Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
10/12/2023, 23:25
General
-
Target
b5f20b4018605b8f43d4e2e102b480c87e839ce82a5c595e188e832a710a4397.exe
-
Size
6.9MB
-
MD5
2a9cf54e646a2545b1831cb20a7ff9bf
-
SHA1
56a14a2327d90d25b523aa9634f2e93781d9518e
-
SHA256
b5f20b4018605b8f43d4e2e102b480c87e839ce82a5c595e188e832a710a4397
-
SHA512
fa19d78b9867415bc80e5ba151b30fed61426e03d4580b2ec8d6275ec778b0b326715c77a6cacbcb30603df0ce6407fd8627c3bb780aa6a79160a733d286a449
-
SSDEEP
196608:5xnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:/NztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5f20b4018605b8f43d4e2e102b480c87e839ce82a5c595e188e832a710a4397.exe"C:\Users\Admin\AppData\Local\Temp\b5f20b4018605b8f43d4e2e102b480c87e839ce82a5c595e188e832a710a4397.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9ANHA.tmp\b5f20b4018605b8f43d4e2e102b480c87e839ce82a5c595e188e832a710a4397.tmp"C:\Users\Admin\AppData\Local\Temp\is-9ANHA.tmp\b5f20b4018605b8f43d4e2e102b480c87e839ce82a5c595e188e832a710a4397.tmp" /SL5="$60192,7025884,54272,C:\Users\Admin\AppData\Local\Temp\b5f20b4018605b8f43d4e2e102b480c87e839ce82a5c595e188e832a710a4397.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD57b4a3f3f3cf411467fddbf0e445c669e
SHA115bc9e1b463fe4e16406636efe18c708a29fabda
SHA256f0961c5de20077a060e0da76744cacd6c147e7e0cd06318f8eacaac376352cef
SHA51223c694bbecc95aa9f30b4ff2c36e53c6cdcdba0776dff16355f9b5056820a5eae5215c6f6036a8eb8de1637240fa347340c3d2e2ccd92e16a3cdb46e31877d75
-
Filesize
196KB
MD529872bac40ca8a178477db2d0110ce9a
SHA191b386f66bf00a667b832d50ff3f50faeb587388
SHA256b96612549b65dec81690b90d1a6b9e4ae16a3870b80ac5747344c0e1fe58c2ef
SHA5124d4091aac070d4e2a0b5d537319283c47edb211ba0a25f92e863a4f025fe2e80d975a0fca6a6fddfdf958f8c54abe516524a724e43a776a3b0d8e60d8642e1de
-
Filesize
77KB
MD517c614c8dc0492c962cbc3720890ccac
SHA19c78a6437562e83354d5d7c2c9416eb080dc9529
SHA2565bdaea4c0481c0e300a1c1192f07f5e31e352645c428f01ed2dc9b0a079e2e30
SHA512133804de1305d36484f5d028bbdaa3aa81d6a1b1aeca202633ce5f09cacfa8fdda29f03942aac123354598d9a9154f04499978fa7860722bb9ac882141b64a8d
-
Filesize
191KB
MD5f6d4a8652834793657b5c9526376622e
SHA171aba746f22e435c062b56ddaa5e33df5527e184
SHA256b738d52925ee79607c01fd0a4148a0ac4edf6c3f619cd81b29d4b6aa482ce6d9
SHA51291f9c08638b4d23db979c7392a3438c044aa8e554d71ec6d4f816b1d6c1accbe59ae09422dede86a9dfbbf3c450231702b2db457eeb927389b24a5ee7660758f
-
Filesize
372KB
MD55c0465a0a5754d764adc7fd342591ec4
SHA1d808b3593c26126e946ccbc60f904f1c72a27658
SHA2565d9198c13e320f7dcf44d0ba2105e1459a1f08d59df7b5bd9e57509e2ab487d1
SHA5122427d624896b53f39ff5162297d52413ef4d2230d6b08837663820d186a831430f338d11df52f7bdd98e003fb9712062cec38fc857a126f5732646c8e576387f
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB