Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2025, 01:27
Behavioral task
behavioral1
Sample
50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe
Resource
win7-20240903-en
General
-
Target
50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe
-
Size
3.0MB
-
MD5
627aa0f851f03fd662229b1d9ba3a65c
-
SHA1
16b6c8c11a080fbc26b214155e98d8a72610d99f
-
SHA256
50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6
-
SHA512
29f878862cb1961034598628e6f74d4994f23a7827f0e24df96ab36dd59c6d22e0552271fcbc82bc08cd7478976b5bd51506bfe47e81623fcf7f715cf95d7b59
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:32868
sudo_3lrtko3j09klclfjg6fshwvfhi8lh9xs
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\provideruploadscpu\asyncimage.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023b6f-13.dat family_orcus -
Orcurs Rat Executable 2 IoCs
resource yara_rule behavioral2/memory/32-1-0x00000000000A0000-0x000000000039E000-memory.dmp orcus behavioral2/files/0x000b000000023b6f-13.dat orcus -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe -
Executes dropped EXE 6 IoCs
pid Process 620 asyncimage.exe 4008 asyncimage.exe 1360 asyncimage.exe 3428 asyncimage.exe 2844 asyncimage.exe 3660 asyncimage.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 620 set thread context of 2124 620 asyncimage.exe 85 PID 4008 set thread context of 1308 4008 asyncimage.exe 87 PID 1360 set thread context of 1780 1360 asyncimage.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asyncimage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caspol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asyncimage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asyncimage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caspol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asyncimage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asyncimage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asyncimage.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 32 50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe 620 asyncimage.exe 620 asyncimage.exe 4008 asyncimage.exe 4008 asyncimage.exe 1360 asyncimage.exe 1360 asyncimage.exe 1360 asyncimage.exe 1360 asyncimage.exe 1780 caspol.exe 1780 caspol.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 32 50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe Token: SeDebugPrivilege 620 asyncimage.exe Token: SeDebugPrivilege 4008 asyncimage.exe Token: SeDebugPrivilege 1360 asyncimage.exe Token: SeDebugPrivilege 1780 caspol.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 32 wrote to memory of 620 32 50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe 83 PID 32 wrote to memory of 620 32 50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe 83 PID 32 wrote to memory of 620 32 50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe 83 PID 620 wrote to memory of 2124 620 asyncimage.exe 85 PID 620 wrote to memory of 2124 620 asyncimage.exe 85 PID 620 wrote to memory of 2124 620 asyncimage.exe 85 PID 620 wrote to memory of 2124 620 asyncimage.exe 85 PID 620 wrote to memory of 2124 620 asyncimage.exe 85 PID 620 wrote to memory of 2124 620 asyncimage.exe 85 PID 620 wrote to memory of 2124 620 asyncimage.exe 85 PID 620 wrote to memory of 2124 620 asyncimage.exe 85 PID 4008 wrote to memory of 1308 4008 asyncimage.exe 87 PID 4008 wrote to memory of 1308 4008 asyncimage.exe 87 PID 4008 wrote to memory of 1308 4008 asyncimage.exe 87 PID 4008 wrote to memory of 1308 4008 asyncimage.exe 87 PID 4008 wrote to memory of 1308 4008 asyncimage.exe 87 PID 4008 wrote to memory of 1308 4008 asyncimage.exe 87 PID 4008 wrote to memory of 1308 4008 asyncimage.exe 87 PID 4008 wrote to memory of 1308 4008 asyncimage.exe 87 PID 1360 wrote to memory of 408 1360 asyncimage.exe 89 PID 1360 wrote to memory of 408 1360 asyncimage.exe 89 PID 1360 wrote to memory of 408 1360 asyncimage.exe 89 PID 1360 wrote to memory of 1780 1360 asyncimage.exe 90 PID 1360 wrote to memory of 1780 1360 asyncimage.exe 90 PID 1360 wrote to memory of 1780 1360 asyncimage.exe 90 PID 1360 wrote to memory of 1780 1360 asyncimage.exe 90 PID 1360 wrote to memory of 1780 1360 asyncimage.exe 90 PID 1360 wrote to memory of 1780 1360 asyncimage.exe 90 PID 1360 wrote to memory of 1780 1360 asyncimage.exe 90 PID 1360 wrote to memory of 1780 1360 asyncimage.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe"C:\Users\Admin\AppData\Local\Temp\50a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exe"C:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2124
-
-
-
C:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exeC:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1308
-
-
C:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exeC:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"2⤵PID:408
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
-
C:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exeC:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3428
-
C:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exeC:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2844
-
C:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exeC:\Users\Admin\AppData\Roaming\provideruploadscpu\asyncimage.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5663b8d5469caa4489d463aa9bc18124f
SHA1e57123a7d969115853ea631a3b33826335025d28
SHA2567b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8
SHA51245e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55
-
Filesize
3.0MB
MD5627aa0f851f03fd662229b1d9ba3a65c
SHA116b6c8c11a080fbc26b214155e98d8a72610d99f
SHA25650a14199dc1de62300209e53ca474fa6c340d7c0aca3ef28c8a93884735667b6
SHA51229f878862cb1961034598628e6f74d4994f23a7827f0e24df96ab36dd59c6d22e0552271fcbc82bc08cd7478976b5bd51506bfe47e81623fcf7f715cf95d7b59
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad