Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2023, 16:29
Static task
static1
Behavioral task
behavioral1
Sample
c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.exe
Resource
win10v2004-20231130-en
General
-
Target
c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.exe
-
Size
6.9MB
-
MD5
55df4382fbb0d945080c521e81800e44
-
SHA1
24ab009994dbde941263a7349410556538dd6d4e
-
SHA256
c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255
-
SHA512
a2e608bb1b8f8916481ad3ba851615278d1f5d2f0860d37d7833942304e076dc53a0f3183848da4c8adfd3524e6cf533d4f229603b907ecd05ee562a8e4e9a49
-
SSDEEP
196608:zRjdxc1gN5pg/uVqocXn6P1OX0HaN2mgA1Uf3FEjzj:lx8gDpg/uVMXW1OE6UJA1jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 4132 crtgame.exe 3468 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.49.94.194 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\bin\x86\is-GSR53.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-E1A98.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FL92B.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JB2FA.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-35FRG.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6LRSF.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-QIPPH.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-UHJAF.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9QB8O.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IAORT.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CM0AV.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RIF2S.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OCMUN.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-TVT5H.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-C7LDS.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IFT1F.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-95KN0.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-60NL3.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H0VUU.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FNJBD.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3HRMG.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-E120K.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-VH3VU.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-D48AQ.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3QDSS.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-R0BDB.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OTSBK.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GU9SH.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LCHID.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H1KG6.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4NCFR.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LNLVC.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-43Q0U.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BRPLV.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-5JM9V.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JJC9N.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NGUFJ.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NGOSO.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GS05U.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-EP613.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-2RMO2.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-78VS7.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RIBIV.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-Q471C.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MOOR6.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-N6MJH.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-JK3S4.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-42D48.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2FC4B.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-41K5A.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-L84FV.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-CFGEJ.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9418V.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-P3UF2.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-UGF3A.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NNNNS.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-B7K4M.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\is-1N5GN.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ERQAB.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9LTIR.tmp c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 440 wrote to memory of 4428 440 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.exe 87 PID 440 wrote to memory of 4428 440 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.exe 87 PID 440 wrote to memory of 4428 440 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.exe 87 PID 4428 wrote to memory of 2040 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 91 PID 4428 wrote to memory of 2040 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 91 PID 4428 wrote to memory of 2040 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 91 PID 4428 wrote to memory of 4132 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 93 PID 4428 wrote to memory of 4132 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 93 PID 4428 wrote to memory of 4132 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 93 PID 4428 wrote to memory of 4080 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 96 PID 4428 wrote to memory of 4080 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 96 PID 4428 wrote to memory of 4080 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 96 PID 4428 wrote to memory of 3468 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 95 PID 4428 wrote to memory of 3468 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 95 PID 4428 wrote to memory of 3468 4428 c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp 95 PID 4080 wrote to memory of 1368 4080 net.exe 97 PID 4080 wrote to memory of 1368 4080 net.exe 97 PID 4080 wrote to memory of 1368 4080 net.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.exe"C:\Users\Admin\AppData\Local\Temp\c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\is-0JNBQ.tmp\c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp"C:\Users\Admin\AppData\Local\Temp\is-0JNBQ.tmp\c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp" /SL5="$140064,6959093,54272,C:\Users\Admin\AppData\Local\Temp\c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:2040
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:4132
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:3468
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵PID:1368
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
691KB
MD5c640b7ef4818e561f72b077cde40ae3a
SHA1395f7e1d92fcb76a621f4bf340e5a37d3da851e9
SHA256433b9c5a434141f776a1d5b20f1884133db19592fc764a6be257b37a0f360ea1
SHA512679ff04a0e3ffb1ca39c8157cc354ad9a4c57194fa75e9dda132feefce9fd2ec3574cafa57f6bd4140422cb02494c20c82cb4dc01afc43d05b03404a747cb5c9
-
Filesize
718KB
MD56c293921e8984cbbd205c91c4694ed0d
SHA11897dcfa243f8fd964d608b08752712acb7facda
SHA256c631bbb6fcd213328097e17d8f6b44c67d10204f13d473e149adc2cdea86cd18
SHA51257e2ca6b1f7f0b29daa14e4d3faccbc8146f9e07f8d23e16db5bddf17e934b40bbcec4c80573b4dbc0aa2541c705971190100a263ae1b4f6d98330e862ba4c6a
-
Filesize
571KB
MD51efecc124f52d0f4ad885f656d3de12e
SHA16bc887233589b8cf5354214cd0ce4970e8177ca7
SHA256797f0c7c5030952e8d4188f83a5ddc0e10bfcefcc0b357e0230b334413cc3e7a
SHA5125fab6a6bbf18936b009b28f61b6e18f68a765bec2297dc07fa9e98b05fd75dca2d82335ca8e90182bfd374947a955df7c275595b118a161726f1329ed8871bca
-
C:\Users\Admin\AppData\Local\Temp\is-0JNBQ.tmp\c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp
Filesize419KB
MD5f95ceac6298bbb4c901008f99a026e3f
SHA177c10c21abf0ccb952d3aaaaaf34b4b9fa8b5ada
SHA25653d0973d08cb858b85bda988093e8bf2dd925db8459ef1120117f630496b7e1d
SHA512ee79a84aa0ee038dd71e8726d66b509100abe4efd72efa18d89d505a06613d797fc745e13c3467cf32d19e33c862f0fcb7d97f8af194d2b1174fb5692b9128e9
-
C:\Users\Admin\AppData\Local\Temp\is-0JNBQ.tmp\c3b63b54a8f9cd9a67eb4037fe4a0bc1137d5df223285bb264ed5fd57e893255.tmp
Filesize244KB
MD5a579e6d17845e29a2b9a753d81f5c575
SHA1d9dade0d92c67721fcf642a8b4841d5e97cedb31
SHA256fa865735a67c002774bdf915bc425826ed7d664ff8cb1f1ce0894ef06dd60516
SHA512cb128a7b5283eee8287ba26602ba40cac5bc56455cd4c3a02b2dfe218f708649cac48765d0609ffadfecb0cd5caff7072f91525fb138c30794caed9d64364532
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303