Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 01:32
General
-
Target
d1ec144ea5d2fe662f0db1507fb1c9b1f97f50d2c19e3e265a0c3ad41c72e6e7.exe
-
Size
6.9MB
-
MD5
f9fdd23a29569cec4014f6f37fd13786
-
SHA1
ffb4acbdc894371f5f33190fa3a1f7f6ef050c5b
-
SHA256
d1ec144ea5d2fe662f0db1507fb1c9b1f97f50d2c19e3e265a0c3ad41c72e6e7
-
SHA512
dba1b599d0e0d0fa1e2515a2397b877fb4f7cf13c4a05da5be5f18477166024d250b96508b8410bec730965eb8c5b5171351b6cb2a45679e1add9a436c159a10
-
SSDEEP
196608:qxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:SNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1ec144ea5d2fe662f0db1507fb1c9b1f97f50d2c19e3e265a0c3ad41c72e6e7.exe"C:\Users\Admin\AppData\Local\Temp\d1ec144ea5d2fe662f0db1507fb1c9b1f97f50d2c19e3e265a0c3ad41c72e6e7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0CUKL.tmp\d1ec144ea5d2fe662f0db1507fb1c9b1f97f50d2c19e3e265a0c3ad41c72e6e7.tmp"C:\Users\Admin\AppData\Local\Temp\is-0CUKL.tmp\d1ec144ea5d2fe662f0db1507fb1c9b1f97f50d2c19e3e265a0c3ad41c72e6e7.tmp" /SL5="$80206,7025884,54272,C:\Users\Admin\AppData\Local\Temp\d1ec144ea5d2fe662f0db1507fb1c9b1f97f50d2c19e3e265a0c3ad41c72e6e7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD50775453f730b1eaedfddfc6438c5e800
SHA1cdb6dee2fa0f58cbf0db6575cbd212b9b26081fe
SHA256d6519d0227f4c6fac23f97bc9d1cc595db249c97468190c0d1e1cde73dacda4f
SHA5120de01d125e01936c32e810fe6e8650328626a8d1aaf8c31740fc86a362f66569b7d7a25e0cdd98094f03dfc4e0374776617c9eaf5cf2d83eadeaf3d215d65d80
-
Filesize
707KB
MD52f0a454ee623c771ae6b94f7f9e4bbdb
SHA1c438b5b38a21b67579eed02e468a7ca8c44161b5
SHA2563538ed377a75d369935abc733f0c49247c93e6ca464dedd0d2e3bfd5e393103a
SHA51212626600c88824a588d14f9102d5edce7d0b37a2aac47ffc8bfbd1368b84ef78d002f4132fc2021d1425afc2b96ad19cf3f361b5b471558c382d6d14f00a1cba
-
Filesize
531KB
MD5d54ebae806accd71b09fc006d5222f4e
SHA11ef91e76a19476b32987ea2e26f616c4330fea62
SHA256bed219ab40170c69217c2984ccd93172ce6d9df3438abff4707b9dfad1d4a49c
SHA51254acdc759f324e29fddd294aef5f7c45b639b7d5e426b113af9bb97f0d807d4499458663258b9e7d218b421b54bf33a96e59653eb8d0d9aa8bea28635d1515ee
-
Filesize
499KB
MD5b2677ebd7484c7cc2a3ec8456b3f75a4
SHA16efaa4040d2eddd810163bbf2911d6e469a474c7
SHA2568cfa4b9cb1d489fdaabf867b18134e41cb143105b222e4788eb7b6ab7bfa357e
SHA512dc56397f02ca095b8a16b71af67e3a2deebc70bb6e2c8ef859d694c368c3db49ca2b3f3fd54f3c2a5d2650e305d13f7ac5a1342f05a6c137f2a44745254845ff
-
Filesize
419KB
MD5d008a0f4c23d814745e4735675295a0a
SHA13f639abbc056a2687281cf4ce3048aaecb68b82f
SHA256c1772412431c04cda09957ee176a58da27d552eec8cb0345016e63e02586b818
SHA5121fc2dbecde8449bb4694f1d7a5c00de1630f9a4632e0f3b96476c8d2a0d41d752b03dc25448694141e6de0bd604b477a1733f2ad26a197bf7958a0bfd523b31f
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
648KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB