Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 01:13
General
-
Target
2f25c01245490dd8e18a41f7a56c47e56c7d457791051091de90e13332d66924.exe
-
Size
6.9MB
-
MD5
b7cd1aa6446b3a3e354009ede1931e95
-
SHA1
83b57243ff5ade881baa7e79a4183c2c6cb78db5
-
SHA256
2f25c01245490dd8e18a41f7a56c47e56c7d457791051091de90e13332d66924
-
SHA512
ce673fc62a7bf81a8932a9ac60da97012128716f28332a76a8bd81f1f36d115b8e9e71c96e6fe82f39bac56af939bc8dc20b3d10bfc5976e2161f070b3ca26c6
-
SSDEEP
196608:9K2+nNevvWstwr2m5BmycyEbSfasepd5e4x6+AjZ6mjxzj:9DY6tiP3myRfzepXe4ny8gxzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f25c01245490dd8e18a41f7a56c47e56c7d457791051091de90e13332d66924.exe"C:\Users\Admin\AppData\Local\Temp\2f25c01245490dd8e18a41f7a56c47e56c7d457791051091de90e13332d66924.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AD86Q.tmp\2f25c01245490dd8e18a41f7a56c47e56c7d457791051091de90e13332d66924.tmp"C:\Users\Admin\AppData\Local\Temp\is-AD86Q.tmp\2f25c01245490dd8e18a41f7a56c47e56c7d457791051091de90e13332d66924.tmp" /SL5="$70220,6991381,54272,C:\Users\Admin\AppData\Local\Temp\2f25c01245490dd8e18a41f7a56c47e56c7d457791051091de90e13332d66924.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD590bc796195b002426ba0d31caf23d974
SHA12eec9beed1594ec3aac1e30282f71f6585f8539a
SHA256981b0bba0df631f824db9685d09960eb6f39cdb146007962610f1fe4e048f9c9
SHA5125be67feaa009d5b94457608000e4872c5943f7ff01348f007b2d133740a3c2bc2bf831c5b020f740e638e61a8d5e84da17ce21f62c2e1efd7c82295f85c8a820
-
Filesize
144KB
MD53d879d27c64e5e25a42397aa96d27c6c
SHA11b4af1719c1b3f552d83338f3abf5d70fcecc49a
SHA256b0641b7c6df6ec4bf4569d9737f9f36573d61312ef0ac979648beab3147b0980
SHA5124b577157bc155a8aa7aefa5710d1548b8a832edd6ad14180348a45e7015bc77b8bdc65696edd003c8a38a624a5ea642fa05045e71af0a02db60e512dc6dba6c4
-
Filesize
140KB
MD508a0978184067290056c403d388296ed
SHA16055915ee5b69b8c50f7f8f016c9ab3f3c2d9a17
SHA256a056c31478429312e860e2c8282bac391c6b337b5efa987e1c46419db1bf4005
SHA5126ffc8483aef13fb77de6daaae97b3b45fef1c208509331f8f6d5c53053e5746b9c197debaf54eaede4482914339b527eea7ae81ec45414b4f144c1ab9c770e6b
-
Filesize
137KB
MD58f5d90b48f3b37649470d3b318e8bf83
SHA15de4a5dc35e55b1288c7b9fc9534c0e9dbeacdd6
SHA2565616efa5d3630ea5018013d11511a7e2e2649bac3f5fc0197eea4a46343e65dd
SHA51237f7087fe07d90208f2f843d248199a4426646d11801fb79d15bda2b56d97e09ad70529ecb271c7414b6b3255c9b249cc2968a7ebed1e8ceeb1dcf611f8a292e
-
Filesize
214KB
MD57556d571999c3887d502fb1a8695c8a3
SHA196b8f537049cdafee0e158ed85ab9db40df57128
SHA2564c82c3786a4dea4619b5c15b831d6a334babdba1d476853ca65ff7a88d1d149c
SHA51299dc7e0b5afb7bfaa68cc605ec1470e6392b9bc3de6d7a4e1dbc3a9eded339f167de75f2dbc481ea25edb5a6ae96b9187ab7350115e9c6a1a6ba7650b5895744
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB