Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

dridex

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2023, 19:33 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac01bc744187b74a5f0ed17a7544d9a3d910fbc23625bf7b86faa7d41441c5f0.exe

  • Size

    6.9MB

  • MD5

    710f75505562d2a48b06164dbbff6d1e

  • SHA1

    808c1735aac1350d40aa0dec08daf73017bbc1e2

  • SHA256

    ac01bc744187b74a5f0ed17a7544d9a3d910fbc23625bf7b86faa7d41441c5f0

  • SHA512

    3b64302d3214d1eb5bef1e30e5be3054444791bd1c24ad66a545f6c90406434864afe05e9406fda631afc001796f97a4b869883a0b9b8ec173302f8e708a8bdb

  • SSDEEP

    196608:aSnj/mmV+GsH+bNueuJRAZVAOk5Vvz+tqE9AmEkzj:aSjumV+jHUodIjk5VzfE9Awzj

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac01bc744187b74a5f0ed17a7544d9a3d910fbc23625bf7b86faa7d41441c5f0.exe
    "C:\Users\Admin\AppData\Local\Temp\ac01bc744187b74a5f0ed17a7544d9a3d910fbc23625bf7b86faa7d41441c5f0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Users\Admin\AppData\Local\Temp\is-MNNIU.tmp\ac01bc744187b74a5f0ed17a7544d9a3d910fbc23625bf7b86faa7d41441c5f0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MNNIU.tmp\ac01bc744187b74a5f0ed17a7544d9a3d910fbc23625bf7b86faa7d41441c5f0.tmp" /SL5="$70090,6998999,54272,C:\Users\Admin\AppData\Local\Temp\ac01bc744187b74a5f0ed17a7544d9a3d910fbc23625bf7b86faa7d41441c5f0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:4312
        • C:\Program Files (x86)\CRTGame\crtgame.exe
          "C:\Program Files (x86)\CRTGame\crtgame.exe" -i
          3⤵
          • Executes dropped EXE
          PID:1168
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 10
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3288
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 10
            4⤵
              PID:4268
          • C:\Program Files (x86)\CRTGame\crtgame.exe
            "C:\Program Files (x86)\CRTGame\crtgame.exe" -s
            3⤵
            • Executes dropped EXE
            PID:3640

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        148.177.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        148.177.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        2.136.104.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.136.104.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.154.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.154.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        205.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.178.17.96.in-addr.arpa
        IN PTR
        Response
        205.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-205deploystaticakamaitechnologiescom
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.a-0001.a-msedge.net
        g-bing-com.a-0001.a-msedge.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
      • flag-us
        DNS
        167.109.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        167.109.18.2.in-addr.arpa
        IN PTR
        Response
        167.109.18.2.in-addr.arpa
        IN PTR
        a2-18-109-167deploystaticakamaitechnologiescom
      • flag-us
        DNS
        167.109.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        167.109.18.2.in-addr.arpa
        IN PTR
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ebf29fc4c2c043fd8bc365d56f7382fa&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ebf29fc4c2c043fd8bc365d56f7382fa&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=0CCA401E911761EF1A6853FD903060EC; domain=.bing.com; expires=Fri, 03-Jan-2025 19:33:34 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 1D19E9713E224D739B9B547E72296F2A Ref B: LON04EDGE0609 Ref C: 2023-12-10T19:33:34Z
        date: Sun, 10 Dec 2023 19:33:34 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ebf29fc4c2c043fd8bc365d56f7382fa&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ebf29fc4c2c043fd8bc365d56f7382fa&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=0CCA401E911761EF1A6853FD903060EC
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: C7968941BD824D8CB180FB01B34FED65 Ref B: LON04EDGE0609 Ref C: 2023-12-10T19:33:34Z
        date: Sun, 10 Dec 2023 19:33:34 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ebf29fc4c2c043fd8bc365d56f7382fa&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ebf29fc4c2c043fd8bc365d56f7382fa&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=0CCA401E911761EF1A6853FD903060EC
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 8AF25DF594F449B999B357CCF9718609 Ref B: LON04EDGE0609 Ref C: 2023-12-10T19:33:34Z
        date: Sun, 10 Dec 2023 19:33:34 GMT
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301480_1GLUO11W92SWCVMG3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301480_1GLUO11W92SWCVMG3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 769326
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 0C7361554C40468EA3D24BBCD81DDF1A Ref B: LON04EDGE0711 Ref C: 2023-12-10T19:33:35Z
        date: Sun, 10 Dec 2023 19:33:34 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301047_1S8G2IIVJ6Z2H00N1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301047_1S8G2IIVJ6Z2H00N1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 874040
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: C6D42EEEF08845C38C01FC05B951210D Ref B: LON04EDGE0711 Ref C: 2023-12-10T19:33:35Z
        date: Sun, 10 Dec 2023 19:33:34 GMT
      • flag-us
        DNS
        200.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.197.79.204.in-addr.arpa
        IN PTR
        Response
        200.197.79.204.in-addr.arpa
        IN PTR
        a-0001a-msedgenet
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        56.126.166.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        56.126.166.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        146.78.124.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        146.78.124.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        104.241.123.92.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.241.123.92.in-addr.arpa
        IN PTR
        Response
        104.241.123.92.in-addr.arpa
        IN PTR
        a92-123-241-104deploystaticakamaitechnologiescom
      • flag-us
        DNS
        119.110.54.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        119.110.54.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        119.110.54.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        119.110.54.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        119.110.54.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        119.110.54.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        134.71.91.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        134.71.91.104.in-addr.arpa
        IN PTR
        Response
        134.71.91.104.in-addr.arpa
        IN PTR
        a104-91-71-134deploystaticakamaitechnologiescom
      • flag-us
        DNS
        178.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        178.178.17.96.in-addr.arpa
        IN PTR
        Response
        178.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-178deploystaticakamaitechnologiescom
      • flag-us
        DNS
        49.179.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        49.179.17.96.in-addr.arpa
        IN PTR
        Response
        49.179.17.96.in-addr.arpa
        IN PTR
        a96-17-179-49deploystaticakamaitechnologiescom
      • flag-us
        DNS
        157.123.68.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        157.123.68.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        140.71.91.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        140.71.91.104.in-addr.arpa
        IN PTR
        Response
        140.71.91.104.in-addr.arpa
        IN PTR
        a104-91-71-140deploystaticakamaitechnologiescom
      • flag-us
        DNS
        193.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        193.178.17.96.in-addr.arpa
        IN PTR
        Response
        193.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-193deploystaticakamaitechnologiescom
      • flag-us
        DNS
        13.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.227.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        52.179.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        52.179.17.96.in-addr.arpa
        IN PTR
        Response
        52.179.17.96.in-addr.arpa
        IN PTR
        a96-17-179-52deploystaticakamaitechnologiescom
      • flag-us
        DNS
        172.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.178.17.96.in-addr.arpa
        IN PTR
        Response
        172.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-172deploystaticakamaitechnologiescom
      • flag-us
        DNS
        26.35.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.35.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        24.73.42.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        24.73.42.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        cceufea.net
        crtgame.exe
        Remote address:
        194.49.94.194:53
        Request
        cceufea.net
        IN A
      • flag-us
        DNS
        cceufea.net
        crtgame.exe
        Remote address:
        194.49.94.194:53
        Request
        cceufea.net
        IN A
      • flag-us
        DNS
        cceufea.net
        crtgame.exe
        Remote address:
        194.49.94.194:53
        Request
        cceufea.net
        IN A
      • flag-us
        DNS
        cceufea.net
        crtgame.exe
        Remote address:
        194.49.94.194:53
        Request
        cceufea.net
        IN A
      • flag-us
        DNS
        cceufea.net
        crtgame.exe
        Remote address:
        194.49.94.194:53
        Request
        cceufea.net
        IN A
      • flag-us
        DNS
        194.94.49.194.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        194.94.49.194.in-addr.arpa
        IN PTR
        Response
      • flag-ru
        DNS
        cceufea.net
        crtgame.exe
        Remote address:
        152.89.198.214:53
        Request
        cceufea.net
        IN A
        Response
        cceufea.net
        IN A
        185.196.8.22
      • flag-us
        GET
        http://cceufea.net/click/?counter=de7ef49b2c006853fb383a753307a71431fb1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f508166429e289d5b86953e226c55f676647fc2813369d184da325a508dd800f116cf
        crtgame.exe
        Remote address:
        185.196.8.22:80
        Request
        GET /click/?counter=de7ef49b2c006853fb383a753307a71431fb1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f508166429e289d5b86953e226c55f676647fc2813369d184da325a508dd800f116cf HTTP/1.1
        Host: cceufea.net
        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.20.1
        Date: Sun, 10 Dec 2023 19:35:45 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        X-Powered-By: PHP/7.4.33
      • flag-us
        DNS
        22.8.196.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.8.196.185.in-addr.arpa
        IN PTR
        Response
        22.8.196.185.in-addr.arpa
        IN PTR
        g3fmytasteoftodaycom
      • flag-us
        DNS
        22.8.196.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.8.196.185.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        214.198.89.152.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        214.198.89.152.in-addr.arpa
        IN PTR
        Response
      • 204.79.197.200:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ebf29fc4c2c043fd8bc365d56f7382fa&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=
        tls, http2
        1.9kB
         9.2kB
         21
        17

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ebf29fc4c2c043fd8bc365d56f7382fa&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ebf29fc4c2c043fd8bc365d56f7382fa&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ebf29fc4c2c043fd8bc365d56f7382fa&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=

        HTTP Response

        204
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239317301047_1S8G2IIVJ6Z2H00N1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        tls, http2
        62.5kB
         1.7MB
         1254
        1250

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301480_1GLUO11W92SWCVMG3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301047_1S8G2IIVJ6Z2H00N1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.3kB
         16
        14
      • 185.196.8.22:80
        http://cceufea.net/click/?counter=de7ef49b2c006853fb383a753307a71431fb1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f508166429e289d5b86953e226c55f676647fc2813369d184da325a508dd800f116cf
        http
        crtgame.exe
        479 B
         352 B
         4
        3

        HTTP Request

        GET http://cceufea.net/click/?counter=de7ef49b2c006853fb383a753307a71431fb1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f508166429e289d5b86953e226c55f676647fc2813369d184da325a508dd800f116cf

        HTTP Response

        200
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        148.177.190.20.in-addr.arpa
        dns
        73 B
         159 B
         1
        1

        DNS Request

        148.177.190.20.in-addr.arpa

      • 8.8.8.8:53
        2.136.104.51.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        2.136.104.51.in-addr.arpa

      • 8.8.8.8:53
        241.154.82.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        241.154.82.20.in-addr.arpa

      • 8.8.8.8:53
        205.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        205.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        g.bing.com
        dns
        112 B
         158 B
         2
        1

        DNS Request

        g.bing.com

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        167.109.18.2.in-addr.arpa
        dns
        142 B
         135 B
         2
        1

        DNS Request

        167.109.18.2.in-addr.arpa

        DNS Request

        167.109.18.2.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         173 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        200.197.79.204.in-addr.arpa
        dns
        73 B
         106 B
         1
        1

        DNS Request

        200.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        56.126.166.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        56.126.166.20.in-addr.arpa

      • 8.8.8.8:53
        146.78.124.51.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        146.78.124.51.in-addr.arpa

      • 8.8.8.8:53
        104.241.123.92.in-addr.arpa
        dns
        73 B
         139 B
         1
        1

        DNS Request

        104.241.123.92.in-addr.arpa

      • 8.8.8.8:53
        119.110.54.20.in-addr.arpa
        dns
        216 B
         158 B
         3
        1

        DNS Request

        119.110.54.20.in-addr.arpa

        DNS Request

        119.110.54.20.in-addr.arpa

        DNS Request

        119.110.54.20.in-addr.arpa

      • 8.8.8.8:53
        134.71.91.104.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        134.71.91.104.in-addr.arpa

      • 8.8.8.8:53
        178.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        178.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        49.179.17.96.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        49.179.17.96.in-addr.arpa

      • 8.8.8.8:53
        157.123.68.40.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        157.123.68.40.in-addr.arpa

      • 8.8.8.8:53
        140.71.91.104.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        140.71.91.104.in-addr.arpa

      • 8.8.8.8:53
        193.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        193.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        13.227.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        13.227.111.52.in-addr.arpa

      • 8.8.8.8:53
        52.179.17.96.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        52.179.17.96.in-addr.arpa

      • 8.8.8.8:53
        172.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        172.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        26.35.223.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        26.35.223.20.in-addr.arpa

      • 8.8.8.8:53
        24.73.42.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        24.73.42.20.in-addr.arpa

      • 194.49.94.194:53
        cceufea.net
        dns
        crtgame.exe
        285 B
         5

        DNS Request

        cceufea.net

        DNS Request

        cceufea.net

        DNS Request

        cceufea.net

        DNS Request

        cceufea.net

        DNS Request

        cceufea.net

      • 8.8.8.8:53
        194.94.49.194.in-addr.arpa
        dns
        72 B
         132 B
         1
        1

        DNS Request

        194.94.49.194.in-addr.arpa

      • 152.89.198.214:53
        cceufea.net
        dns
        crtgame.exe
        57 B
         84 B
         1
        1

        DNS Request

        cceufea.net

        DNS Response

        185.196.8.22

      • 8.8.8.8:53
        22.8.196.185.in-addr.arpa
        dns
        142 B
         107 B
         2
        1

        DNS Request

        22.8.196.185.in-addr.arpa

        DNS Request

        22.8.196.185.in-addr.arpa

      • 8.8.8.8:53
        214.198.89.152.in-addr.arpa
        dns
        73 B
         127 B
         1
        1

        DNS Request

        214.198.89.152.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\CRTGame\crtgame.exe
        Filesize

        1.3MB

        MD5

        02e731d426a6c572a98b2b1e90ed6dbe

        SHA1

        f19f2dfdad937f0fee226688ab093c012f74d20f

        SHA256

        7f237f93818f142b8cfcc8fb34c8fea80294e22f4e86df4dcbc018fe55aff78f

        SHA512

        4ec63959eb2f520ea3190e8596c45a50af60d8da4df199cfdd53820a5e63228002107e4206f0f8f57fdf108aa25ece343f1551f4b7fe7e27cc7767768374af72

        Download Submit

      • C:\Program Files (x86)\CRTGame\crtgame.exe
        Filesize

        873KB

        MD5

        c9c37e82a94b82cd871227848820741d

        SHA1

        1d8716af31f0730dca393a4af2ac714eb4546ea8

        SHA256

        c4d883500bfb1cce78a5b87989816abc7b9beb8c8734737a6b1c41b7cbea3bab

        SHA512

        fd56b3c2cf5de869dd0bdc921d0a350c239eb0beb70970b2c3877481f9939288dd5918edaaccb55038bf9bcb8a7100b9d905d0dac6f4114507bf9a546f086219

        Download Submit

      • C:\Program Files (x86)\CRTGame\crtgame.exe
        Filesize

        221KB

        MD5

        7a4cdbe9e0542983dae2b223160c70b5

        SHA1

        683f30f3e867c9df776a953798d8d62df9bbc3c7

        SHA256

        00f29e280bfa5cd1568beff19fad531d0ca70521f0f3cab60171fee84c392b76

        SHA512

        69ab0fe65db297c73fa2bf6d7574b607a2fb6b3c27cfe90da7ae2183bd8b064f6912cdd8a494e89b56d15d037ae9f442d2706413faf9a8f870d1e2472f2c922f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-03C5B.tmp\_isetup\_iscrypt.dll
        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-03C5B.tmp\_isetup\_isdecmp.dll
        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-MNNIU.tmp\ac01bc744187b74a5f0ed17a7544d9a3d910fbc23625bf7b86faa7d41441c5f0.tmp
        Filesize

        687KB

        MD5

        f448d7f4b76e5c9c3a4eaff16a8b9b73

        SHA1

        31808f1ffa84c954376975b7cdb0007e6b762488

        SHA256

        7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49

        SHA512

        f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4

        Download Submit

      • memory/1168-151-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/1168-152-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/1168-155-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/1176-161-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

        Download

      • memory/1176-163-0x0000000002200000-0x0000000002201000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1176-10-0x0000000002200000-0x0000000002201000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3640-162-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-179-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-208-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-157-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-204-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-201-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-166-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-167-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-170-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-173-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-176-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-159-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-180-0x0000000000920000-0x00000000009C1000-memory.dmp

        Filesize

        644KB

        Download

      • memory/3640-185-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-188-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-189-0x0000000000920000-0x00000000009C1000-memory.dmp

        Filesize

        644KB

        Download

      • memory/3640-192-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-195-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3640-198-0x0000000000400000-0x000000000061B000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/4720-2-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4720-0-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4720-160-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.