Technical Information
Modifies file system
Creates the following files
- %TEMP%\dfir-orc_x64.exe
- <Current directory>\dfir-orc_workstation_geuwqwklhyc_20201005_233442.log
- <Current directory>\dfir-orc_workstation_geuwqwklhyc_20201005_233442.json
- <Current directory>\dfir-orc_20201005_233442_workstation_geuwqwklhyc.7z.p7b
- %TEMP%\workingtemp\processstatistics.csv
- %TEMP%\workingtemp\jobstatistics.csv
- %TEMP%\workingtemp\autorunsc.exe
- %TEMP%\workingtemp\tcpvcon.exe
- %TEMP%\workingtemp\usninfo.7z
- %TEMP%\workingtemp\processes.csv
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://www.microsoft.com/pki/certs/MicrosoftWinPCA.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\dfir-orc_x64.exe' WolfLauncher
- '%TEMP%\dfir-orc_x64.exe' NTFSUtil * /vss
- '%TEMP%\dfir-orc_x64.exe' GetThis /out="%TEMP%\WorkingTemp\Event.7z" /config=res:#GetEvents_config.xml
- '%TEMP%\dfir-orc_x64.exe' NTFSInfo /config=res:#NTFSInfo_config.xml /SecDescr="%TEMP%\WorkingTemp\NTFSInfo_SecDesc.7z" /out="%TEMP%\WorkingTemp\NTFSInfo.7z"
- '%TEMP%\dfir-orc_x64.exe' USNInfo * /out="%TEMP%\WorkingTemp\USNInfo.7z"
- '%TEMP%\workingtemp\tcpvcon.exe' -accepteula -c -n -a
- '%TEMP%\dfir-orc_x64.exe' GetThis /out="%TEMP%\WorkingTemp\SystemHives.7z" /config=res:#GetSystemHives_config.xml
- '%TEMP%\workingtemp\autorunsc.exe' * -h -m -s -a * -c -nobanner -accepteula -o "%TEMP%\WorkingTemp\autorunsc.csv"
- '%TEMP%\dfir-orc_x64.exe' GetThis /out="%TEMP%\WorkingTemp\Event.7z" /config=res:#GetEvents_config.xml' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-WMIObject win32_process | Export-Csv -NoTypeInformation -Encoding UTF8 -Path "%TEMP%\WorkingTemp\processes.csv"' (with hidden window)
- '%TEMP%\workingtemp\autorunsc.exe' * -h -m -s -a * -c -nobanner -accepteula -o "%TEMP%\WorkingTemp\autorunsc.csv"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Volume | Export-Csv -NoTypeInformation -Encoding UTF8 -Path "%TEMP%\WorkingTemp\volumes.csv"' (with hidden window)
- '%TEMP%\workingtemp\tcpvcon.exe' -accepteula -c -n -a' (with hidden window)
- '%TEMP%\dfir-orc_x64.exe' NTFSUtil * /vss' (with hidden window)
- '%TEMP%\dfir-orc_x64.exe' USNInfo * /out="%TEMP%\WorkingTemp\USNInfo.7z"' (with hidden window)
- '%TEMP%\dfir-orc_x64.exe' NTFSInfo /config=res:#NTFSInfo_config.xml /SecDescr="%TEMP%\WorkingTemp\NTFSInfo_SecDesc.7z" /out="%TEMP%\WorkingTemp\NTFSInfo.7z"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Disk | Export-Csv -NoTypeInformation -Encoding UTF8 -Path "%TEMP%\WorkingTemp\disks.csv"' (with hidden window)
- '%TEMP%\dfir-orc_x64.exe' WolfLauncher' (with hidden window)
- '<SYSTEM32>\systeminfo.exe' /FO csv' (with hidden window)
- '%TEMP%\dfir-orc_x64.exe' GetThis /out="%TEMP%\WorkingTemp\SystemHives.7z" /config=res:#GetSystemHives_config.xml' (with hidden window)
Executes the following
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\systeminfo.exe' /FO csv
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Volume | Export-Csv -NoTypeInformation -Encoding UTF8 -Path "%TEMP%\WorkingTemp\volumes.csv"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Disk | Export-Csv -NoTypeInformation -Encoding UTF8 -Path "%TEMP%\WorkingTemp\disks.csv"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-WMIObject win32_process | Export-Csv -NoTypeInformation -Encoding UTF8 -Path "%TEMP%\WorkingTemp\processes.csv"
