Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
arch:x64arch:x86image:win10v2004-20231201-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.exe
Resource
win10v2004-20231201-en
General
-
Target
08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.exe
-
Size
6.9MB
-
MD5
cc22b5e38aecdffc8a3b833e5f119039
-
SHA1
740ac43f61e3ce877252ca4f892b78d1008fdce0
-
SHA256
08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322
-
SHA512
2c2c873df288c7d7b6c44a8964a12de92449ff5b92cf90c8470288f0045a6a9e2c4fec43632f9de9e0ae636c285ba572e88deaa03549b0483001dd0a7810e757
-
SSDEEP
98304:G+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:7z25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 5064 crtgame.exe 2248 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\bin\x86\is-J1TLO.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GDVAE.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-6P7TI.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-UHMII.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OTU10.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9I59A.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-7N96Q.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2NBGK.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2U194.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GGAOV.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H5PVC.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8F1M3.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8D7F2.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IPNVB.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-C8UCP.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LK104.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-SR3OR.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9MDD9.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-M7QMN.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IKPB7.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-G7TGT.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MS323.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-7V9U7.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0CMQ6.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-Q0RC4.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-V5NDR.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-NUK5V.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-F9J5A.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-K1T8J.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-TTLAU.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CQ2GM.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JTRIK.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DU90S.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CHATR.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AOOB7.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LIEA8.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-C3G4O.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4H429.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-UB9LO.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4J5FB.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8MIR8.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-R929A.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-28A2V.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-7DEKS.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-V6J20.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LNGOR.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5FKRF.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LHBPM.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-FODMB.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DUA97.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-VG1LA.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-S5AF8.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\is-B7NVK.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-O63RJ.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-RQ8KF.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-E2SF7.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-GPR89.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KEUGC.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-1HC2D.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RCISD.tmp 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4168 wrote to memory of 3156 4168 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.exe 19 PID 4168 wrote to memory of 3156 4168 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.exe 19 PID 4168 wrote to memory of 3156 4168 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.exe 19 PID 3156 wrote to memory of 4708 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 38 PID 3156 wrote to memory of 4708 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 38 PID 3156 wrote to memory of 4708 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 38 PID 3156 wrote to memory of 5064 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 36 PID 3156 wrote to memory of 5064 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 36 PID 3156 wrote to memory of 5064 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 36 PID 3156 wrote to memory of 2336 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 35 PID 3156 wrote to memory of 2336 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 35 PID 3156 wrote to memory of 2336 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 35 PID 3156 wrote to memory of 2248 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 33 PID 3156 wrote to memory of 2248 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 33 PID 3156 wrote to memory of 2248 3156 08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp 33 PID 2336 wrote to memory of 2716 2336 net.exe 34 PID 2336 wrote to memory of 2716 2336 net.exe 34 PID 2336 wrote to memory of 2716 2336 net.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.exe"C:\Users\Admin\AppData\Local\Temp\08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\is-PPLQU.tmp\08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp"C:\Users\Admin\AppData\Local\Temp\is-PPLQU.tmp\08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp" /SL5="$8006A,6985375,54272,C:\Users\Admin\AppData\Local\Temp\08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:2248
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:2336
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:5064
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:4708
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5dcfca3f8c3fff073398066fcc003ef68
SHA110c1e574cb87a5f5b13a33bf9bc648d8d0279fcf
SHA256f4f21c84f6fd5cf55e24aa46bd39aa956a86945c28925d9dc93849383770628d
SHA5121004ccdeaa373c0d6ddbfc54bd33062288c02abe18a29fdba9f707e6df55c4637fb96d6bccd83eb7aa1896ddcf4debd97390694699dd9d42fa46bd87821b78a6
-
Filesize
1KB
MD58e50645041d3f8130b990d4ba99f791a
SHA13201efe4be256f3bd061ec7a87d56e282628a612
SHA2562c4cf631925717d793597caeb1557f84e0dbd91e0cd827b5071838feb5a93c9e
SHA512929f9159b5d14df82bdad3e11bddc40a3313986d4de971832a799c0207afe61a93d16408e3978d28a974287f9216cddd0d8a8227361a409e39d97fb9a4000741
-
Filesize
194KB
MD50d8d0682d8755b0013d70d7a11690108
SHA1359148958c4d98227b074eaf3ba9dfeed586f674
SHA256ebbf8729a496766972fdccf7e166e6a7cfe2d872281e9fc145ab8ec504cbc76f
SHA512f3b4327a69c0195b5ada081baa8bc48100e9f764f12f1504c453fb152318ce7376c039af87278f32cfc068065939526eb46dad70be72a0851ffee466e3a0f3f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-PPLQU.tmp\08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp
Filesize64KB
MD551c33e9596de92f526b0f54fc3f64a98
SHA1ab1389f9a5dfa0b02f5fd7edcee29bf240ba8be6
SHA256f9447f91e7bb104d0f37f1870a388fd7fe359f6b649f1a27fe767e9962fee345
SHA5122ddd4a10853b53201445140d9e17ab0a2a35e0635a76c3cf8ce34dbc8ae7a59bc6ce2306f97a8c88e6dd5ec5da781315c133c363f6c728d5d53585f06df386a5
-
C:\Users\Admin\AppData\Local\Temp\is-PPLQU.tmp\08268606d4a8a10025d1a717e8fec526ce9ec4e61010d9c3be60fc8ea1789322.tmp
Filesize71KB
MD5ca2cd5e230016f978f91b1c0babb1936
SHA102dc85a62f0a2e44bdfb42c4b52731e2b9cdb0dc
SHA256479c1bb0213de433e77698080f106a035db261ea53e3eee989099a9b51d06c2e
SHA512662410af4ea7443f0c4a573ed80cd99c65e552504d5035beda4ff8cf410a8329da0fab46673e7fa2fbc795c4c04c0c570333199b58866e3025c88d50bcd823f3