Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
53s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10/12/2023, 21:07
General
-
Target
08115ea90224f85403b0b13c118ce61b242b5a14ee338e2e09a93f3f4d5d4c23.exe
-
Size
6.9MB
-
MD5
7cdc2c1365699b9205b864e5120ba12a
-
SHA1
10994fb85df4ffcf1ea6bacf9a9fc3b8247bf83c
-
SHA256
08115ea90224f85403b0b13c118ce61b242b5a14ee338e2e09a93f3f4d5d4c23
-
SHA512
f2afeebc532b495ac959a8225603b6f60dd766eedf2e871327d0dbf37c34ba8552cd5d19e401378449458fb74d37fd20392b94d0373369c080609dcb12a2ea1d
-
SSDEEP
196608:vxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:VNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\08115ea90224f85403b0b13c118ce61b242b5a14ee338e2e09a93f3f4d5d4c23.exe"C:\Users\Admin\AppData\Local\Temp\08115ea90224f85403b0b13c118ce61b242b5a14ee338e2e09a93f3f4d5d4c23.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DOJEJ.tmp\08115ea90224f85403b0b13c118ce61b242b5a14ee338e2e09a93f3f4d5d4c23.tmp"C:\Users\Admin\AppData\Local\Temp\is-DOJEJ.tmp\08115ea90224f85403b0b13c118ce61b242b5a14ee338e2e09a93f3f4d5d4c23.tmp" /SL5="$80068,7025884,54272,C:\Users\Admin\AppData\Local\Temp\08115ea90224f85403b0b13c118ce61b242b5a14ee338e2e09a93f3f4d5d4c23.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD583d708f2f117505a97374dbdff571bbc
SHA17ca8e73fa2bd6f5c035be55b80472cc909667620
SHA2566e17305aae7f803450305214c6d5ef2ecb7a80f723d57cdb0bfc58b7b1d0eb5d
SHA512a1db79542fce0edc2d972ba437859cc53b2aca462f5859f3c7ea60e624b57ac411e3092762fab950364e8118221da103ce71ea1a2c4008e2aba914a67bc8c006
-
Filesize
180KB
MD544d34cb00da103e0feb3420e9b0c5e38
SHA1c62f1bce70bee7d97f93e4676ad076c6b08cc12e
SHA256d3bfa210b2f20941a6e784fe0141617ca832e04308c14f301f51da0fb4f00332
SHA5120d50918b07a4459842d0f276861ff83092d3993f65194a8d4fc90819f22cd07ba3f39c82ccf3dd4c4806911355944f6d101a94494cc2eec324926f1d35212fc6
-
Filesize
63KB
MD5e05131d7ed64269a3645b4d061f251ab
SHA1e0816452dfd1a1474cda45d96a9d07aecc5b8095
SHA25694edbf7e0c44544833f274aa66b3a5a0a39cd3514f97f0fe6829236d72e2a201
SHA512274907c4345d18fd72c1a9071b09e961a735e55056f16625a34dacda4ae755476aa6cb832d5704195643dfb9f8a3306959f8e60c2eb12eb1db1214d245171cd2
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
193KB
MD51fb97aa32abe8da1c07af0137ffc2769
SHA1452cf5fe4d91258a7929f3088770704dac371ee5
SHA2565992bcdc4311e69eac20499a91136d9ff6e68d205ab022f4dba1f6c625267c72
SHA51274a14edc998244a50d9b75dc06df7fe57d79de10de63fd958d63c3e4f0cad1ceb66fa8509f7545095e17418c841b7f4760a6b9c0a174931a114776ab75ce8afd
-
Filesize
40KB
MD51242a0847703232bbd420976993e2469
SHA1745431adba7b67059f9fa33987f5058b46ede5c5
SHA2566cff3c28e8eb01ba404d8d4ffda58254e2ef10019848b3b2d068809827c7bdf9
SHA512e664b33cd8cbb0bc8018f9cff5ddf783c4bb6b456a7ccb6f36383704578f97ee1ccf11a2cdf44453f606924f957584114caf83fcefb9038795c8673bb60ff38d
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB