Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2023, 20:49

General

  • Target

    848e42821c34f75a19403551a2b3c4bd5c0ba64fd42aad77a625d95b14357f84.exe

  • Size

    6.9MB

  • MD5

    79991fc2e1757121caba6c507a2dc2ec

  • SHA1

    5caf6298bf342e1b94d0a6e8369c46a3c76d6eb7

  • SHA256

    848e42821c34f75a19403551a2b3c4bd5c0ba64fd42aad77a625d95b14357f84

  • SHA512

    ae67455035bc25604b33416bf93ae6ff57d9fe0506c0dd1f30ed8b71c2896a4ecd6e72d81056d05548fa46be6266a0e11281e82274e179a68a570beb7f9fe179

  • SSDEEP

    196608:6A89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:iBmakyVnlUQ7Wz3Tv1jNTh0zj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\848e42821c34f75a19403551a2b3c4bd5c0ba64fd42aad77a625d95b14357f84.exe
    "C:\Users\Admin\AppData\Local\Temp\848e42821c34f75a19403551a2b3c4bd5c0ba64fd42aad77a625d95b14357f84.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Users\Admin\AppData\Local\Temp\is-FIACC.tmp\848e42821c34f75a19403551a2b3c4bd5c0ba64fd42aad77a625d95b14357f84.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FIACC.tmp\848e42821c34f75a19403551a2b3c4bd5c0ba64fd42aad77a625d95b14357f84.tmp" /SL5="$B0042,6977575,54272,C:\Users\Admin\AppData\Local\Temp\848e42821c34f75a19403551a2b3c4bd5c0ba64fd42aad77a625d95b14357f84.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:732
        • C:\Program Files (x86)\CRTGame\crtgame.exe
          "C:\Program Files (x86)\CRTGame\crtgame.exe" -i
          3⤵
          • Executes dropped EXE
          PID:3976
        • C:\Program Files (x86)\CRTGame\crtgame.exe
          "C:\Program Files (x86)\CRTGame\crtgame.exe" -s
          3⤵
          • Executes dropped EXE
          PID:4488
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 10
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2748
    • C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 10
      1⤵
        PID:4484

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\CRTGame\crtgame.exe

        Filesize

        238KB

        MD5

        f242d64b201a4a626498d96955e244c0

        SHA1

        74d454badd6058a03fc4bafae605a770743f26d3

        SHA256

        30befa30eb56ebf0e2c740e3afe2c046e8f18854835277b44d69f5ff7f28c8cc

        SHA512

        a8ae42e51278dd6bf35ca18279206cb67b89f59630880be08f462b0da06e60fbf477b714eb9fa657a01202a1d0fd7ce291954e79b3a8b7e368e70cc026ff5897

      • C:\Program Files (x86)\CRTGame\crtgame.exe

        Filesize

        251KB

        MD5

        ce188580e0c5bf0c206046ccabd961b2

        SHA1

        9c60e76853dfade9064f0874f576a84f054e2d0b

        SHA256

        2790528352e1dff52e37fe6c253177fd2b0353b95a0ebff8e98a17bbe3f68483

        SHA512

        1075a750332936538a11ab4cee025b76807842b93d4cb79d91c887d6fe48f015b0e201febd8bd5c45ca8648102c1092bc611701ea79d0912cdba78199f799403

      • C:\Program Files (x86)\CRTGame\crtgame.exe

        Filesize

        112KB

        MD5

        a541e3ccd588926650f2303ad66aac94

        SHA1

        74a588198ec9c9031afa0d7de60952804117f204

        SHA256

        dcb959ff702ff76148d0810553f9cd68c5d7ee825aa6282b9855f2f13abc7875

        SHA512

        b3cf3c9f1dfa9ea154c762b15814ae2dad6170ab6216d746d85488dfaf0467f1c35fc8d8461df76b777e6f5678ea1eabcb2a73ec14cb0fd7c0b19265bf16b41c

      • C:\Users\Admin\AppData\Local\Temp\is-6CF25.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • C:\Users\Admin\AppData\Local\Temp\is-6CF25.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • C:\Users\Admin\AppData\Local\Temp\is-FIACC.tmp\848e42821c34f75a19403551a2b3c4bd5c0ba64fd42aad77a625d95b14357f84.tmp

        Filesize

        310KB

        MD5

        07a0d98dcc0f444515805327440e1bd6

        SHA1

        c1eacb3d0eedc7ca89253ccf1f2541ef996ed900

        SHA256

        0cadc0007ac533276f4301fd4c73ad488f5540c0337787d345e42188c0837ad6

        SHA512

        874dbc3339c0783a525f17a91998e1b5fda477a28caf4c649dfe2fb8e28a1e11ae06d9b3f293651a395a21add85c875da49f86df7f10ff7417b39f5ab5959eb2

      • C:\Users\Admin\AppData\Local\Temp\is-FIACC.tmp\848e42821c34f75a19403551a2b3c4bd5c0ba64fd42aad77a625d95b14357f84.tmp

        Filesize

        367KB

        MD5

        8efc45be5ff4f8c06b017d5ce226ec42

        SHA1

        228c283946a42d377491c2d4c6d783b1f2de022c

        SHA256

        0e9a7207afb4aa74426dfd81e1ba3558c6ad74a84898bc52c5c53f5acf9d2545

        SHA512

        2a3bb265e091c421b87635d6b4aa111e9e8fc905397860ebed1dc6e80b6e363df2f8de0a2da4a85c6321fd3f46901975d7ea35dc00950143f06015ca8fe06679

      • memory/1524-0-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/1524-159-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/1524-2-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3976-151-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/3976-152-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/3976-154-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/3976-155-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4360-162-0x0000000002340000-0x0000000002341000-memory.dmp

        Filesize

        4KB

      • memory/4360-7-0x0000000002340000-0x0000000002341000-memory.dmp

        Filesize

        4KB

      • memory/4360-160-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

      • memory/4488-178-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-180-0x00000000008A0000-0x0000000000942000-memory.dmp

        Filesize

        648KB

      • memory/4488-165-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-166-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-169-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-172-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-175-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-179-0x00000000008A0000-0x0000000000942000-memory.dmp

        Filesize

        648KB

      • memory/4488-158-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-161-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-185-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-188-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-189-0x00000000008A0000-0x0000000000942000-memory.dmp

        Filesize

        648KB

      • memory/4488-192-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-195-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-198-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-202-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-205-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/4488-208-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB