Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10/12/2023, 21:59
General
-
Target
f8a7162d902d43bd157ecc8252620ad4022d82afabadec5661f5d980f9d48909.exe
-
Size
6.9MB
-
MD5
d4d17caa2171d4fb0d62f2ec9bb4e088
-
SHA1
a2b2cd7b7c913db16e84b55ab75624e2a2f8df27
-
SHA256
f8a7162d902d43bd157ecc8252620ad4022d82afabadec5661f5d980f9d48909
-
SHA512
46b6db07a3ac2d165f423b7e3b0fcbd1a0f7db9033851341cf213c5f1d36d27957ff921baa0138ccb310a6cd8ba1ef46dc0d8802bfd9e1e5807d9754a3dfb4a4
-
SSDEEP
196608:4xnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:wNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8a7162d902d43bd157ecc8252620ad4022d82afabadec5661f5d980f9d48909.exe"C:\Users\Admin\AppData\Local\Temp\f8a7162d902d43bd157ecc8252620ad4022d82afabadec5661f5d980f9d48909.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-27TUR.tmp\f8a7162d902d43bd157ecc8252620ad4022d82afabadec5661f5d980f9d48909.tmp"C:\Users\Admin\AppData\Local\Temp\is-27TUR.tmp\f8a7162d902d43bd157ecc8252620ad4022d82afabadec5661f5d980f9d48909.tmp" /SL5="$A002E,7025884,54272,C:\Users\Admin\AppData\Local\Temp\f8a7162d902d43bd157ecc8252620ad4022d82afabadec5661f5d980f9d48909.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD53581a455e1f5eb5084d33ee2410ea869
SHA11b70617472a131212c87e578f3a6efcce70c4c8e
SHA256c31f01423a22e6e733ab88a31fd64c99eb21a2b8152481f5276906141f494b4d
SHA5128f221130f936f3e1f348a9eba0900f978cee8b42d0937312fc38e134282ad75760f858f5ecbe09262a6950a6d6b6c470ba9aba6b16e88926115744e2ba7e029f
-
Filesize
776KB
MD5d47991d237b42cefc9265be11ff28dbd
SHA14bf6e1ba89670cadebb636ef410089b2a421861e
SHA256c02c81045d9ca444156c9064f9d5cca041478f64f04298b6cc62ec10f7e3fdc0
SHA512452d99abbe2be72184ebd2f7d3ebc576b7e51dc4c36d609f9bd7b462ab11810515ec2c271031a986e86d82e5f277cc2b7d6544d09212a980c7b783856bbc62f9
-
Filesize
474KB
MD5ec9a92b79687de8781cc247a7817e454
SHA17681e7c25c8cff60cbcd01cb8ec5d339d099badf
SHA256eb552e8afe91b73a5b3abf8b4b4f7e2628d7d9b35f3a75d57b4d60722fb2c441
SHA51252bfdfb8e11045d2ec0f8bc4cdcd82fd34ce3b0d188bc1ae08b19f404e959f73cf3d2551539d2db014cf5e5b361660d95378fd494fcfa4c50a1799c66829cb18
-
Filesize
687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB