Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10/12/2023, 20:41
General
-
Target
8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe
-
Size
6.9MB
-
MD5
181ddc1e41eeaa0d8746b6bd91c596f9
-
SHA1
803cf6866f4001ed78537ead1c9fd5be621e5fa1
-
SHA256
8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468
-
SHA512
43a0fe920edd41eb6f98e52634649fa6e27f939c4e0ab35b12c25456fa840497ed3b364e0f8cc70cef4eafc49cdfc3fb355c3ffd3d747fc6f52e98897a9545f3
-
SSDEEP
196608:aSnj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:aSjumV+jHUodIjk5VzfE9Awzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe"C:\Users\Admin\AppData\Local\Temp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BOAPV.tmp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp"C:\Users\Admin\AppData\Local\Temp\is-BOAPV.tmp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp" /SL5="$9011E,6998999,54272,C:\Users\Admin\AppData\Local\Temp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD545be26bae6ef4817b818437b2ee070c9
SHA1c3af0395c8413fc492d2c615aeab51d61c3475b8
SHA2563a3a16f0598ccfc5d76cdce4ec28fbc0cd35c8fcd7b665715d0d0e32f3f725de
SHA512541f129b81b708bf0d7ea04a4488cfc7ceec4d81080e98a91fd1b81969897996a0ed895f98cb9afecff63466eefdadbe519fff53ee91d4cfee93d9d8a8c24590
-
Filesize
74KB
MD50a325260b436c67e334477d3f577c4d5
SHA12dff833a1fbf7c4e0c06a3012b11fe1715ebd661
SHA256ee9360d503df5e7b50e1b2f298e26d334f25933f716b44e479f378927bce57f6
SHA512dc6b54e2da57926af73e4567cce9424f4e7a88a78a16be1e94c16862dd186066552be20a1c35a277a21ec1e302fff02e97627348b0d55ad5fc71ed0c2d068ba9
-
Filesize
78KB
MD5da77751b81c3dd3bedae1a9ff649ea4b
SHA1071608af2e1a66e42e292c3b3bed2e9b33f20edf
SHA2568b024ad9ed6b5798bd6fc1fdb786d43f55f36963dcd4eb9186d3a7be8bef30df
SHA512921b66cef1448b464dc1c0a46629b7e66d629a037ea169dccd9647135eabc8089c5be67b804eb36387f14493fe2fd424afb633ff3a2af286064b48cb8666c282
-
Filesize
69KB
MD59b82bd05a816dcae55999dd28860e733
SHA1879f43869a7c90f8c5dcd3dff9a2ca5e4df9f792
SHA2561b745f5525b661016d839a389ea1c9915e67b8c248b92bf77d613fb5f049a651
SHA512900a6167a4d55aba9b03b78d9699c43dc91d2b18512e2d0173a0b314ec89aa0f14d011476676969393545b118b09f95621e4080999724404c94edaa53d6945f2
-
Filesize
64KB
MD516d8a852879c43b0b22f4104375e04b6
SHA12c91a5e43b463465cdda203d57e89a3a493c3bbf
SHA256fa815bbfa1bc58849e4e3a669aded28f698b5ecf777cf87a9f6d736df67e1f54
SHA512cb2fcc3feff9ada20a57887555f961e3e8b02b94bd9b2650a7d3607dde4b8b2bae48701e19e18890fba5ac1b8d239d56d54fa9d56fbe95565da2ab044b035f37
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB