Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
10/12/2023, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
tuc7.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
tuc7.exe
Resource
win10v2004-20231201-en
General
-
Target
tuc7.exe
-
Size
6.9MB
-
MD5
8cdc35abbc8f012285fa8ada42cd1854
-
SHA1
27184eee999841e6c589d90fd4f2db92abb21255
-
SHA256
fcd543fca24df3c849ddd7c28c225335d97c2c8d678409eb5865a7e04548e19d
-
SHA512
5ec7a6672a3f633d9561d21b48e2af99a8cab035f7f42aa0afb3054967ed38fac7e9677a539e73f66eef2dcbea3a86922ae40768a120cbe59dd79a53d00f12e7
-
SSDEEP
196608:aA89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:CBmakyVnlUQ7Wz3Tv1jNTh0zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1808 tuc7.tmp 2240 crtgame.exe 524 crtgame.exe -
Loads dropped DLL 6 IoCs
pid Process 2220 tuc7.exe 1808 tuc7.tmp 1808 tuc7.tmp 1808 tuc7.tmp 1808 tuc7.tmp 1808 tuc7.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\bin\x86\is-H9N8R.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0S53N.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AJ99N.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-H5A0K.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-T7AEF.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GCDN7.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3B4KQ.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-I5RUQ.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-I55EE.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6R6QR.tmp tuc7.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-EMVAO.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-7V17A.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-EOREV.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-73EB9.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H9KU6.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-TQBT8.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3U8O8.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QB3HL.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-D2Q5F.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-U28TS.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-CDI09.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-C70JF.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-UC7VA.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DR7DH.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-EQ5TN.tmp tuc7.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3BC3J.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-M5GIO.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DGFAF.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RMBH0.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-L23SL.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-R6TA1.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RKNDT.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-7L78T.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-K2B87.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-C0ET8.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DGAN5.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-PO5MI.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-VSCN9.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RV3EG.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4ECHK.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OVK5S.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-MOGVJ.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-KKTLL.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SF5IR.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-U2SQU.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8OF5E.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-D6F94.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-J5TNA.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-IQGBN.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QM4T3.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IBA82.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BLFNF.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-EVTM1.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\is-N0FCB.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-8EN69.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-I67VO.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AIVK2.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H8VA0.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KOBRC.tmp tuc7.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-UIQLQ.tmp tuc7.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1808 tuc7.tmp -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2220 wrote to memory of 1808 2220 tuc7.exe 28 PID 2220 wrote to memory of 1808 2220 tuc7.exe 28 PID 2220 wrote to memory of 1808 2220 tuc7.exe 28 PID 2220 wrote to memory of 1808 2220 tuc7.exe 28 PID 2220 wrote to memory of 1808 2220 tuc7.exe 28 PID 2220 wrote to memory of 1808 2220 tuc7.exe 28 PID 2220 wrote to memory of 1808 2220 tuc7.exe 28 PID 1808 wrote to memory of 1628 1808 tuc7.tmp 29 PID 1808 wrote to memory of 1628 1808 tuc7.tmp 29 PID 1808 wrote to memory of 1628 1808 tuc7.tmp 29 PID 1808 wrote to memory of 1628 1808 tuc7.tmp 29 PID 1808 wrote to memory of 2240 1808 tuc7.tmp 31 PID 1808 wrote to memory of 2240 1808 tuc7.tmp 31 PID 1808 wrote to memory of 2240 1808 tuc7.tmp 31 PID 1808 wrote to memory of 2240 1808 tuc7.tmp 31 PID 1808 wrote to memory of 2820 1808 tuc7.tmp 35 PID 1808 wrote to memory of 2820 1808 tuc7.tmp 35 PID 1808 wrote to memory of 2820 1808 tuc7.tmp 35 PID 1808 wrote to memory of 2820 1808 tuc7.tmp 35 PID 1808 wrote to memory of 524 1808 tuc7.tmp 34 PID 1808 wrote to memory of 524 1808 tuc7.tmp 34 PID 1808 wrote to memory of 524 1808 tuc7.tmp 34 PID 1808 wrote to memory of 524 1808 tuc7.tmp 34 PID 2820 wrote to memory of 1432 2820 net.exe 33 PID 2820 wrote to memory of 1432 2820 net.exe 33 PID 2820 wrote to memory of 1432 2820 net.exe 33 PID 2820 wrote to memory of 1432 2820 net.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc7.exe"C:\Users\Admin\AppData\Local\Temp\tuc7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\is-MKRBP.tmp\tuc7.tmp"C:\Users\Admin\AppData\Local\Temp\is-MKRBP.tmp\tuc7.tmp" /SL5="$400F4,6977575,54272,C:\Users\Admin\AppData\Local\Temp\tuc7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1628
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:2240
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:524
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:2820
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵PID:1432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
396KB
MD5ec0e489764544ee6460d3eb693861263
SHA10ecf1799abab67ab4bfaff08dcb826517a5b186c
SHA25632796ddcb9bc6b938c8fba6bce06579084078364dfc1279875dda2fe4b820513
SHA51240517e8fc43a18329725b4ec5532bda5f2f49bdc0860e0c0b753df0bf9f8e608aa54b1045dcfb83542a6582e4b0ee70b64b9e390be71511f8a8094751fe5d54b
-
Filesize
298KB
MD54006ff6a228abf92de38f2d2c7d6ce13
SHA1d4392014efa0a22ab07fe5b9008a03637f4eddf8
SHA256f943be674b63c65fd04161b8e86f0017f941b7d8e24a6dceba9aca1adb999c35
SHA5124abe1fc245411972237340153064f1c081adc79d884d5920cf2642730474a308a21966d7a13498897dd3f44196fe397203bbfa2fe949b073fb0eb1044d9dfc11
-
Filesize
207KB
MD592047b5d001a889d16c49d56ce29b305
SHA1f0d98e0b29efc8f6998daaf3b5d7d305db90a483
SHA25672e9517abba3406e78762935d84f4bd6353b909a7ff34b8adef1bce5aec80a2b
SHA5124b0c1eae2582153876a7214088678826dd81034e6eee504c7e4a464e91d879a6a3185759f3a8359e2dbd3ab27df92a5b4e5e7e7e96bee8f7b8615e04d9ddb6f0
-
Filesize
451KB
MD5877c161a40ba655aee875c9a7bfe6afc
SHA198797a837f199ef84b6cbd1724c667e9d70f7348
SHA256efcca0fa4531e6cd33e2f96ef8279e6f44c510ea165d25d7048a58c5cc9e7d97
SHA512860e96a27b5a497cefb12c46e0c17a8438c10a4d08df138d43376035d09f11b4ce6232043b8f59d29d056f8b0227821cf87e231f9f81d922be13e2e503ce1ece
-
Filesize
563KB
MD550949864d19b420ee6666965900ef237
SHA169173166f919c07dad5154bba4968e51fbac8341
SHA25630970709e7cd96cffcca7e3e2f2d8b6e04517903f40ca5f0766ff64334f50678
SHA512141f67209c326b6e4727a6fb26507feb8913e7020fb931706c45db1e858310a739ee756c14c3f59cc5ad0b9e9c52234cc2bcd97dd8e5d0f85bd4ece76c88f68c
-
Filesize
491KB
MD50d3fb0df060d6ccc7fb4c1b3ebf8026b
SHA1d53b6519e3dc6fc9ededf41c8e1cddadbc432d04
SHA25683f8d7946543468adb3f7e9c035e843313d16b1bd4d3287cf7124c232bef693a
SHA512567c1c987bfd0b361211362383493eab46c5f64a4d884b296efaf8f346ac73a4f49b0cc5262da4ca55698b89ef4048b32c6419db2272b094a1c71f953d131546
-
Filesize
472KB
MD5af5e07b50a1b3732bc7375ee806cc1ec
SHA1fd4e9f3f18e4ff9e59eb7ed66bfb53287febe27c
SHA256661fef2e47b5b15bdd6d7e788ac2e3293f53c96ceaf20d645ba5b7509b2c3fd2
SHA51230adecb8e649c536d101a620af336a8919fdeb3c2073866f9f174fa8d353e8b01cd03a896bd72bb5e096607cb3e3c8f2a389146419660c9f8e76758dd7269316
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3