Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 02:24
Static task
static1
Behavioral task
behavioral1
Sample
f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.exe
Resource
win10-20231129-en
General
-
Target
f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.exe
-
Size
6.9MB
-
MD5
9a8c603eb92ed0e689b9a35452bd9a39
-
SHA1
947982b95b8cb8b0834b7da57a5cdecd729e3b6e
-
SHA256
f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c
-
SHA512
62b7e160007a069b9aabc149a7dbd577f5f98a1839d18f72ecb380989cfad031c8e7e35d846ba856e7b53072ed034593db49b8a595c3f7f7eb37755f7bad9ca1
-
SSDEEP
98304:E+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:9z25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 1996 crtgame.exe 652 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 Destination IP 194.49.94.194 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\stuff\is-SH8MC.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MVAFG.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AMDIF.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-S557G.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5Q1PM.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GU25N.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0NKO6.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-P4BCK.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KCDKA.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-PR3KH.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-V8EC2.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JH9AH.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LB978.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8GLR0.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-20E4K.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4R2U3.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CUNQD.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-PC803.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5GBDO.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FL2O6.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-46HMU.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-86PSV.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-1I2JB.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AU20U.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6PG7S.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8C2OE.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5GGGT.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BF3ET.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RINTF.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-J4PTT.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-QP7K4.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-DT00R.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-APQHO.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-I2JLS.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DN2GG.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-STVOD.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-L5UFQ.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-POKQB.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CM9BN.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IU00N.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MCNNU.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-HBCSC.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-EVP9H.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-VDLDG.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-URRIB.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LII00.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-VL3MA.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-171RR.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ITGHN.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-97MJV.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FNJH2.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8EETQ.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DR2RH.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-N1MR8.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-TI8FM.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\is-NI7QI.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-U4L96.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-2P2CJ.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H6KCS.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-20473.tmp f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3664 wrote to memory of 4744 3664 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.exe 74 PID 3664 wrote to memory of 4744 3664 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.exe 74 PID 3664 wrote to memory of 4744 3664 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.exe 74 PID 4744 wrote to memory of 2712 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 75 PID 4744 wrote to memory of 2712 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 75 PID 4744 wrote to memory of 2712 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 75 PID 4744 wrote to memory of 1996 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 76 PID 4744 wrote to memory of 1996 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 76 PID 4744 wrote to memory of 1996 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 76 PID 4744 wrote to memory of 5072 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 80 PID 4744 wrote to memory of 5072 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 80 PID 4744 wrote to memory of 5072 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 80 PID 4744 wrote to memory of 652 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 78 PID 4744 wrote to memory of 652 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 78 PID 4744 wrote to memory of 652 4744 f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp 78 PID 5072 wrote to memory of 1264 5072 net.exe 81 PID 5072 wrote to memory of 1264 5072 net.exe 81 PID 5072 wrote to memory of 1264 5072 net.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.exe"C:\Users\Admin\AppData\Local\Temp\f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\is-DCP3V.tmp\f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp"C:\Users\Admin\AppData\Local\Temp\is-DCP3V.tmp\f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp" /SL5="$40242,6985375,54272,C:\Users\Admin\AppData\Local\Temp\f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:2712
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:1996
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:652
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵PID:1264
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
813KB
MD5b11d51ee7f40df28bc4dd910d931442d
SHA1d35521c2bc43992b48b87dc5176c53d8090e64e2
SHA256a580416bcf54add2a3f60704459e90517d024d61ca7504565b2f5e501cfe6b0d
SHA512bb6e8567d42afe6f895bdb629dba939b5d00311302c87be762ebf99961cd4953e6c8cf77d1fb11b2522c4b06ef9d9eaacfe91cfc2861b734b42962e5a4cf3503
-
Filesize
449KB
MD572be25dfa9207a5e0a29e2e712ef08a5
SHA1426d83421bf8d696dde36b6453e514df04014885
SHA256cfd5456833086c3696f70c7c2cabe0578d7bdf9972048d2a6ce00a7833434fca
SHA512facc22621a393de18d2d4fbab907ecae671c7a497be1db9be25e5122970b8c151e10825752ece50dbd87a49d099d8bf738999cfaae6269556b55124563c5727c
-
Filesize
529KB
MD53d141ab72cdc31dc62cb414ce8c81288
SHA1031207782e2af8e6f9ed360082076b029317c4d7
SHA25642481d5820d64293418de5a53826696801b9fba9340ce2e608091c48ee5ff88d
SHA512ee86bb665fdcc123adb7ef6688a84d3528b8ef13e9d94c751ec4563f2cbc283c79d1531a4ea55108faf483f001cfa0eee4d9bf6e1374e28a2ccf1453760e5697
-
C:\Users\Admin\AppData\Local\Temp\is-DCP3V.tmp\f15063de3b71ef8b1b61f54bdb3490b6439b80c5ba26885d874fa4c7e3b8167c.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303