\Local\Temp\a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe"C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵PID:1292
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2416
-
-
-
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exeC:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exeC:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵PID:3284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵PID:232
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵PID:4928
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
PID:5076
-
-
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exeC:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2772
-
-
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exeC:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2656
-
-
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exeC:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2168
-
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exeC:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3960
-
C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exeC:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
1KB
MD5663b8d5469caa4489d463aa9bc18124f
SHA1e57123a7d969115853ea631a3b33826335025d28
SHA2567b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8
SHA51245e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55
-
Filesize
3.0MB
MD562b979701e8d5ff4c7c49af4c4b69dca
SHA1ff23caf424ade62e9d789cb823cbf9eb0fc3d9ed
SHA256a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c
SHA512d6d747f94e1b82d4f7b701bceeb2f0d2e02858dd08e50d38272a457554063ebbfecbf368c4298e6a83fa36a9d1cd73949bbe7683248802405672a2f9591e85b6
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad