Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 00:46
General
-
Target
9eebda5d0e05687ceae354b8fe51e62c490ec94d50a1320abb4fb7f6fcb3a4ee.exe
-
Size
6.9MB
-
MD5
2503d3dc1b61de8c144bae8001353bba
-
SHA1
35a40804755eab099b60d0b1da436d496b8eaf49
-
SHA256
9eebda5d0e05687ceae354b8fe51e62c490ec94d50a1320abb4fb7f6fcb3a4ee
-
SHA512
8f427a0356df8f52728ea8417167dcc9a7c50fab687389fe32d59435733dfe850df328bf1035283ed4a8a77c5214defa8cee6f1006f675c2b45fb5bfc934be60
-
SSDEEP
98304:9+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:gz25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eebda5d0e05687ceae354b8fe51e62c490ec94d50a1320abb4fb7f6fcb3a4ee.exe"C:\Users\Admin\AppData\Local\Temp\9eebda5d0e05687ceae354b8fe51e62c490ec94d50a1320abb4fb7f6fcb3a4ee.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DE321.tmp\9eebda5d0e05687ceae354b8fe51e62c490ec94d50a1320abb4fb7f6fcb3a4ee.tmp"C:\Users\Admin\AppData\Local\Temp\is-DE321.tmp\9eebda5d0e05687ceae354b8fe51e62c490ec94d50a1320abb4fb7f6fcb3a4ee.tmp" /SL5="$70200,6985375,54272,C:\Users\Admin\AppData\Local\Temp\9eebda5d0e05687ceae354b8fe51e62c490ec94d50a1320abb4fb7f6fcb3a4ee.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187KB
MD5ac6c31904cfe1411dc7ecaafaff391c2
SHA1f2f1f7b99e76ff6d8a36423dbd5e0198d8f675fd
SHA256502e7856db5da76ac7f63c0285a4a21d2182842b7b84dd168599302cc872f767
SHA51269839e0be2961741e0de767c55640b18e51e9ef0694c5544cb82d79cd088c420f46a209c56acc3185f5704b77b3679a214a257d0da1333eeac89d777401c8ed1
-
Filesize
149KB
MD554a0d4586e61c7230c54fdf8c8e29b17
SHA1ff255fffe1646f443a34104f7b4c52f06969ccbf
SHA2560e5e71e91e2dee578382fbcee61ad9a60aa335024822c78798c99b89e1233e17
SHA512b6d1a72e251f0ebc8a327ee9e00f74a7d1615428a69f3732c26fecd5a6045e5af3d79cd55a13e2710162e6cc65412587387f8f00c9e549b28e46b529f1ca83de
-
Filesize
159KB
MD54ba2becb46459efe8b300967c5d5b450
SHA1f536c4dffb0e9b5abaf2adcaa1633115970e1379
SHA25613b51ceda23c9325e3c00b2f89c7a3e2e184635e33036ab58f086d86e37c5a78
SHA5123f684832e0a35573ff68c30c1294f4892af8d39c208fff456233f961d963bf8c51cb532384c0777a3b4f451f8e7269b085ec13cbaf71adaed199cab1e7eb1771
-
Filesize
55KB
MD5cf425fa40765c3918932482b8c2bdad9
SHA13f141868fc2370dd41e0e9a503bdbe95b2a79c40
SHA2564ba8595103197be3ff6bca6450ffff6bbc7e06bb862df125eef7322e611c1957
SHA512a84d48437adac6a4c8db77d9962a98b20f1af996ef8c56c9f834f7593e7144a4e2ad0f4ec4bbed2cbde8e9fafc699f8fb8fc7c42efc4a86cf969d10d458d6553
-
Filesize
39KB
MD51cf83c194179870e5de25566d4230b3c
SHA1f1dabfbc078172c636327eaaeae2963728ab2d4a
SHA256ecdf0b3dd8532d263152140b82b0ad27070c7fe330bd2ae6ecd3607a47f430b3
SHA512f07099b5f0761373fc101ab3b7b4f9af8e414f931f1a49ff7bc9f4302a2c5b5f3bbcbd9b95f6e973a467f123501c22858117c0dda1a8e04636953d08ee779d12
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
644KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
644KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB