Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 01:01
Behavioral task
behavioral1
Sample
9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe
Resource
win7-20240903-en
General
-
Target
9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe
-
Size
863KB
-
MD5
9f5255673dcaa00aec821823de4f7c68
-
SHA1
939f1351d2ee92aec84860165b139142a1c16519
-
SHA256
9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0
-
SHA512
e63fa29fd0d0ad2cdbee2f153a5bc28699f9e83e8afa1e92734daa225416f07d4ee6621d7cca6ee23d1a7b0689f00c4c5f1cafe16a47dbd2fe1562cea2e15427
-
SSDEEP
24576:HFS04YNEMuExDiU6E5R9s8xY/2l/drtnIbt+rdTe:H34auS+UjfU2TrdIbt+rA
Malware Config
Extracted
orcus
192.168.1.66
64515d4bdc6342c3b19af3653725ee05
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
01/26/2025 19:20:01
-
plugins
AgEAAA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Signatures
-
Orcus family
-
Executes dropped EXE 2 IoCs
pid Process 1892 Script.exe 2980 AudioDriver.exe -
Loads dropped DLL 2 IoCs
pid Process 2276 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 1892 Script.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe 2980 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2980 AudioDriver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2980 AudioDriver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2276 wrote to memory of 1892 2276 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 28 PID 2276 wrote to memory of 1892 2276 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 28 PID 2276 wrote to memory of 1892 2276 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 28 PID 2276 wrote to memory of 1892 2276 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 28 PID 2276 wrote to memory of 1908 2276 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 29 PID 2276 wrote to memory of 1908 2276 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 29 PID 2276 wrote to memory of 1908 2276 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 29 PID 2276 wrote to memory of 1908 2276 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 29 PID 1892 wrote to memory of 2980 1892 Script.exe 31 PID 1892 wrote to memory of 2980 1892 Script.exe 31 PID 1892 wrote to memory of 2980 1892 Script.exe 31 PID 1892 wrote to memory of 2980 1892 Script.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe"C:\Users\Admin\AppData\Local\Temp\9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\Script.exe"C:\Users\Admin\AppData\Local\Temp\Script.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2980
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\start.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:1908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD580b6d85f4829619861c1ba75d0165e1a
SHA18fef67ccbb53d901324481cc0f1caf86bdfface8
SHA25663fb361c804641806c87c3d175bad8f9a9ab6f214da7044b4e929ef755f109d3
SHA5127e6e2e95e9eca666a1f5535badd3d80bb5ad9545ef3eb7cf2dc552884edc5f0a84bcdf17066b71c765d18673a55e890b7115a13666f3346242c8996b4f063c22
-
Filesize
839KB
MD598a5ba2b1804e05fd8d361429c538d5e
SHA1ff979f68614cdddf6db17ff574a51153fd6358bd
SHA256502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753
SHA512ad7ac8fa9511b973dbf5cd691a6d2ebb265e9eeb8549872751d89e8f8f71ca70a8dcc6e5cfa7b678d6cd9ce61096d5536792eb53244eff08ae0ee8fc91b3a478