Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2023, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.exe
Resource
win10v2004-20231127-en
General
-
Target
c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.exe
-
Size
6.9MB
-
MD5
c98fb48edf3d379389fd12aeb3cdcf24
-
SHA1
aafb4d1afb8d567822e4d78a42ea9031ef6ab28c
-
SHA256
c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915
-
SHA512
f49ddc55d6f822482dc2e5dc117b8f61f88872a9aabfc076abe8e5eedf3316c72408f72f314be2673e6afbcc329f6dec45c711cb9a6bab37f2cfbd6931be0c5d
-
SSDEEP
98304:V+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:oz25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 4452 crtgame.exe 4484 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 141.98.234.31 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KBU0N.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9GPNL.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2O9L3.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-4GIE2.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\is-IK6D1.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9GD1G.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-15KNG.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5EQRT.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-HHTRC.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-6POLT.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-87K6N.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H25P3.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-VR0O0.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-LUA6T.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-HD13R.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-TT7G1.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-TV5GO.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-D3FT1.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-56473.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-192T3.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-O5M1B.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SD5QJ.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5T5NO.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-BNLBU.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-D92DV.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AOMB0.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6LEMS.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9IQLU.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5KKBC.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KVUIV.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RRK3A.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-PKQV8.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QKFUJ.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NNMDG.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5GMVU.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IA0F7.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-3HER5.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CJ8D1.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LD8QG.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ENK6L.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LG3B5.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-UM23N.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5OERF.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6DTPT.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-68ADV.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RCLTM.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-S8QKO.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-54M2V.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RSKLS.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GL215.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AKTG7.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8OFVN.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JC58P.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GAUJG.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3D3O8.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BP1KJ.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DCNOD.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OKGQ2.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-U4Q85.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JJFUR.tmp c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1932 wrote to memory of 3420 1932 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.exe 87 PID 1932 wrote to memory of 3420 1932 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.exe 87 PID 1932 wrote to memory of 3420 1932 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.exe 87 PID 3420 wrote to memory of 1260 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 90 PID 3420 wrote to memory of 1260 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 90 PID 3420 wrote to memory of 1260 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 90 PID 3420 wrote to memory of 4452 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 92 PID 3420 wrote to memory of 4452 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 92 PID 3420 wrote to memory of 4452 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 92 PID 3420 wrote to memory of 3472 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 95 PID 3420 wrote to memory of 3472 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 95 PID 3420 wrote to memory of 3472 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 95 PID 3420 wrote to memory of 4484 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 94 PID 3420 wrote to memory of 4484 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 94 PID 3420 wrote to memory of 4484 3420 c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp 94 PID 3472 wrote to memory of 1052 3472 net.exe 96 PID 3472 wrote to memory of 1052 3472 net.exe 96 PID 3472 wrote to memory of 1052 3472 net.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.exe"C:\Users\Admin\AppData\Local\Temp\c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\is-5TN37.tmp\c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp"C:\Users\Admin\AppData\Local\Temp\is-5TN37.tmp\c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp" /SL5="$C0068,6985375,54272,C:\Users\Admin\AppData\Local\Temp\c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1260
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:4452
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:4484
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵PID:1052
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD527e042a7d6fbe962c330400f1223a954
SHA1b6f0a6675289e2f586cf9ccd1cbe54a0c1b005ca
SHA2562f430158dad6a1b4522f47fce2ed29dcb8e292bc703270c89c28d7ed36b5a339
SHA512752fc200506cb125b77b1281acf973e07c664fd0ab9c3125a316713a705606abc94f00d3748f4023ed5dc84fe0709b332b876bb9ef3913c0963c591b4f9841fd
-
Filesize
639KB
MD5fa8eb0bcb57425743ed6e401d31a26c7
SHA1712d67978aa773dbc674d790793600e88db1cfaf
SHA256cc607b7f52824f3625ebcf112b02744fd8a4fee248f8f87db132acf264a0f754
SHA5122b04fe808bfc86a27c20327b8db663ab83756c2044e7b33b4be966e6e0a1eb4633e3ba97ad25cd90310616b9d96e862eb0dbcddbaf4bc58b41167d7d53ab17a3
-
C:\Users\Admin\AppData\Local\Temp\is-5TN37.tmp\c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp
Filesize641KB
MD5dc9b384964b34dbb24aa9bd2ffc61b68
SHA155a34116ae18cb82fca08737616223aa2ee6753a
SHA256029675d063ff9bd1b44f5ed29034cceef61e7b4af920bdbf6bb127f508c74f26
SHA512485cfbfe985eb7194aed8e32217407c8f045ff0efe9052e2ab05f415617ef0a7689d8f75b1f532e93518dd349144cc047c7420eaf11f9127623b5b93254a7922
-
C:\Users\Admin\AppData\Local\Temp\is-5TN37.tmp\c372f0910fc96f48d28ec6c2ac6aac59e699035c29fd053d8832882a39128915.tmp
Filesize82KB
MD593a6355b8c0e97c20468a93d148e8505
SHA117d23f73029a7241a4bc01e4eae2449b69393d24
SHA256ad830c088766a34c1c07c30b44671510a21282fa94ddb2260b058022558a02d6
SHA512464dce8a3a45a8a492bbcb9c3f291c6baeb8a76bb38ce04dd3044bed10adf2593e8df32520a31da75edbe0f056b59df0ac82280d6631f0146e6df2c60f55607e
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303