Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 01:35
Behavioral task
behavioral1
Sample
225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe
Resource
win7-20240903-en
General
-
Target
225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe
-
Size
3.0MB
-
MD5
c0425594cb2719131850869093fdac64
-
SHA1
57801983f722353632cbe6338619f274c59d5caf
-
SHA256
225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9
-
SHA512
a48f63e4b44522c61feff0a7d44af41250ba3264c989d8e1e50c7fee0c4b90b5a3e2b7984da5098874d4368cd7196419b9815b4fe002558ddecafa225cdaf328
-
SSDEEP
49152:4s7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpau/nRFfjI7L0qb:4sHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
niggers
31.44.184.52:16749
sudo_ai8hybb6bfsu8cdberulrqxurblwtews
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\cpuflower\windowsauth.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023b53-13.dat family_orcus -
Orcurs Rat Executable 2 IoCs
resource yara_rule behavioral2/memory/4828-1-0x0000000000E30000-0x000000000112E000-memory.dmp orcus behavioral2/files/0x000b000000023b53-13.dat orcus -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\Control Panel\International\Geo\Nation 225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe -
Executes dropped EXE 4 IoCs
pid Process 4636 windowsauth.exe 3384 windowsauth.exe 3768 windowsauth.exe 4468 windowsauth.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4636 set thread context of 4836 4636 windowsauth.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsauth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsauth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msbuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsauth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsauth.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4828 225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe 4636 windowsauth.exe 4636 windowsauth.exe 4636 windowsauth.exe 4636 windowsauth.exe 4836 msbuild.exe 4836 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4828 225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe Token: SeDebugPrivilege 4636 windowsauth.exe Token: SeDebugPrivilege 4836 msbuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4828 wrote to memory of 4636 4828 225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe 86 PID 4828 wrote to memory of 4636 4828 225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe 86 PID 4828 wrote to memory of 4636 4828 225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe 86 PID 4636 wrote to memory of 1332 4636 windowsauth.exe 88 PID 4636 wrote to memory of 1332 4636 windowsauth.exe 88 PID 4636 wrote to memory of 1332 4636 windowsauth.exe 88 PID 4636 wrote to memory of 4836 4636 windowsauth.exe 89 PID 4636 wrote to memory of 4836 4636 windowsauth.exe 89 PID 4636 wrote to memory of 4836 4636 windowsauth.exe 89 PID 4636 wrote to memory of 4836 4636 windowsauth.exe 89 PID 4636 wrote to memory of 4836 4636 windowsauth.exe 89 PID 4636 wrote to memory of 4836 4636 windowsauth.exe 89 PID 4636 wrote to memory of 4836 4636 windowsauth.exe 89 PID 4636 wrote to memory of 4836 4636 windowsauth.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe"C:\Users\Admin\AppData\Local\Temp\225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Roaming\cpuflower\windowsauth.exe"C:\Users\Admin\AppData\Roaming\cpuflower\windowsauth.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"3⤵PID:1332
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
-
C:\Users\Admin\AppData\Roaming\cpuflower\windowsauth.exeC:\Users\Admin\AppData\Roaming\cpuflower\windowsauth.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3384
-
C:\Users\Admin\AppData\Roaming\cpuflower\windowsauth.exeC:\Users\Admin\AppData\Roaming\cpuflower\windowsauth.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3768
-
C:\Users\Admin\AppData\Roaming\cpuflower\windowsauth.exeC:\Users\Admin\AppData\Roaming\cpuflower\windowsauth.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5663b8d5469caa4489d463aa9bc18124f
SHA1e57123a7d969115853ea631a3b33826335025d28
SHA2567b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8
SHA51245e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55
-
Filesize
3.0MB
MD5c0425594cb2719131850869093fdac64
SHA157801983f722353632cbe6338619f274c59d5caf
SHA256225b6199e42b79355c1bed89cf53ddd3ccfb8f407637951501fefe01105761f9
SHA512a48f63e4b44522c61feff0a7d44af41250ba3264c989d8e1e50c7fee0c4b90b5a3e2b7984da5098874d4368cd7196419b9815b4fe002558ddecafa225cdaf328
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad