Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 01:10
Static task
static1
Behavioral task
behavioral1
Sample
0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe
Resource
win10-20231129-en
General
-
Target
0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe
-
Size
6.9MB
-
MD5
9c61d38fd9c85bb00d18bfe03bb7d437
-
SHA1
70520013c0d5dfaeb0c695c0b38e04a12843078b
-
SHA256
0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f
-
SHA512
0d05b6e935d34c8408144fc7fd465e34ab3ba8b425d937e074af6ba70050c034b7f6373238cf4b1464678e5ec5e3cd0921ee7bab26c6c1d203b546ed65beaebb
-
SSDEEP
196608:uK2+nNevvWstwr2m5BmycyEbSfasepd5e4x6+AjZ6mjxzj:uDY6tiP3myRfzepXe4ny8gxzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 876 crtgame.exe 528 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.49.94.194 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-2NEP1.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-UCJGP.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KM5ET.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RS9LF.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2794I.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IGFAV.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-7G01E.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-A5344.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-RKVKQ.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-15O8F.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-M7380.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-ROU5B.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JEO0B.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NJ69G.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-9CQC3.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-FEBJH.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8D956.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\is-U5G9C.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-LI9S4.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9U1CD.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OH3MS.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0GDMU.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2FSDR.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-HD1CP.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SDJRA.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-P2K5B.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-6IQMP.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0U0LR.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5EALM.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-01EEB.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6MG3R.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FIPUN.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IA9BM.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-B6RJI.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-G1FLP.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MIBFP.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6TIPM.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5VM2V.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RPO2K.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-T0KAC.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-F96L5.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2FU4H.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0BSNN.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5QTLD.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IM4RN.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9G0A2.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FF3BT.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8OIFA.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FNO2O.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-J21U6.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OS639.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-TUHS1.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JGOJA.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SB14B.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-066GD.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-P7E68.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-M3OI9.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-94VRR.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-F4KRA.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2FGLC.tmp 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 5012 wrote to memory of 1404 5012 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe 19 PID 5012 wrote to memory of 1404 5012 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe 19 PID 5012 wrote to memory of 1404 5012 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe 19 PID 1404 wrote to memory of 1604 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 42 PID 1404 wrote to memory of 1604 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 42 PID 1404 wrote to memory of 1604 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 42 PID 1404 wrote to memory of 876 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 40 PID 1404 wrote to memory of 876 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 40 PID 1404 wrote to memory of 876 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 40 PID 1404 wrote to memory of 1824 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 39 PID 1404 wrote to memory of 1824 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 39 PID 1404 wrote to memory of 1824 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 39 PID 1404 wrote to memory of 528 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 38 PID 1404 wrote to memory of 528 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 38 PID 1404 wrote to memory of 528 1404 0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp 38 PID 1824 wrote to memory of 3596 1824 net.exe 37 PID 1824 wrote to memory of 3596 1824 net.exe 37 PID 1824 wrote to memory of 3596 1824 net.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe"C:\Users\Admin\AppData\Local\Temp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\is-HK2PV.tmp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp"C:\Users\Admin\AppData\Local\Temp\is-HK2PV.tmp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp" /SL5="$70204,6991381,54272,C:\Users\Admin\AppData\Local\Temp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:528
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:1824
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:876
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1604
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵PID:3596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230KB
MD5e07e9360df78867c5ac2184d0a8df39d
SHA1a27657bbe2e772d55f065e995d9c898030410bd1
SHA2564a97066a135f1104aa29d27aea47df29c84fb35660de7fdeeaafead6fc01516a
SHA51292cb713798f39ad82678358b9be0e6339665410b1fd3cce36ef50d843030ba0093b1f402c27c4b04430d0a71ebd245df7528d9729e0dd654b1a179edd731e41a
-
Filesize
182KB
MD5470dad8fa97025e690c2e3b1eab204c3
SHA1ff5156ff9c3937566e06b94a8a8a4f950de99617
SHA256df610dcc49fffcea7c0beef6e6579ecd0a026bf2c8eb0b6b4cd469fa3855f689
SHA5125fd9927864eedfd42576c55bf1b846e50bbb55eb21d1bdcb08fa5b1226816204c76064e2bfd044587c545ff2a9e6f23c3348d7f289abe750583e186a5096b284
-
Filesize
111KB
MD56f141b3c8b6dc4b6047ba7ab98426b10
SHA1cd7121338a4e13649774c15151f385d9ff33e87f
SHA256320912b59d8d0b0e0a69e76c0c880606effb4acaba0cd038156999e7e955597b
SHA51267bd18256fb7b71e419f7ff02185f8db7340ed5472992849be314d46ba17ed3291d9b96b73cc555b18dcf56746d62ce1f47f6beecf6742f7f47b92022d42c154
-
C:\Users\Admin\AppData\Local\Temp\is-HK2PV.tmp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp
Filesize136KB
MD5293be1ef7fb17890318a2174bf404291
SHA1ec15f6fcd17e30e4bacc341cbb99b1db99f69c0e
SHA256d928e63187e789feb3fc4d3520d7f45751c7581e31d8b5424e9383ae794f7bb1
SHA512f1e6928f924d799e43e870cab29188b35c0094da9fa312458dbbefbf4973d8630fde4e81105d3245552754cd8e66af2f8b498628dd938a562f888c39f14b84b4
-
C:\Users\Admin\AppData\Local\Temp\is-HK2PV.tmp\0ee36379f0055593c91e8c6536546a19056efe622d7973a9d13f99c3bddc085f.tmp
Filesize144KB
MD574be442719edefa207cfd65685b096b0
SHA185035e2cbf106e5edd57ef75b8b5fcb904a00f4a
SHA256f0ac718fb0bceb7ab81c6adb637fe831ac1e00290db2f8549dce6fef24758187
SHA51271203df7a304694e9ad4fe87e0301bdea1f695323c7bbe3426f6b4d6295e14340194091381ed49757439068c66dde030e45b35f073689c420a2eee95d7807a5d
-
Filesize
1KB
MD530f56d3dcdbb4cee25cac7637364c580
SHA199fb8bc836254b3d273fde24225fdecbfbf58253
SHA25624925300046609e14788b5a383ecbf2b11eeb555bc8b2f99ed0729cf904e0128
SHA512183246d537305beb844dc9e9b62f400f7a565b38f014cf31962c373be5fff892b48dfeb59a552a15b94dee7d687c2bedcc3e283194a9e4244183e7bca1a1f121
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303