Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 04:18
Static task
static1
Behavioral task
behavioral1
Sample
2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.exe
Resource
win10-20231020-en
General
-
Target
2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.exe
-
Size
6.9MB
-
MD5
01e2705ed3f7cc09492a06378e04f571
-
SHA1
35525c8db3f1996831a81e115d7d1b2568b4ed27
-
SHA256
2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5
-
SHA512
24554ca4a7ad6e6433e5e3c70e63e9cf744bb0a4300b6d78a2c686a7ce5163f94ca846e1fbd37861ccb4e88df8de0d57bf02d9598d0dcf9694445166f037e6ab
-
SSDEEP
196608:7Snj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:7SjumV+jHUodIjk5VzfE9Awzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 4188 crtgame.exe 2324 crtgame.exe -
Loads dropped DLL 3 IoCs
pid Process 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\bin\x86\is-F7VL9.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-J12B8.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NJP7P.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-HCG87.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JKTEJ.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8P00N.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9QF07.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-2IC0B.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-QMM0N.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-64UMN.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\is-PE7RB.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LINTR.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-25PKR.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-J5LQJ.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-B05L3.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-F6R86.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-KGQBL.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SIB25.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-07202.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DD8UG.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SKL97.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-UNEM5.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9VQ76.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NISJJ.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5JJ88.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9NE6I.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LMNKM.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-B9VGJ.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-1HNN4.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BECSS.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-M5UEL.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-RF894.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-8H9SP.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NOS3B.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-S06F4.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4099P.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QQBMR.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-6L51N.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DH15Q.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OTTSL.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-C0NO7.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ODQH8.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-NQRCF.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-EP246.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-11L5R.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GGPEG.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MO3RH.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-PNUM5.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-S7SRP.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CB9AU.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-EOV02.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-KMK6R.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SM8UU.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9Q1GG.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-B4BQ1.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SVL7T.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GT86H.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-HMFQK.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-N2KLD.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JVLBE.tmp 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3832 wrote to memory of 2604 3832 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.exe 71 PID 3832 wrote to memory of 2604 3832 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.exe 71 PID 3832 wrote to memory of 2604 3832 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.exe 71 PID 2604 wrote to memory of 2268 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 72 PID 2604 wrote to memory of 2268 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 72 PID 2604 wrote to memory of 2268 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 72 PID 2604 wrote to memory of 4188 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 74 PID 2604 wrote to memory of 4188 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 74 PID 2604 wrote to memory of 4188 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 74 PID 2604 wrote to memory of 4296 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 77 PID 2604 wrote to memory of 4296 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 77 PID 2604 wrote to memory of 4296 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 77 PID 2604 wrote to memory of 2324 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 76 PID 2604 wrote to memory of 2324 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 76 PID 2604 wrote to memory of 2324 2604 2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp 76 PID 4296 wrote to memory of 3520 4296 net.exe 78 PID 4296 wrote to memory of 3520 4296 net.exe 78 PID 4296 wrote to memory of 3520 4296 net.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.exe"C:\Users\Admin\AppData\Local\Temp\2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\is-8RUAD.tmp\2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp"C:\Users\Admin\AppData\Local\Temp\is-8RUAD.tmp\2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp" /SL5="$80224,6998999,54272,C:\Users\Admin\AppData\Local\Temp\2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:2268
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:4188
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:2324
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 104⤵PID:3520
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
362KB
MD5ef3da5725558078df41e528ce8ab2118
SHA1d373eb682b11c2d4d583f1cf60c95a2ba2534ec9
SHA2560dd0ac0fdf5b9bc82af972f24cf4e9dbbe7b5a34163774f77fe52a38b184a612
SHA512cc870b84f727b69ac1cef5dbfd224df041a7285b9074706b1642e87c491977799b44fc983870167a9fbe3b3854e85dc1dfeb9ee80a2341a54c5c4ee1602628ca
-
Filesize
303KB
MD5f32b482f6e9b33c44eeed2340998d337
SHA1a10fc9f8232cd0bc9e661b3240ab808bab6dbae6
SHA2568d6cbf11f68c7970b4765fc2016d5f643c439c863ea47b194f518bd74d741307
SHA512f3fdf08f3c3c33b829368178e87aca799ce82385f4362e7a6e8f8d1d09a6d3ab21bcda02a68f75c8263a0763c334af81da08448003b3e81971b3d310a9dfbfa9
-
Filesize
222KB
MD5fcb552334c0d81e5f5de50d558ffd414
SHA1a70f6c98f83eee470388938f93e0633c4072e5d7
SHA256f7f2436339908d7e4a3f28f992e8c4b2817d648a3596eb9b0eff54b370116be4
SHA512976b8a35cec40a4d5770e68f1411789a4223313557093c769165087042fcf985b055a9862f65d82d08281a058cf5a5a4a062f9cecaf0260e920cc0b340160237
-
C:\Users\Admin\AppData\Local\Temp\is-8RUAD.tmp\2d5f74d9f565f3da2375856b098a55df43e1e002335561ab1e779766fe4c20a5.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303