Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
02/12/2023, 21:18 UTC
General
-
Target
d103dd0c1f9b2b3ad998c84877146baf7577ede3b073b9759ac766183e5fcad5.exe
-
Size
1.7MB
-
MD5
83064e4ed3d2fba580b01bd6416ba3a1
-
SHA1
718ad21f898ddb8438d3f12970f3be3fa40b45f8
-
SHA256
d103dd0c1f9b2b3ad998c84877146baf7577ede3b073b9759ac766183e5fcad5
-
SHA512
3217cba7281555d6136390b978e7bf23ba0624744c51a174b64d1e196d645962ab1fddefc9bb400009289557bfc154fa9e6d4913feb25a46f0d131e50739de1b
-
SSDEEP
49152:UvOrpK2erEPvxRQn1wgGZpXT5XFP9fG1:Ts6xiWvD55pG1
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d103dd0c1f9b2b3ad998c84877146baf7577ede3b073b9759ac766183e5fcad5.exe"C:\Users\Admin\AppData\Local\Temp\d103dd0c1f9b2b3ad998c84877146baf7577ede3b073b9759ac766183e5fcad5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS32.101.122.92.in-addr.arpaRemote address:8.8.8.8:53Request32.101.122.92.in-addr.arpaIN PTRResponse32.101.122.92.in-addr.arpaIN PTRa92-122-101-32deploystaticakamaitechnologiescom
-
DNS73.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request73.159.190.20.in-addr.arpaIN PTRResponse
-
DNS9.228.82.20.in-addr.arpaRemote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
DNSflingtrainer.comRemote address:8.8.8.8:53Requestflingtrainer.comIN AResponseflingtrainer.comIN A188.114.97.0flingtrainer.comIN A188.114.96.0
-
GEThttps://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-updateRemote address:188.114.97.0:443RequestGET /wp-content/check-for-trainer-update/get-trainer-update HTTP/1.1
User-Agent: FLiNGTrainer
Host: flingtrainer.com
ResponseHTTP/1.1 200 OK
Date: Sat, 02 Dec 2023 21:19:07 GMT
Content-Length: 6
Connection: keep-alive
last-modified: Tue, 09 May 2023 12:34:22 GMT
etag: "6-5fb41f9908f80"
accept-ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hj1LyZ0srwp53P63KRjpdk07pex7P3U62tKV1Vumq7oDTSqbysZg8zkv4fadAzlfSNhhog6oxxKjCjfQhpD%2FFKR2K8VZIKTj18i%2BFWIpP3CmryFlCG77BG1bQ6mq4fTzJc9W"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82f69b32cda51ca4-AMS
alt-svc: h3=":443"; ma=86400
-
GEThttps://flingtrainer.com/wp-content/check-for-trainer-update/remnant-ii-trainerRemote address:188.114.97.0:443RequestGET /wp-content/check-for-trainer-update/remnant-ii-trainer HTTP/1.1
User-Agent: FLiNGTrainer
Host: flingtrainer.com
ResponseHTTP/1.1 200 OK
Date: Sat, 02 Dec 2023 21:19:08 GMT
Content-Length: 12
Connection: keep-alive
last-modified: Sat, 02 Dec 2023 19:28:07 GMT
etag: "c-60b8be26772f2"
accept-ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OfKsoIt5vkSc169Ej6dHLSOuQxjkyD9xe%2BmSH5KxDuZqwz0psxCmTX1ybFVedQb98pIopdos7T38362Qt19364Ksuz0tVrMrds77a1DPAzCvYJXYgWOz68r5hlEU2ta%2Bo6z1"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82f69b39c8431ca4-AMS
alt-svc: h3=":443"; ma=86400
-
DNSx2.c.lencr.orgRemote address:8.8.8.8:53Requestx2.c.lencr.orgIN AResponsex2.c.lencr.orgIN CNAMEcrl.root-x1.letsencrypt.org.edgekey.netcrl.root-x1.letsencrypt.org.edgekey.netIN CNAMEe8652.dscx.akamaiedge.nete8652.dscx.akamaiedge.netIN A23.206.95.234
-
GEThttp://x2.c.lencr.org/Remote address:23.206.95.234:80RequestGET / HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: x2.c.lencr.org
ResponseHTTP/1.1 200 OK
Server: nginx
Content-Type: application/pkix-crl
Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT
ETag: "64cd6654-12c"
Cache-Control: max-age=3600
Expires: Sat, 02 Dec 2023 22:19:06 GMT
Date: Sat, 02 Dec 2023 21:19:06 GMT
Content-Length: 300
Connection: keep-alive
-
DNS0.97.114.188.in-addr.arpaRemote address:8.8.8.8:53Request0.97.114.188.in-addr.arpaIN PTRResponse
-
DNS234.95.206.23.in-addr.arpaRemote address:8.8.8.8:53Request234.95.206.23.in-addr.arpaIN PTRResponse234.95.206.23.in-addr.arpaIN PTRa23-206-95-234deploystaticakamaitechnologiescom
-
DNS55.36.223.20.in-addr.arpaRemote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
DNS226.173.246.72.in-addr.arpaRemote address:8.8.8.8:53Request226.173.246.72.in-addr.arpaIN PTRResponse226.173.246.72.in-addr.arpaIN PTRa72-246-173-226deploystaticakamaitechnologiescom
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS103.169.127.40.in-addr.arpaRemote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS2.36.159.162.in-addr.arpaRemote address:8.8.8.8:53Request2.36.159.162.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS86.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
DNS104.98.62.23.in-addr.arpaRemote address:8.8.8.8:53Request104.98.62.23.in-addr.arpaIN PTRResponse104.98.62.23.in-addr.arpaIN PTRa23-62-98-104deploystaticakamaitechnologiescom
-
DNS31.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
-
DNS89.65.42.20.in-addr.arpaRemote address:8.8.8.8:53Request89.65.42.20.in-addr.arpaIN PTRResponse
-
188.114.97.0:443https://flingtrainer.com/wp-content/check-for-trainer-update/remnant-ii-trainertls, http
HTTP Request
GET https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-updateHTTP Response
200HTTP Request
GET https://flingtrainer.com/wp-content/check-for-trainer-update/remnant-ii-trainerHTTP Response
200 -
23.206.95.234:80http://x2.c.lencr.org/http
HTTP Request
GET http://x2.c.lencr.org/HTTP Response
200
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5332.101.122.92.in-addr.arpadns
DNS Request
32.101.122.92.in-addr.arpa
-
8.8.8.8:5373.159.190.20.in-addr.arpadns
DNS Request
73.159.190.20.in-addr.arpa
-
8.8.8.8:539.228.82.20.in-addr.arpadns
DNS Request
9.228.82.20.in-addr.arpa
-
8.8.8.8:53flingtrainer.comdns
DNS Request
flingtrainer.com
DNS Response
188.114.97.0188.114.96.0
-
8.8.8.8:53x2.c.lencr.orgdns
DNS Request
x2.c.lencr.org
DNS Response
23.206.95.234
-
8.8.8.8:530.97.114.188.in-addr.arpadns
DNS Request
0.97.114.188.in-addr.arpa
-
8.8.8.8:53234.95.206.23.in-addr.arpadns
DNS Request
234.95.206.23.in-addr.arpa
-
8.8.8.8:5355.36.223.20.in-addr.arpadns
DNS Request
55.36.223.20.in-addr.arpa
-
8.8.8.8:53226.173.246.72.in-addr.arpadns
DNS Request
226.173.246.72.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53103.169.127.40.in-addr.arpadns
DNS Request
103.169.127.40.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:532.36.159.162.in-addr.arpadns
DNS Request
2.36.159.162.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:5386.23.85.13.in-addr.arpadns
DNS Request
86.23.85.13.in-addr.arpa
-
8.8.8.8:53104.98.62.23.in-addr.arpadns
DNS Request
104.98.62.23.in-addr.arpa
-
8.8.8.8:5331.243.111.52.in-addr.arpadns
DNS Request
31.243.111.52.in-addr.arpa
-
8.8.8.8:5389.65.42.20.in-addr.arpadns
DNS Request
89.65.42.20.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB