Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10/12/2023, 20:26
General
-
Target
3ca8e51235853ccbae394b799e0bed281c2843708d2d622e599fffc536babf5c.exe
-
Size
6.9MB
-
MD5
b262ce9689e7b06f0de21c6c64709ce2
-
SHA1
8d424194095e019bd12151a5ed9b549d4473fafc
-
SHA256
3ca8e51235853ccbae394b799e0bed281c2843708d2d622e599fffc536babf5c
-
SHA512
e372318f61d4f92f94300f7554cb1f7e7464c2d4685db37e9973e636d4382c1d5c4bd7117015884214bd7e1ac1d685784b66cb98ae99d724807cb8dc325ada4d
-
SSDEEP
196608:9xnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:DNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ca8e51235853ccbae394b799e0bed281c2843708d2d622e599fffc536babf5c.exe"C:\Users\Admin\AppData\Local\Temp\3ca8e51235853ccbae394b799e0bed281c2843708d2d622e599fffc536babf5c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E0AP3.tmp\3ca8e51235853ccbae394b799e0bed281c2843708d2d622e599fffc536babf5c.tmp"C:\Users\Admin\AppData\Local\Temp\is-E0AP3.tmp\3ca8e51235853ccbae394b799e0bed281c2843708d2d622e599fffc536babf5c.tmp" /SL5="$60196,7025884,54272,C:\Users\Admin\AppData\Local\Temp\3ca8e51235853ccbae394b799e0bed281c2843708d2d622e599fffc536babf5c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
969KB
MD5a04a684330ac4fad7178d06fd151ea4a
SHA116e2df72aa4b48ecee668fe4d5f837ba2da64619
SHA256d7ada160a59190ffb8e0ae37da6fdbcd7d0f86491caed326c3c1132062aea79f
SHA512450e5df13c3732c105ed14414088790710bf728c11b8bcf37e2473626ec9ca80a9227c9d5163c048092b49ce45d6d068d002d6ef13d859a93ba10fa80da200e9
-
Filesize
960KB
MD5068d7cc6e41c2c9cb212b3e555545d09
SHA1a66a65b4c8dfd53654dff074be866ffed6b5e928
SHA2564b41968811d1061a9de922cd65c3f709a2c00965dfeefa5c1cac6d85679ab545
SHA512db65892c79526a2bf9e07e741db257bc6dd2d5ffae245c55988e2271d6eb867d969d980f6c8c5f20780b5d2359c0a08f98c7c5e55a1f839a15344c273799555f
-
Filesize
865KB
MD5b027e57453b015bd21da5d99ccf6c4a8
SHA1f9a5a6783cdb100225a402cc7c2b0e8a693ec603
SHA25694a3a1457738b6020728a7eed3f0a8f90cc29029dae523ef0b4ac94461bb211f
SHA512766056680bf5e45334d703c90acb6cc1d418fe5330469b209e06d9d60cb8240edfedb6b59b65753dd753119ae66ec790759d904c4c0db7aa7e4b6b98b4fe486a
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
197KB
MD55194cb3fb580e93bfef82cec7d9b6337
SHA1b7ff4c51b4a5a775d148d9e964336a74c5ef97a1
SHA25633dde1de072429feda37f859b4ebc0dee9bab227c2a44827c706d21a566b795b
SHA5127cff0259b75e339985c2cdb3a4552c5f18f2f95c827506e2f66ce2d5b9d3ef7fa6f23c3a429183fea4d0dd2c425bbc2adee9da8c827e3122f6e63912a0ef46fd
-
Filesize
249KB
MD5ec5058339656da2b358c2e89a8286e4b
SHA10acd506477c31643de6ad108883c91eea09d07ab
SHA2566cdafda84742d9efd0f1a25b16f76c269d08f0bf004b471d8ff08b59767f2cd9
SHA512f352c5d4ef0e30842144a19fc9973eb5f703cc6a074c5d35ff0adc4368f856a02837b7c3c2679041f84ba625978da5a560c87a9f6ace12476d7534109481674a
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB