Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2023, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.exe
Resource
win10v2004-20231130-en
General
-
Target
6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.exe
-
Size
6.9MB
-
MD5
0df5f442b3d31c200eed57297709c6d6
-
SHA1
4c41dfa04863b7018ae6cbfb038652189f6b0893
-
SHA256
6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1
-
SHA512
c994ccbb1a5c9b9e9adc8ecdc27956e69b201f4f4977a59bbd90971cb68a62141dd3e4b457c1842918c0a01e17f59b22b3f5dc9338d5af2590946800d0493f8b
-
SSDEEP
196608:BxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:XNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 944 crtgame.exe 1780 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\bin\x86\is-11AP0.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3JBOT.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BARUU.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-1E37K.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6IMIP.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-1339P.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8VBSF.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-DAVHH.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-C521K.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ML1LJ.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SC14V.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8AH0B.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-I9EUL.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IECCB.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IK6BT.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3GC8U.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-VNP00.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LCNJB.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-J1IBR.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AHC1L.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-4OADE.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6C9DM.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KJTA3.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-19PIM.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RIRAT.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JKAP9.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QUEQJ.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BB49M.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OUEAN.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6IBNK.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IQA1R.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5RSE2.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-I4CUI.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\is-R30R5.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9U2CH.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-O8OBB.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H07D3.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-13BHS.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AE6I9.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GE6R9.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-CPNUA.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KNCMI.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-P69M9.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LO285.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CFTHM.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-5T7CD.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-PJANU.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SAM6E.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QP0FO.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-5PIUH.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-K9MF0.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-D08PN.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-00AL1.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NR9CN.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-G3UF9.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FLNKM.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0MOC1.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ROHAD.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GVOB1.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LGL5J.tmp 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1880 wrote to memory of 4156 1880 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.exe 27 PID 1880 wrote to memory of 4156 1880 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.exe 27 PID 1880 wrote to memory of 4156 1880 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.exe 27 PID 4156 wrote to memory of 1296 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 56 PID 4156 wrote to memory of 1296 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 56 PID 4156 wrote to memory of 1296 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 56 PID 4156 wrote to memory of 944 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 54 PID 4156 wrote to memory of 944 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 54 PID 4156 wrote to memory of 944 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 54 PID 4156 wrote to memory of 4308 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 61 PID 4156 wrote to memory of 4308 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 61 PID 4156 wrote to memory of 4308 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 61 PID 4156 wrote to memory of 1780 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 60 PID 4156 wrote to memory of 1780 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 60 PID 4156 wrote to memory of 1780 4156 6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp 60 PID 4308 wrote to memory of 1744 4308 net.exe 59 PID 4308 wrote to memory of 1744 4308 net.exe 59 PID 4308 wrote to memory of 1744 4308 net.exe 59
Processes
-
C:\Users\Admin\AppData\Local\Temp\6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.exe"C:\Users\Admin\AppData\Local\Temp\6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\is-09R7C.tmp\6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp"C:\Users\Admin\AppData\Local\Temp\is-09R7C.tmp\6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp" /SL5="$9005E,7025884,54272,C:\Users\Admin\AppData\Local\Temp\6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:944
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1296
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:1780
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:4308
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵PID:1744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271KB
MD508878f35ef031f62cfbf81e81a9f19f6
SHA1b80e8e3c0d2ad4446fde0c46d2d9c40620617b44
SHA2567dfeebe24d71ee9cb8c2aa1ef3ffca3db4fd65d3a49282ec0eb6a6c961b171b8
SHA512d795adbfbf485bd74b114caec607f2d8f3e93c414465c166b66784309555dcdcb6ee81c8726cc0586fe8021c0820dc180690ffce55755943baa50a144e75e79e
-
Filesize
167KB
MD5d0931cb604a1e3b1e24ed443744d859b
SHA1a441895606987b5d1c8e6e192dbf762d41d8c005
SHA2562beb3ebe56f2c938203a42aa8adabe0b118a7205db7003b7015c5d279a448426
SHA512b55407efd4f41337aa69663a9eb6cc9c6a2ad3b230d6a7ce6c9b8dac8ba737d9e6270f727daf867b74d3b55e46e0c38008c5dcb4a9bf143d73c61aec1026843d
-
Filesize
171KB
MD595f027a535e577b6344ae29c0d1141d5
SHA13f3ed1bf7f99d7606de7eba8bf987c33b93128ed
SHA256f40fd6303e30014b38b7b0fc589ec5766d376c28abd4f46b3c951477ac26036e
SHA512ebb4b787e6f35f2fbd5ff01b62ff029e6cefa50cc51d7875eec7e9006b968a9e7440d7a58b59322ea12d606e2d1a5844880fd5870d59c65777a145943cb9d2bd
-
C:\Users\Admin\AppData\Local\Temp\is-09R7C.tmp\6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
C:\Users\Admin\AppData\Local\Temp\is-09R7C.tmp\6db09d94c9382516dedb392f4cacbcc425e976cc1a0694626174723f3a9c6fc1.tmp
Filesize676KB
MD5c22df4f47147995a3cf434aed9204c17
SHA113b9e07f1f191bf42e13fd0eeb3679e25c1c06cd
SHA25618caa88fb10e7fc72c5858dd216bc1ca18c1afacfd05ef350c6b8fe55dcf6025
SHA5120a7bf33b27b8846df5e88778d4ab83931b346896bda48ee21c91ce781cd3bf7bf4f98e6043522d8f35c7806933bf3a786031aa0bcdd7e9cddada48e2b0a3a6d7
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303