Overview

overview

10

Static

static

3

Wave-Setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Wave-Setup.exe

  • Size

    125.0MB

  • Sample

    250218-vx51pavkap

  • MD5

    9c2c4ff8c886747f36dfb60baf8dfc58

  • SHA1

    447c496617ce26d88040f6b927bd7758f895e704

  • SHA256

    5583231982fa337c0ade14f84301cbf2078656bcfe128f99dd082c3ec95cb4c7

  • SHA512

    0fc242a792479be540a8d78128efe566229f1b97c39bed840f813b81a5bc6504002f427e06eca14973e17c3789ec4f2d00a8cbbcbbcaa5629a34300fa9635a0f

  • SSDEEP

    24576:ZTZS04YNEMuExDiU6E5R9s8xY/2l/d4BNIbt+rx:ZTb4auS+UjfU2TgNIbt+r

Score
10/10
orcusdefense_evasiondiscoveryevasionpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

orcus

C2

147.45.67.158

Mutex

07a04be20fd64a6f98b69fb858017041

Attributes
  • administration_rights_required

    false

  • anti_debugger

    false

  • anti_tcp_analyzer

    false

  • antivm

    false

  • autostart_method

    2

  • change_creation_date

    false

  • force_installer_administrator_privileges

    false

  • hide_file

    false

  • install

    false

  • installation_folder

    %appdata%\Microsoft\Speech\wavecrack.exe

  • installservice

    false

  • keylogger_enabled

    false

  • newcreationdate

    02/18/2022 03:09:09

  • plugins

    AgUFh/KmowjokAL8tAK+cicSsb2a/R0OQgBzAG8AZABQAHIAbwB0AGUAYwB0AGkAbwBuAAcDMQAuADAAQSA0ADcAZQBiADcANgA1ADAAMwA0ADkAOAA0ADcAYgA0AGEAOQBhAGYANQAyADEAMQBiADMANQA4ADYAMQA4ADQAAQXs/a7YDMDqAcy2Ar9g7F/XqzpdHw9EAGkAcwBhAGIAbABlAEQAZQBmAGUAbgBkAGUAcgAHAzIALgAwAEEgMABkADYAZABmADMAYwBiADgAOAA5ADIANABhADYAMwBhADkAYgBjADMAMgAyAGUAMAA2AGQANQAxADAAZABhAAEAAAQE

  • reconnect_delay

    10000

  • registry_autostart_keyname

    Audio HD Driver

  • registry_hidden_autostart

    false

  • set_admin_flag

    false

  • tasksch_name

    svchost.exe

  • tasksch_request_highest_privileges

    false

  • try_other_autostart_onfail

    false

aes.plain

Targets

    • Target

      Wave-Setup.exe

    • Size

      125.0MB

    • MD5

      9c2c4ff8c886747f36dfb60baf8dfc58

    • SHA1

      447c496617ce26d88040f6b927bd7758f895e704

    • SHA256

      5583231982fa337c0ade14f84301cbf2078656bcfe128f99dd082c3ec95cb4c7

    • SHA512

      0fc242a792479be540a8d78128efe566229f1b97c39bed840f813b81a5bc6504002f427e06eca14973e17c3789ec4f2d00a8cbbcbbcaa5629a34300fa9635a0f

    • SSDEEP

      24576:ZTZS04YNEMuExDiU6E5R9s8xY/2l/d4BNIbt+rx:ZTb4auS+UjfU2TgNIbt+r

    Score
    10/10
    orcusdefense_evasiondiscoveryevasionpersistenceprivilege_escalationratspywarestealertrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies Windows Defender TamperProtection settings

      evasiontrojan

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • UAC bypass

      defense_evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

      defense_evasiontrojan

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Hijack Execution Flow: Executable Installer File Permissions Weakness

      Possible Turn off User Account Control's privilege elevation for standard users.

      defense_evasionpersistenceprivilege_escalation

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Impair Defenses

5
T1562

Disable or Modify Tools

5
T1562.001

Modify Registry

6
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks