Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 03:53
Static task
static1
Behavioral task
behavioral1
Sample
ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe
Resource
win10-20231020-en
General
-
Target
ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe
-
Size
6.9MB
-
MD5
e9713c4b36d86aaa6bd7b254352d770b
-
SHA1
f28da7b1c81ff9dbbdb9528c24fd7a12101437f1
-
SHA256
ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0
-
SHA512
8ef0187d12641a4e8d24816a88e9ca8d974d36eec6f2adf517be1786c9e850b1bd41b7f0cf4ea89c9c5e1c175024486b0b6320c3a69776a44f1cc3340b5b7262
-
SSDEEP
196608:IxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:gNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 764 crtgame.exe 964 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 81.31.197.38 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\bin\x86\is-N5MMC.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-A1E60.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5T42I.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-VHUSQ.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5NJ3B.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BJM2H.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GBPRS.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-1NF13.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-O2Q84.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-63V4F.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4FFMS.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OKNJR.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-N446M.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5050P.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-839GJ.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MTOOR.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-LRHKS.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-052FR.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-EVRIQ.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-INIE0.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-1BJD6.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-D7OA1.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-081VQ.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-TT8D9.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-HLGAS.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-L0613.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\is-IGAOQ.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-TU276.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-MKT5J.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-33ONR.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-AN8CH.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-HVC7Q.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-3TPDA.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-I0U8V.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SJVI1.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6EQNJ.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-62HBM.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-A4COV.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-DM6DT.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RSBVS.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-POTSJ.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0QFRM.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QHE82.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-CJF72.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SO16H.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KM7EM.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H88RJ.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CJ5R3.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GEGH6.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-245CU.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-21ADE.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0G1EP.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-M89VA.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-U8BGN.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0Q062.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-L2CG5.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8VKCA.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-05AJ3.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DO1C2.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-15JI9.tmp ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1644 wrote to memory of 968 1644 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe 71 PID 1644 wrote to memory of 968 1644 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe 71 PID 1644 wrote to memory of 968 1644 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe 71 PID 968 wrote to memory of 1196 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 72 PID 968 wrote to memory of 1196 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 72 PID 968 wrote to memory of 1196 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 72 PID 968 wrote to memory of 764 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 73 PID 968 wrote to memory of 764 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 73 PID 968 wrote to memory of 764 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 73 PID 968 wrote to memory of 3520 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 77 PID 968 wrote to memory of 3520 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 77 PID 968 wrote to memory of 3520 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 77 PID 968 wrote to memory of 964 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 75 PID 968 wrote to memory of 964 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 75 PID 968 wrote to memory of 964 968 ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp 75 PID 3520 wrote to memory of 2952 3520 net.exe 78 PID 3520 wrote to memory of 2952 3520 net.exe 78 PID 3520 wrote to memory of 2952 3520 net.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe"C:\Users\Admin\AppData\Local\Temp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\is-NE1R0.tmp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp"C:\Users\Admin\AppData\Local\Temp\is-NE1R0.tmp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp" /SL5="$50232,7025884,54272,C:\Users\Admin\AppData\Local\Temp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1196
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:764
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:964
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵PID:2952
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1014KB
MD508609199175866a85da9c455ee9357b0
SHA1db1964716ca3bfdba31c604e06717c62beb4b15f
SHA2562c62b2d2ea994ec2d653d1d0d6c46b9e62d9d3d261038b54590f2d20d2ba9a38
SHA512a3f0e5a670522c51b8686c83dda6676d83239c39cdba91749bb2af1200f7ed85eb2a9a599dd1977936516d61783f253c9f83b748879d0b933a33f27ba647f1b6
-
Filesize
849KB
MD50cb5cd067556a4bfee2283863be2b56e
SHA1df3e17cd15b3cc2748dbdef981a01d5086a9917a
SHA256d5ac26b3814fcbf3f5fd5909866ecf50da8b384b7f8569c0a8bf240766069de9
SHA51290e12df2f7afd3e826d28df3b5345ebe7b275708d4ae2b18104f2b80896b89a3b60bb8dbd9f5badbdb444388ef335e68986bd4ee466657735db841fc43ab4690
-
Filesize
148KB
MD53514b8b38d1266f6112172886ef66b6b
SHA1cd478bd9f806d78a7a825d07446a4fe9ef133853
SHA256c135163747fe1dc8966decbfae2e2a655be11f73a80a00b5e9d5755f16bb85fa
SHA512474fe69306e11993702565932c46823fcf45eb4b12bf8332c19a9879a9a2e23893d29d01c1c2b56ac5e0dd95bf806b58a44410d456ef30e4caee43999eeff94c
-
C:\Users\Admin\AppData\Local\Temp\is-NE1R0.tmp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp
Filesize409KB
MD5a7ac20e2edd9718ec6085977fd258e8b
SHA1578bd803babd5fba2235247d7458c360b489c155
SHA256fc28fdfccc688e1d8ba4b3e407b45423db4967f3cfbb05f2b5ca93983869c43c
SHA5121086d77ba43f4bc8599f66d507deed7c30fadae8e522a65bf75bb095e5759f20fcec8a3f19cce4fd29a746e33def2eb71a91614e0f3bf48c53ad0b7a96121dce
-
C:\Users\Admin\AppData\Local\Temp\is-NE1R0.tmp\ccef751e1897fab3a6332f52955f910678227139da78d933b1813c63b35eabc0.tmp
Filesize208KB
MD59cb13216c34fd841d6c5a3d5813e1842
SHA181d156f8f49107f7bdc4488b4b5e9ce630f61340
SHA2564b6c924bf5a2fcea80a7b175dcd01e02e7b04bc3c54b983aea8e2197a19100cd
SHA5127378b71274a65715676444f4407dd01582985b94e564526e4d7ad160061c5dcdd9e9278c533caaa3ce869cc22076e1c0f566a4496426340a8eaf01ebec441335
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303