Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10/12/2023, 21:49
General
-
Target
6c4a5e6b20a9740078f74cee0818021346efe4b18a4afa338a09dc3d8ac8e43c.exe
-
Size
6.9MB
-
MD5
ab948194c3bb3d3bcfb96bbc2cdffa48
-
SHA1
04ae7601fdab0d772b6825b77661ce418ca5f239
-
SHA256
6c4a5e6b20a9740078f74cee0818021346efe4b18a4afa338a09dc3d8ac8e43c
-
SHA512
1a65a05de0f89e1fa4addd5982d556b15d54451c5a3e8385b9001186549a5b179c18714332ff705488b94783bb5670630b2af70480d06003a7570394c8f1cd15
-
SSDEEP
196608:kxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:MNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c4a5e6b20a9740078f74cee0818021346efe4b18a4afa338a09dc3d8ac8e43c.exe"C:\Users\Admin\AppData\Local\Temp\6c4a5e6b20a9740078f74cee0818021346efe4b18a4afa338a09dc3d8ac8e43c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TLD8E.tmp\6c4a5e6b20a9740078f74cee0818021346efe4b18a4afa338a09dc3d8ac8e43c.tmp"C:\Users\Admin\AppData\Local\Temp\is-TLD8E.tmp\6c4a5e6b20a9740078f74cee0818021346efe4b18a4afa338a09dc3d8ac8e43c.tmp" /SL5="$180042,7025884,54272,C:\Users\Admin\AppData\Local\Temp\6c4a5e6b20a9740078f74cee0818021346efe4b18a4afa338a09dc3d8ac8e43c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
595KB
MD536d400cdb73e90da05e9e632f9443364
SHA10ffae2e4c396fb8b79c2e6920aed0e1ea5aea3c8
SHA256ce47e6cb24cb76781c17a08a2f7ca222a9e81369217c4a6bb8bf5b6386c4172c
SHA512e03850c784b0017cb7a53f9dbf3b9e10ba5192da21b8b6f283d25452df7d67cfbfac05803d11509027360460ec15759c3c087cd946a844829bb96f260822ff89
-
Filesize
506KB
MD50c74e9a463ef4ae806a8f6ae65d96973
SHA17dba9ad3380f4fe37b933d027c80ac163311bb72
SHA256dce770686f4142a2c8dbe48de1cee1d53e6a2559dc1c70ef1ffa0069d8f738b1
SHA512b21f5ee9494daa7ce9572fbf4b592e9ecda2295481e91b8c79990eba29bb5207dcd167eb7063092ac7cb8ce7f96e38ff86c55f8a435cbad182b2708a2c55dc49
-
Filesize
643KB
MD539967a45fe10e30220c479137296290f
SHA144556dda2ea7358886f2812fa497f74d76509d6e
SHA2567e89df85ccf711d84dc14810b44a39c1c252e223542b7a441058161eb50316cf
SHA51270348cee19d8d13a4bee761124256047d6f204b20cac3128abb947342cc7de8629ee1a09ccaa77045d247c1da68163d86604d02aa26cd4ebf3a8513e039ee17d
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
264KB
MD546c5c6fa049b0be91fc497ae9cf3bca9
SHA1c07dce5d730afa801c2b41fda3e607507a38e800
SHA256f9999b53c7fda4a0f17ea7dc215f03f57286e062464ca525a0022f465d84186e
SHA512b8aae434c108b28765db7496aa931f372c3aff3655b3516e239bc1e2cce812416a8b8277d0dd09d1c18df0f8e9bad9199bee5392f5c8807ffcb827d52782189b
-
Filesize
146KB
MD50df8554edb6dfdd912b30539f3117265
SHA18af67c4eeef01f58bc081ece874c9d9ea905307d
SHA256eb188987cd884ea7cfdd6df49f4c8042a9900fa485142115a4187d2b9ce7f6a7
SHA512aa3395fd55abb169db282bdf81c44d6799f0bb27ccf789614b0030865ff11ec744b10c6a8bb8bcc7203ef48aada5a7dbf5414bb61bdcf54084dc40521805362b
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB