Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    131s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11/12/2023, 03:53

General

  • Target

    ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe

  • Size

    6.9MB

  • MD5

    e9713c4b36d86aaa6bd7b254352d770b

  • SHA1

    f28da7b1c81ff9dbbdb9528c24fd7a12101437f1

  • SHA256

    ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0

  • SHA512

    8ef0187d12641a4e8d24816a88e9ca8d974d36eec6f2adf517be1786c9e850b1bd41b7f0cf4ea89c9c5e1c175024486b0b6320c3a69776a44f1cc3340b5b7262

  • SSDEEP

    196608:IxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:gNztzQlcDPXus98d9Jzj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe
    "C:\Users\Admin\AppData\Local\Temp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Users\Admin\AppData\Local\Temp\is-NE1R0.tmp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NE1R0.tmp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp" /SL5="$50232,7025884,54272,C:\Users\Admin\AppData\Local\Temp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:968
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:1196
        • C:\Program Files (x86)\CRTGame\crtgame.exe
          "C:\Program Files (x86)\CRTGame\crtgame.exe" -i
          3⤵
          • Executes dropped EXE
          PID:764
        • C:\Program Files (x86)\CRTGame\crtgame.exe
          "C:\Program Files (x86)\CRTGame\crtgame.exe" -s
          3⤵
          • Executes dropped EXE
          PID:964
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 10
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3520
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 10
            4⤵
              PID:2952

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\CRTGame\crtgame.exe

        Filesize

        1014KB

        MD5

        08609199175866a85da9c455ee9357b0

        SHA1

        db1964716ca3bfdba31c604e06717c62beb4b15f

        SHA256

        2c62b2d2ea994ec2d653d1d0d6c46b9e62d9d3d261038b54590f2d20d2ba9a38

        SHA512

        a3f0e5a670522c51b8686c83dda6676d83239c39cdba91749bb2af1200f7ed85eb2a9a599dd1977936516d61783f253c9f83b748879d0b933a33f27ba647f1b6

      • C:\Program Files (x86)\CRTGame\crtgame.exe

        Filesize

        849KB

        MD5

        0cb5cd067556a4bfee2283863be2b56e

        SHA1

        df3e17cd15b3cc2748dbdef981a01d5086a9917a

        SHA256

        d5ac26b3814fcbf3f5fd5909866ecf50da8b384b7f8569c0a8bf240766069de9

        SHA512

        90e12df2f7afd3e826d28df3b5345ebe7b275708d4ae2b18104f2b80896b89a3b60bb8dbd9f5badbdb444388ef335e68986bd4ee466657735db841fc43ab4690

      • C:\Program Files (x86)\CRTGame\crtgame.exe

        Filesize

        148KB

        MD5

        3514b8b38d1266f6112172886ef66b6b

        SHA1

        cd478bd9f806d78a7a825d07446a4fe9ef133853

        SHA256

        c135163747fe1dc8966decbfae2e2a655be11f73a80a00b5e9d5755f16bb85fa

        SHA512

        474fe69306e11993702565932c46823fcf45eb4b12bf8332c19a9879a9a2e23893d29d01c1c2b56ac5e0dd95bf806b58a44410d456ef30e4caee43999eeff94c

      • C:\Users\Admin\AppData\Local\Temp\is-NE1R0.tmp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp

        Filesize

        409KB

        MD5

        a7ac20e2edd9718ec6085977fd258e8b

        SHA1

        578bd803babd5fba2235247d7458c360b489c155

        SHA256

        fc28fdfccc688e1d8ba4b3e407b45423db4967f3cfbb05f2b5ca93983869c43c

        SHA512

        1086d77ba43f4bc8599f66d507deed7c30fadae8e522a65bf75bb095e5759f20fcec8a3f19cce4fd29a746e33def2eb71a91614e0f3bf48c53ad0b7a96121dce

      • C:\Users\Admin\AppData\Local\Temp\is-NE1R0.tmp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp

        Filesize

        208KB

        MD5

        9cb13216c34fd841d6c5a3d5813e1842

        SHA1

        81d156f8f49107f7bdc4488b4b5e9ce630f61340

        SHA256

        4b6c924bf5a2fcea80a7b175dcd01e02e7b04bc3c54b983aea8e2197a19100cd

        SHA512

        7378b71274a65715676444f4407dd01582985b94e564526e4d7ad160061c5dcdd9e9278c533caaa3ce869cc22076e1c0f566a4496426340a8eaf01ebec441335

      • \Users\Admin\AppData\Local\Temp\is-K72A7.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • \Users\Admin\AppData\Local\Temp\is-K72A7.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • memory/764-153-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/764-150-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/764-151-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/764-154-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-160-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-187-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-157-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-207-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-204-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-201-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-197-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-164-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-165-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-168-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-171-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-174-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-178-0x0000000000860000-0x0000000000902000-memory.dmp

        Filesize

        648KB

      • memory/964-177-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-181-0x0000000000860000-0x0000000000902000-memory.dmp

        Filesize

        648KB

      • memory/964-184-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-194-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/964-188-0x0000000000860000-0x0000000000902000-memory.dmp

        Filesize

        648KB

      • memory/964-191-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

      • memory/968-6-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/968-161-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/968-159-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

      • memory/1644-0-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/1644-158-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB