Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
134s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
10/12/2023, 23:21
General
-
Target
29318e47bfb6f2ef58ca3a5c50912ac004bda22fb8dca795db3f1e6e19b44e61.exe
-
Size
6.9MB
-
MD5
a4d9fefccf36666c850c5821b0ff5641
-
SHA1
b3803ab8a3844a2aa14d35ee8d1e8c1927c3b4d5
-
SHA256
29318e47bfb6f2ef58ca3a5c50912ac004bda22fb8dca795db3f1e6e19b44e61
-
SHA512
ff6812f23db3223f4894fdaa2b9183ba922f47dfa0c1fe74cd19f8552ca84ee02d14cce42a078c55f08149c669c6a9d8509d7e32ca76e51874798725900ed02b
-
SSDEEP
196608:xSnj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:xSjumV+jHUodIjk5VzfE9Awzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\29318e47bfb6f2ef58ca3a5c50912ac004bda22fb8dca795db3f1e6e19b44e61.exe"C:\Users\Admin\AppData\Local\Temp\29318e47bfb6f2ef58ca3a5c50912ac004bda22fb8dca795db3f1e6e19b44e61.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-N213O.tmp\29318e47bfb6f2ef58ca3a5c50912ac004bda22fb8dca795db3f1e6e19b44e61.tmp"C:\Users\Admin\AppData\Local\Temp\is-N213O.tmp\29318e47bfb6f2ef58ca3a5c50912ac004bda22fb8dca795db3f1e6e19b44e61.tmp" /SL5="$600D8,6998999,54272,C:\Users\Admin\AppData\Local\Temp\29318e47bfb6f2ef58ca3a5c50912ac004bda22fb8dca795db3f1e6e19b44e61.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5a82bc5bd6738ad219f050f7255020404
SHA1a3823adb07196d1ab154b43de156519292b411ea
SHA256a6f3cda576dec2c8a9c83613e050d4a32c0f2d1e2d61d3bf3c0e4a6a17cc35dd
SHA5128b9d40ac1333f01f568949b610ad2ebc645a3d324f4ece8791f7534c42c724dd0a68e19b60e37a15525d24cb3e6ef62a5ab51c68758dc5f74a82036555998b04
-
Filesize
768KB
MD55f5241f69e403bad08dbcd3f3bf5d9c2
SHA1269ebfac2ded0896d7999b2732f1ac22fcf2690c
SHA256307455ad11a74fb70ae99ce2d90b9c623fec48246cd5df26922e5cd008462ea1
SHA512dc49c31ebca0db835896634e9e20b7ab8ee88aa366a6404b8f1d4a3aed34131c408d03c0a0e57ea86e0b84d236483b6100117643ef375dd2206e5b9ceea42e60
-
Filesize
205KB
MD56190628063bb3a40a49e8957b29accdb
SHA1c0866d172946d97b354ceb96eb6601819d1b7747
SHA256b53bf9f3da7dad4c678cccbdbe0679ef64650e8947b512ae9280d79189a708af
SHA512a080c8d9c5b4bf63d7447ec6d772e0451791cad8208a30658ee952442e09633a8eefe6b1121da1615f129699fbb8544c6d46330ff873a2d4fa58a276c38f0a40
-
Filesize
605KB
MD5ff9852f72434668368413a2478d13310
SHA1c91ece2248f39bda0a91d42c0648541ac81b347e
SHA256d6d194ca386f22bcd8a7ae514e26f538dfbbafbbf37b695236c2478b9518d7c8
SHA5124c49a7749e69126030d6c45a2c31ee1993348722f13ba611aaba63fb3aa464278b5b4f63cca1383975e4b1f90c9b23144c4a53d4dd5191357540e3538ffe00e0
-
Filesize
488KB
MD57c7186e6fa731593a8dc190c6f6b38ee
SHA14403021a8830f1dceab38db7373cc5e384d82e3d
SHA2560e3670db75ca6211af4467490251c46cfa82d5cec029bdf312a418f682b4622f
SHA5125d4bc63de692f3bdfda1dd4762ee3335c6793c6ccb7241ee73ca64bbfacf1e703d819ccef2dace273c562f427f25af4b848c9954b995987fa380987aba0beb6e
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB