Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
12/06/2023, 11:50 UTC
General
-
Target
09000799.exe
-
Size
1.8MB
-
MD5
a8e21d0a395957079d29dab3f6d2f0c7
-
SHA1
4ded3b53f149f64298289d52a98288cc56a62005
-
SHA256
a9e2eb82a9248f900aa399ac902d78778d5391457c95e202f0e4331bf9b22b37
-
SHA512
0210430aeb6b98eed77c3cb58d25fe7948d1aa1074490d6f1799ab225e6e5ed5b9d0e6fface71332446b2b40faeb044138ea58c18530dee5bdb7aacc8f5eb046
-
SSDEEP
24576:xslcze89r3WOSPQud80RRp/8mUeUDSVXT5XLyaT7Y7gbaVD:te896Xou7Rz8mB5XT5XL1fYsbaV
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09000799.exe"C:\Users\Admin\AppData\Local\Temp\09000799.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse -
DNSflingtrainer.comRemote address:8.8.8.8:53Requestflingtrainer.comIN AResponseflingtrainer.comIN A172.67.177.160flingtrainer.comIN A104.21.35.160
-
DNS160.177.67.172.in-addr.arpaRemote address:8.8.8.8:53Request160.177.67.172.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
GEThttps://flingtrainer.com/wp-content/check-for-trainer-update/the-witcher-3-wild-hunt-trainerRemote address:172.67.177.160:443RequestGET /wp-content/check-for-trainer-update/the-witcher-3-wild-hunt-trainer HTTP/1.1
User-Agent: FLiNGTrainer
Host: flingtrainer.com
ResponseHTTP/1.1 200 OK
Date: Mon, 12 Jun 2023 11:50:24 GMT
Content-Length: 12
Connection: keep-alive
last-modified: Thu, 22 Dec 2022 13:27:16 GMT
etag: "c-5f06aa0afb78a"
accept-ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FNqxFTDTlRmBj7SA8yjWhfPTeLT3k%2FqRpZgJlRazOo765mzdXzPa6eazFNARD9exmLTwGS0BTNtKTiZFDjJdyHuTCufj0qKLKbMFD3hdpGqZnu22TWglMZuBLY8rf5w3RHbs"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7d61e041b94b1c93-AMS
alt-svc: h3=":443"; ma=86400
-
DNS149.220.183.52.in-addr.arpaRemote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
GEThttps://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-updateRemote address:172.67.177.160:443RequestGET /wp-content/check-for-trainer-update/get-trainer-update HTTP/1.1
User-Agent: FLiNGTrainer
Host: flingtrainer.com
ResponseHTTP/1.1 200 OK
Date: Mon, 12 Jun 2023 11:50:24 GMT
Content-Length: 6
Connection: keep-alive
last-modified: Tue, 09 May 2023 12:34:22 GMT
etag: "6-5fb41f991166c"
accept-ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1c7UW5UanfFUqXbwqcks9of80GmYKRLjZTfrPz19LbNVibdJ8h3JLRYOU50OB%2FYUHLb%2FScD1MXHeiCFCyX1qQdv7oWjhERFvKIoP13f4IKkeDRde22WAn0pF%2FydxHP4UXj7Y"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7d61e0420d4e0a54-AMS
alt-svc: h3=":443"; ma=86400
-
DNS35.36.251.142.in-addr.arpaRemote address:8.8.8.8:53Request35.36.251.142.in-addr.arpaIN PTRResponse35.36.251.142.in-addr.arpaIN PTRams17s12-in-f31e100net
-
DNS28.118.140.52.in-addr.arpaRemote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
DNS86.8.109.52.in-addr.arpaRemote address:8.8.8.8:53Request86.8.109.52.in-addr.arpaIN PTRResponse
-
172.67.177.160:443flingtrainer.comtls
-
93.184.220.29:80
-
93.184.220.29:80
-
172.67.177.160:443https://flingtrainer.com/wp-content/check-for-trainer-update/the-witcher-3-wild-hunt-trainertls, http
HTTP Request
GET https://flingtrainer.com/wp-content/check-for-trainer-update/the-witcher-3-wild-hunt-trainerHTTP Response
200 -
172.67.177.160:443https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-updatetls, http
HTTP Request
GET https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-updateHTTP Response
200 -
52.152.110.14:443
-
8.238.178.254:80 -
8.238.178.254:80
-
173.223.113.164:443
-
52.152.110.14:443
-
8.238.178.254:80
-
52.152.110.14:443
-
104.85.1.163:80
-
204.79.197.203:80
-
52.152.110.14:443
-
52.152.110.14:443
-
52.152.110.14:443
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:53flingtrainer.comdns
DNS Request
flingtrainer.com
DNS Response
172.67.177.160104.21.35.160
-
8.8.8.8:53160.177.67.172.in-addr.arpadns
DNS Request
160.177.67.172.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53149.220.183.52.in-addr.arpadns
DNS Request
149.220.183.52.in-addr.arpa
-
8.8.8.8:5335.36.251.142.in-addr.arpadns
DNS Request
35.36.251.142.in-addr.arpa
-
8.8.8.8:5328.118.140.52.in-addr.arpadns
DNS Request
28.118.140.52.in-addr.arpa
-
8.8.8.8:5386.8.109.52.in-addr.arpadns
DNS Request
86.8.109.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB