Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2023, 20:41
Static task
static1
Behavioral task
behavioral1
Sample
8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe
Resource
win10v2004-20231130-en
General
-
Target
8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe
-
Size
6.9MB
-
MD5
181ddc1e41eeaa0d8746b6bd91c596f9
-
SHA1
803cf6866f4001ed78537ead1c9fd5be621e5fa1
-
SHA256
8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468
-
SHA512
43a0fe920edd41eb6f98e52634649fa6e27f939c4e0ab35b12c25456fa840497ed3b364e0f8cc70cef4eafc49cdfc3fb355c3ffd3d747fc6f52e98897a9545f3
-
SSDEEP
196608:aSnj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:aSjumV+jHUodIjk5VzfE9Awzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 3956 crtgame.exe 3612 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 141.98.234.31 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\stuff\is-Q21GT.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-K7O7Q.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SA3SS.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0M0L0.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-63SD1.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BRETA.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-P2IDH.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-K05HH.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RSK7K.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2EHBL.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GLVAG.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4PDH1.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-59TST.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-9O1E5.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DB3R6.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-CG02M.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ISK8T.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JRLL4.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MGPUE.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-489AC.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NMVD2.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6L3SE.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9CV4G.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2NMF6.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2DNUQ.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-0TOUV.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\is-IRCKS.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-1R8A2.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-7D9T0.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MARMT.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DDJH2.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SIEB6.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5R936.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NFVU0.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MQF8P.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-Q5LCP.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-GBUS3.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JUFF0.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-B2797.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-G1E0A.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4T5GF.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3VS0S.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-7EEJJ.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-V3UQH.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6HOTO.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KML9R.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CHM9B.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-05IH4.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-6F4FM.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-47D3K.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-Q2U8H.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-Q6DRR.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GEV4Q.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-R3NI7.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GEJ20.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4K3CI.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5S77I.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-132HD.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-648KN.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H2PL5.tmp 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2800 2976 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe 19 PID 2976 wrote to memory of 2800 2976 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe 19 PID 2976 wrote to memory of 2800 2976 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe 19 PID 2800 wrote to memory of 1312 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 36 PID 2800 wrote to memory of 1312 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 36 PID 2800 wrote to memory of 1312 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 36 PID 2800 wrote to memory of 3956 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 30 PID 2800 wrote to memory of 3956 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 30 PID 2800 wrote to memory of 3956 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 30 PID 2800 wrote to memory of 5068 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 34 PID 2800 wrote to memory of 5068 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 34 PID 2800 wrote to memory of 5068 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 34 PID 2800 wrote to memory of 3612 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 33 PID 2800 wrote to memory of 3612 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 33 PID 2800 wrote to memory of 3612 2800 8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp 33 PID 5068 wrote to memory of 3504 5068 net.exe 32 PID 5068 wrote to memory of 3504 5068 net.exe 32 PID 5068 wrote to memory of 3504 5068 net.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe"C:\Users\Admin\AppData\Local\Temp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\is-BOAPV.tmp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp"C:\Users\Admin\AppData\Local\Temp\is-BOAPV.tmp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp" /SL5="$9011E,6998999,54272,C:\Users\Admin\AppData\Local\Temp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:3956
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:3612
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:5068
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1312
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵PID:3504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD545be26bae6ef4817b818437b2ee070c9
SHA1c3af0395c8413fc492d2c615aeab51d61c3475b8
SHA2563a3a16f0598ccfc5d76cdce4ec28fbc0cd35c8fcd7b665715d0d0e32f3f725de
SHA512541f129b81b708bf0d7ea04a4488cfc7ceec4d81080e98a91fd1b81969897996a0ed895f98cb9afecff63466eefdadbe519fff53ee91d4cfee93d9d8a8c24590
-
Filesize
74KB
MD50a325260b436c67e334477d3f577c4d5
SHA12dff833a1fbf7c4e0c06a3012b11fe1715ebd661
SHA256ee9360d503df5e7b50e1b2f298e26d334f25933f716b44e479f378927bce57f6
SHA512dc6b54e2da57926af73e4567cce9424f4e7a88a78a16be1e94c16862dd186066552be20a1c35a277a21ec1e302fff02e97627348b0d55ad5fc71ed0c2d068ba9
-
Filesize
78KB
MD5da77751b81c3dd3bedae1a9ff649ea4b
SHA1071608af2e1a66e42e292c3b3bed2e9b33f20edf
SHA2568b024ad9ed6b5798bd6fc1fdb786d43f55f36963dcd4eb9186d3a7be8bef30df
SHA512921b66cef1448b464dc1c0a46629b7e66d629a037ea169dccd9647135eabc8089c5be67b804eb36387f14493fe2fd424afb633ff3a2af286064b48cb8666c282
-
C:\Users\Admin\AppData\Local\Temp\is-BOAPV.tmp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp
Filesize69KB
MD59b82bd05a816dcae55999dd28860e733
SHA1879f43869a7c90f8c5dcd3dff9a2ca5e4df9f792
SHA2561b745f5525b661016d839a389ea1c9915e67b8c248b92bf77d613fb5f049a651
SHA512900a6167a4d55aba9b03b78d9699c43dc91d2b18512e2d0173a0b314ec89aa0f14d011476676969393545b118b09f95621e4080999724404c94edaa53d6945f2
-
C:\Users\Admin\AppData\Local\Temp\is-BOAPV.tmp\8d9e7f76b51d431f39fc70293207caea779cc397062c6b5c403b842dbbb9e468.tmp
Filesize64KB
MD516d8a852879c43b0b22f4104375e04b6
SHA12c91a5e43b463465cdda203d57e89a3a493c3bbf
SHA256fa815bbfa1bc58849e4e3a669aded28f698b5ecf777cf87a9f6d736df67e1f54
SHA512cb2fcc3feff9ada20a57887555f961e3e8b02b94bd9b2650a7d3607dde4b8b2bae48701e19e18890fba5ac1b8d239d56d54fa9d56fbe95565da2ab044b035f37
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303