Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

8adfba3dca...12.exe

windows7-x64

1

8adfba3dca...12.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    151s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 05:50 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe

  • Size

    1.9MB

  • MD5

    a348ec5b5a794d95d809c41a45a5ebfe

  • SHA1

    3c92b5482bcd649f4247690fc55d875d2eededfc

  • SHA256

    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12

  • SHA512

    3a6b48711897b448dff536bc1f3de24cc5d2c93074cb6b346298014896c7f7427ca09c96db4980fb56b27264460d9546cab18d3a75aec2884e17ced02f198945

  • SSDEEP

    49152:tuQ4tIPxjNF9TZWtHEM/sCfQQ0XT5Xwv1:NzTTZaR4D5Av1

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    "C:\Users\Admin\AppData\Local\Temp\8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2080

Network

  • flag-us
    DNS
    flingtrainer.com
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
    Response
    flingtrainer.com
    IN A
    188.114.97.0
    flingtrainer.com
    IN A
    188.114.96.0
  • flag-us
    GET
    https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    Remote address:
    188.114.97.0:443
    Request
    GET /wp-content/check-for-trainer-update/get-trainer-update HTTP/1.1
    User-Agent: FLiNGTrainer
    Host: flingtrainer.com
  • flag-us
    DNS
    apps.identrust.com
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    Remote address:
    8.8.8.8:53
    Request
    apps.identrust.com
    IN A
    Response
    apps.identrust.com
    IN CNAME
    identrust.edgesuite.net
    identrust.edgesuite.net
    IN CNAME
    a1952.dscq.akamai.net
    a1952.dscq.akamai.net
    IN A
    2.18.121.70
    a1952.dscq.akamai.net
    IN A
    2.18.121.80
  • flag-us
    GET
    http://apps.identrust.com/roots/dstrootcax3.p7c
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    Remote address:
    2.18.121.70:80
    Request
    GET /roots/dstrootcax3.p7c HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: apps.identrust.com
    Response
    HTTP/1.1 200 OK
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    X-Robots-Tag: noindex
    Referrer-Policy: same-origin
    Last-Modified: Mon, 21 Aug 2023 22:08:28 GMT
    ETag: "37d-603761e33cf00"
    Accept-Ranges: bytes
    Content-Length: 893
    X-Content-Type-Options: nosniff
    X-Frame-Options: sameorigin
    Content-Type: application/pkcs7-mime
    Cache-Control: max-age=3600
    Expires: Wed, 11 Oct 2023 07:40:43 GMT
    Date: Wed, 11 Oct 2023 06:40:43 GMT
    Connection: keep-alive
  • flag-us
    GET
    https://flingtrainer.com/wp-content/check-for-trainer-update/lies-of-p-trainer
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    Remote address:
    188.114.97.0:443
    Request
    GET /wp-content/check-for-trainer-update/lies-of-p-trainer HTTP/1.1
    User-Agent: FLiNGTrainer
    Host: flingtrainer.com
  • flag-us
    DNS
    x2.c.lencr.org
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    Remote address:
    8.8.8.8:53
    Request
    x2.c.lencr.org
    IN A
    Response
    x2.c.lencr.org
    IN CNAME
    crl.root-x1.letsencrypt.org.edgekey.net
    crl.root-x1.letsencrypt.org.edgekey.net
    IN CNAME
    e8652.dscx.akamaiedge.net
    e8652.dscx.akamaiedge.net
    IN A
    23.42.174.147
  • flag-hk
    GET
    http://x2.c.lencr.org/
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    Remote address:
    23.42.174.147:80
    Request
    GET / HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: x2.c.lencr.org
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Content-Type: application/pkix-crl
    Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT
    ETag: "64cd6654-12c"
    Cache-Control: max-age=3600
    Expires: Wed, 11 Oct 2023 07:40:59 GMT
    Date: Wed, 11 Oct 2023 06:40:59 GMT
    Content-Length: 300
    Connection: keep-alive
  • flag-us
    GET
    https://flingtrainer.com/wp-content/check-for-trainer-update/lies-of-p-trainer
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    Remote address:
    188.114.97.0:443
    Request
    GET /wp-content/check-for-trainer-update/lies-of-p-trainer HTTP/1.1
    User-Agent: FLiNGTrainer
    Host: flingtrainer.com
    Response
    HTTP/1.1 200 OK
    Date: Wed, 11 Oct 2023 06:41:04 GMT
    Content-Length: 9
    Connection: keep-alive
    last-modified: Fri, 29 Sep 2023 13:42:07 GMT
    etag: "9-6067f972f7ac1"
    accept-ranges: bytes
    Cache-Control: no-cache, no-store, must-revalidate
    pragma: no-cache
    expires: 0
    x-frame-options: SAMEORIGIN
    x-xss-protection: 1; mode=block
    x-content-type-options: nosniff
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5HQT7azlTgANaY11XUdLZgHNWY3etQ8YVPu2bxvFGJ%2FC9whGH8c%2BbsUMJIq8SJvCHJxaaduF%2Fv8JO%2BJJMvcDJRNLapmT0jAYaJZIf00mL4%2BwmaPPgutpXU5izLdQhRZGs4Iy"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 81451d828a8f0a54-AMS
    alt-svc: h3=":443"; ma=86400
  • 188.114.97.0:443
    https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update
    tls, http
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    944 B
     5.4kB
     11
    12

    HTTP Request

    GET https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update
  • 2.18.121.70:80
    http://apps.identrust.com/roots/dstrootcax3.p7c
    http
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    421 B
     1.6kB
     6
    5

    HTTP Request

    GET http://apps.identrust.com/roots/dstrootcax3.p7c

    HTTP Response

    200
  • 188.114.97.0:443
    https://flingtrainer.com/wp-content/check-for-trainer-update/lies-of-p-trainer
    tls, http
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    975 B
     5.4kB
     11
    12

    HTTP Request

    GET https://flingtrainer.com/wp-content/check-for-trainer-update/lies-of-p-trainer
  • 23.42.174.147:80
    http://x2.c.lencr.org/
    http
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    344 B
     721 B
     5
    3

    HTTP Request

    GET http://x2.c.lencr.org/

    HTTP Response

    200
  • 188.114.97.0:443
    https://flingtrainer.com/wp-content/check-for-trainer-update/lies-of-p-trainer
    tls, http
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    831 B
     6.0kB
     8
    9

    HTTP Request

    GET https://flingtrainer.com/wp-content/check-for-trainer-update/lies-of-p-trainer

    HTTP Response

    200
  • 8.8.8.8:53
    flingtrainer.com
    dns
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    62 B
     94 B
     1
    1

    DNS Request

    flingtrainer.com

    DNS Response

    188.114.97.0
    188.114.96.0

  • 8.8.8.8:53
    apps.identrust.com
    dns
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    64 B
     165 B
     1
    1

    DNS Request

    apps.identrust.com

    DNS Response

    2.18.121.70
    2.18.121.80

  • 8.8.8.8:53
    x2.c.lencr.org
    dns
    8adfba3dcaa3c93ff2225bebfd61b64faf33c92fd29d69f65fd0d4b09869fd12.exe
    60 B
     165 B
     1
    1

    DNS Request

    x2.c.lencr.org

    DNS Response

    23.42.174.147

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    9cb778801e84c8d2077cc9f483a0d485

    SHA1

    9c986f30986f7a33b50b929cfe73ff1459f0b1e4

    SHA256

    b8e95a8e577a56eb9f9ed29650180549008776345e85d259946cdb577abcf17c

    SHA512

    09edcb2dc79875e9df43620fd289d4a27d37e99fc7d4d0329470ed5dd5d63fae54a7940b3129d2fd5e675ea4515723e436e28675ffbe2d534f2d53eecd22cb68

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab655A.tmp
    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar6B94.tmp
    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

    Download Submit

  • memory/2080-4-0x000000001AF30000-0x000000001AFB0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2080-0-0x0000000001C70000-0x0000000001CA4000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2080-5-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2080-6-0x000000001AF30000-0x000000001AFB0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2080-7-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2080-3-0x000000001AF30000-0x000000001AFB0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2080-29-0x000000001AF30000-0x000000001AFB0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2080-30-0x000000001AF30000-0x000000001AFB0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2080-2-0x000000001AF30000-0x000000001AFB0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2080-40-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2080-41-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2080-42-0x000000001AF30000-0x000000001AFB0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2080-1-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

    Filesize

    9.9MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.