Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/01/2025, 01:05
Behavioral task
behavioral1
Sample
08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3.exe
Resource
win7-20240903-en
General
-
Target
08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3.exe
-
Size
840KB
-
MD5
b678cfd23d26f187292a8baffd715cc2
-
SHA1
d06fad601014f7acd42947edf55ce83a60570cee
-
SHA256
08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3
-
SHA512
943a7157b25985e866871f06a75b2e8fefc7b07deac64c65291760fee499527e275b8c41b61e319fad6fb63176a665e2de53d700d27993c85a6b42307836d345
-
SSDEEP
24576:YLFS04YNEMuExDiU6E5R9s8xY/2l/d6N1Ibt+r1:YL34auS+UjfU2T21Ibt+r
Malware Config
Extracted
orcus
127.0.0.1
249a511d5aef428daa2c8a929dac0262
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
01/25/2025 18:56:26
-
plugins
AgEAAA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Signatures
-
Orcus family
-
Executes dropped EXE 1 IoCs
pid Process 2692 AudioDriver.exe -
Loads dropped DLL 1 IoCs
pid Process 3068 08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe 2692 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2692 AudioDriver.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2692 3068 08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3.exe 30 PID 3068 wrote to memory of 2692 3068 08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3.exe 30 PID 3068 wrote to memory of 2692 3068 08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3.exe 30 PID 3068 wrote to memory of 2692 3068 08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3.exe"C:\Users\Admin\AppData\Local\Temp\08ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
840KB
MD5b678cfd23d26f187292a8baffd715cc2
SHA1d06fad601014f7acd42947edf55ce83a60570cee
SHA25608ae2dea6f39e6c0abcf607a36d7241781887c27421250d9d85d6f32e86b13a3
SHA512943a7157b25985e866871f06a75b2e8fefc7b07deac64c65291760fee499527e275b8c41b61e319fad6fb63176a665e2de53d700d27993c85a6b42307836d345