Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2023, 20:41

General

  • Target

    8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe

  • Size

    6.9MB

  • MD5

    181ddc1e41eeaa0d8746b6bd91c596f9

  • SHA1

    803cf6866f4001ed78537ead1c9fd5be621e5fa1

  • SHA256

    8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468

  • SHA512

    43a0fe920edd41eb6f98e52634649fa6e27f939c4e0ab35b12c25456fa840497ed3b364e0f8cc70cef4eafc49cdfc3fb355c3ffd3d747fc6f52e98897a9545f3

  • SSDEEP

    196608:aSnj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:aSjumV+jHUodIjk5VzfE9Awzj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe
    "C:\Users\Admin\AppData\Local\Temp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\is-BOAPV.tmp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BOAPV.tmp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp" /SL5="$9011E,6998999,54272,C:\Users\Admin\AppData\Local\Temp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Program Files (x86)\CRTGame\crtgame.exe
        "C:\Program Files (x86)\CRTGame\crtgame.exe" -i
        3⤵
        • Executes dropped EXE
        PID:3956
      • C:\Program Files (x86)\CRTGame\crtgame.exe
        "C:\Program Files (x86)\CRTGame\crtgame.exe" -s
        3⤵
        • Executes dropped EXE
        PID:3612
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" helpmsg 10
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5068
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:1312
    • C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 10
      1⤵
        PID:3504

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\CRTGame\crtgame.exe

        Filesize

        53KB

        MD5

        45be26bae6ef4817b818437b2ee070c9

        SHA1

        c3af0395c8413fc492d2c615aeab51d61c3475b8

        SHA256

        3a3a16f0598ccfc5d76cdce4ec28fbc0cd35c8fcd7b665715d0d0e32f3f725de

        SHA512

        541f129b81b708bf0d7ea04a4488cfc7ceec4d81080e98a91fd1b81969897996a0ed895f98cb9afecff63466eefdadbe519fff53ee91d4cfee93d9d8a8c24590

      • C:\Program Files (x86)\CRTGame\crtgame.exe

        Filesize

        74KB

        MD5

        0a325260b436c67e334477d3f577c4d5

        SHA1

        2dff833a1fbf7c4e0c06a3012b11fe1715ebd661

        SHA256

        ee9360d503df5e7b50e1b2f298e26d334f25933f716b44e479f378927bce57f6

        SHA512

        dc6b54e2da57926af73e4567cce9424f4e7a88a78a16be1e94c16862dd186066552be20a1c35a277a21ec1e302fff02e97627348b0d55ad5fc71ed0c2d068ba9

      • C:\Program Files (x86)\CRTGame\crtgame.exe

        Filesize

        78KB

        MD5

        da77751b81c3dd3bedae1a9ff649ea4b

        SHA1

        071608af2e1a66e42e292c3b3bed2e9b33f20edf

        SHA256

        8b024ad9ed6b5798bd6fc1fdb786d43f55f36963dcd4eb9186d3a7be8bef30df

        SHA512

        921b66cef1448b464dc1c0a46629b7e66d629a037ea169dccd9647135eabc8089c5be67b804eb36387f14493fe2fd424afb633ff3a2af286064b48cb8666c282

      • C:\Users\Admin\AppData\Local\Temp\is-BOAPV.tmp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp

        Filesize

        69KB

        MD5

        9b82bd05a816dcae55999dd28860e733

        SHA1

        879f43869a7c90f8c5dcd3dff9a2ca5e4df9f792

        SHA256

        1b745f5525b661016d839a389ea1c9915e67b8c248b92bf77d613fb5f049a651

        SHA512

        900a6167a4d55aba9b03b78d9699c43dc91d2b18512e2d0173a0b314ec89aa0f14d011476676969393545b118b09f95621e4080999724404c94edaa53d6945f2

      • C:\Users\Admin\AppData\Local\Temp\is-BOAPV.tmp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp

        Filesize

        64KB

        MD5

        16d8a852879c43b0b22f4104375e04b6

        SHA1

        2c91a5e43b463465cdda203d57e89a3a493c3bbf

        SHA256

        fa815bbfa1bc58849e4e3a669aded28f698b5ecf777cf87a9f6d736df67e1f54

        SHA512

        cb2fcc3feff9ada20a57887555f961e3e8b02b94bd9b2650a7d3607dde4b8b2bae48701e19e18890fba5ac1b8d239d56d54fa9d56fbe95565da2ab044b035f37

      • C:\Users\Admin\AppData\Local\Temp\is-PB35D.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • C:\Users\Admin\AppData\Local\Temp\is-PB35D.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • memory/2800-163-0x00000000020F0000-0x00000000020F1000-memory.dmp

        Filesize

        4KB

      • memory/2800-161-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

      • memory/2800-10-0x00000000020F0000-0x00000000020F1000-memory.dmp

        Filesize

        4KB

      • memory/2976-0-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/2976-2-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/2976-160-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3612-186-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-183-0x0000000000910000-0x00000000009B1000-memory.dmp

        Filesize

        644KB

      • memory/3612-157-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-159-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-162-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-208-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-167-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-166-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-170-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-173-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-176-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-205-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-182-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-178-0x0000000000910000-0x00000000009B1000-memory.dmp

        Filesize

        644KB

      • memory/3612-202-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-189-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-190-0x0000000000910000-0x00000000009B1000-memory.dmp

        Filesize

        644KB

      • memory/3612-193-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-196-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3612-199-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3956-152-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3956-151-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

      • memory/3956-155-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB