Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
arch:x64arch:x86image:win10v2004-20231201-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 03:36
Static task
static1
Behavioral task
behavioral1
Sample
46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.exe
Resource
win10v2004-20231201-en
General
-
Target
46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.exe
-
Size
6.9MB
-
MD5
61f0895b5326ccec05acf92872edaeda
-
SHA1
b201cb42aca3e67841d324f85d66ef969f4bb77d
-
SHA256
46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df
-
SHA512
2b57a6d499e6136136968767842dc2f9b46e4dcc88b2d603d8f1db688f53a0d13c0beceecd5988cfd7e930e91c01f4a41a6279d8c4179d670f4a243c4db959a9
-
SSDEEP
98304:X+koiRLFdsODKUdFxQ8k618KzAYYC9z3Bbgtev25o40nsZJjNw5MQNiEU4P5EKHl:Oz25G6bV1yYDuZxCWQNhUU2uNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 3196 crtgame.exe 4868 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.49.94.194 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\bin\x86\is-KL1GE.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-LB7NG.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-S8MU8.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5L2E9.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BON2M.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-49030.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-TA9C7.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ICOQS.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ALOE0.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4EPOR.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6QRK8.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-O018G.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6VVPM.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AOI53.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-PE086.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-E5892.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-IHODT.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-R7JF5.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-HACRB.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-03AUL.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NFTUG.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DDDCO.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AO3CQ.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KPN27.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-E7QTQ.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LIRBD.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4RA77.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RMQN0.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-VLE3T.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KD3K4.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6JM8K.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MVQUB.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-HTA04.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NC81V.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FM1QC.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\is-CPL1K.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-TPDK4.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-7RHAE.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3QKOP.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FHAH1.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4D1J0.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0MJ26.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-348VD.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KUE08.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-V3UAB.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-QG7K8.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DG816.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SOS1A.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CS5G0.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-AJI11.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6KV3B.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-531MN.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0CQMQ.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-2U756.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4MQCF.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-I88VJ.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NRSSM.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-R1ODC.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-A66CQ.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-95IUE.tmp 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2908 wrote to memory of 1740 2908 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.exe 87 PID 2908 wrote to memory of 1740 2908 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.exe 87 PID 2908 wrote to memory of 1740 2908 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.exe 87 PID 1740 wrote to memory of 2420 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 91 PID 1740 wrote to memory of 2420 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 91 PID 1740 wrote to memory of 2420 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 91 PID 1740 wrote to memory of 3196 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 93 PID 1740 wrote to memory of 3196 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 93 PID 1740 wrote to memory of 3196 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 93 PID 1740 wrote to memory of 4324 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 94 PID 1740 wrote to memory of 4324 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 94 PID 1740 wrote to memory of 4324 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 94 PID 1740 wrote to memory of 4868 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 96 PID 1740 wrote to memory of 4868 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 96 PID 1740 wrote to memory of 4868 1740 46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp 96 PID 4324 wrote to memory of 3960 4324 net.exe 97 PID 4324 wrote to memory of 3960 4324 net.exe 97 PID 4324 wrote to memory of 3960 4324 net.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.exe"C:\Users\Admin\AppData\Local\Temp\46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\is-81AKR.tmp\46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp"C:\Users\Admin\AppData\Local\Temp\is-81AKR.tmp\46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp" /SL5="$500EC,6985375,54272,C:\Users\Admin\AppData\Local\Temp\46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:2420
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:3196
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵PID:3960
-
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:4868
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD51136a41f500b13b6a816c6af6b557f10
SHA1e747467f5c7e70b2698cd82d89f4fb399549a3cb
SHA2560918f440806323a446d8f7dfeccceaae20c91fa20764f7e8837946d3ca2e2675
SHA512bccdfcd59905ed18aaa1ec0b9882c7923fbf027abaf5246516300118cbca917c05083c158570052cc6f89b292bfa00ceba2e2207c75b0f87285873cff95ea79a
-
Filesize
742KB
MD570a20a2f37242d7cfe32f6db40c14825
SHA1549d112ab54f701c2aecaa070e9dfa54572034ef
SHA256ec43472008920c761ae0e5a21d1ee9fa1273249aec3b665e13d1973eddb6b7cf
SHA5122fc656aa9a4f1ec64ecb099735e22e18ba2d54d36afc290badeb6687ec729a6998527a1ca84c188989e6b5611eeeef021accf9d0b11662b6e4a31ef0bc894802
-
Filesize
771KB
MD5c4e71505082e5727c55021f6db5d61fe
SHA16865b6350c00c3d30796462cd66dc53f42ab9f9c
SHA256b9f3c4d14656134c75849d49052976a5cd49a97a4d6a0cd6bdc87dd333f8d406
SHA5121dc1cd52590dc517133cfebc64f7228eab5704bc38b6713ed31721ea6222b2bf9e6ab9d0822d608bc1607f4dcf19013f90aa4a05b4a24b91ab9e69a5b057be9e
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-81AKR.tmp\46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp
Filesize563KB
MD55c860c5e33914f2821d0972e2cff499f
SHA17099b8892503dcc4eaae565aeb90def4131c1213
SHA256533d28857dc3379112e2bf8dbf19ea49ec43498463cfa16a2139906b45e08853
SHA51244d4b14c194025961f6fd52644b101e06bbdbab3a62efc4835ace88ff54599b78baada4459ba28bb29059a8892a0c408ef6e2e9671988bd8f9b68defae647f7c
-
C:\Users\Admin\AppData\Local\Temp\is-81AKR.tmp\46fd09ce9047cfb9f948d3d20da65f4e908e0977588b12616002157732b8e3df.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4