Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

581bfc3f0f...94.exe

windows7-x64

1

581bfc3f0f...94.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2023, 18:18 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe

  • Size

    1.9MB

  • MD5

    ee22341242572923fc557fc31601ae98

  • SHA1

    5b08a6b2a449f469acd7a6364d1b8b6f9e6f7884

  • SHA256

    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394

  • SHA512

    c44647bc864a299b71f803fe99af3900092e5aef609a1910c5383c331ebda73fc47c465d41ffa1f4b2f9042f2f0adf91648efdc5f232c1a3ba7827cc199da348

  • SSDEEP

    49152:yeeKdmm4AFDw2Y9K9W9Mb6W/XT5X1gF44I1:OwDpY9+1D5lg5I1

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    "C:\Users\Admin\AppData\Local\Temp\581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2120

Network

  • flag-us
    DNS
    flingtrainer.com
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
    Response
    flingtrainer.com
    IN A
    188.114.96.0
    flingtrainer.com
    IN A
    188.114.97.0
  • flag-us
    GET
    https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    Remote address:
    188.114.96.0:443
    Request
    GET /wp-content/check-for-trainer-update/get-trainer-update HTTP/1.1
    User-Agent: FLiNGTrainer
    Host: flingtrainer.com
    Response
    HTTP/1.1 200 OK
    Date: Wed, 06 Dec 2023 18:19:03 GMT
    Content-Length: 6
    Connection: keep-alive
    last-modified: Tue, 09 May 2023 12:34:22 GMT
    etag: "6-5fb41f9908f80"
    accept-ranges: bytes
    Cache-Control: no-cache, no-store, must-revalidate
    pragma: no-cache
    expires: 0
    x-frame-options: SAMEORIGIN
    x-xss-protection: 1; mode=block
    x-content-type-options: nosniff
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aXeyqyntfDEn%2BLeHoFUnXmF92iJsb24bIKSF%2FysrGv5bIa9Qq6pmpdAjXLmCrZtXPbpP8omMk%2BrwwNjGv67t%2FdK%2Bq65rqmMmyCN7aCyUtEw8rLpeeH8PBJnXZT8pq9xGVFjZ"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 831688ef49c00e10-AMS
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    apps.identrust.com
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    Remote address:
    8.8.8.8:53
    Request
    apps.identrust.com
    IN A
    Response
    apps.identrust.com
    IN CNAME
    identrust.edgesuite.net
    identrust.edgesuite.net
    IN CNAME
    a1952.dscq.akamai.net
    a1952.dscq.akamai.net
    IN A
    104.110.240.226
    a1952.dscq.akamai.net
    IN A
    104.110.240.216
  • flag-nl
    GET
    http://apps.identrust.com/roots/dstrootcax3.p7c
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    Remote address:
    104.110.240.226:80
    Request
    GET /roots/dstrootcax3.p7c HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: apps.identrust.com
    Response
    HTTP/1.1 200 OK
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    X-Robots-Tag: noindex
    Referrer-Policy: same-origin
    Last-Modified: Fri, 13 Oct 2023 16:28:31 GMT
    ETag: "37d-6079b8c0929c0"
    Accept-Ranges: bytes
    Content-Length: 893
    X-Content-Type-Options: nosniff
    X-Frame-Options: sameorigin
    Content-Type: application/pkcs7-mime
    Cache-Control: max-age=3600
    Expires: Wed, 06 Dec 2023 19:19:01 GMT
    Date: Wed, 06 Dec 2023 18:19:01 GMT
    Connection: keep-alive
  • flag-us
    GET
    https://flingtrainer.com/wp-content/check-for-trainer-update/tevi-trainer
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    Remote address:
    188.114.96.0:443
    Request
    GET /wp-content/check-for-trainer-update/tevi-trainer HTTP/1.1
    User-Agent: FLiNGTrainer
    Host: flingtrainer.com
    Response
    HTTP/1.1 200 OK
    Date: Wed, 06 Dec 2023 18:19:03 GMT
    Content-Length: 9
    Connection: keep-alive
    last-modified: Wed, 06 Dec 2023 17:10:55 GMT
    etag: "9-60bda6f1c64b7"
    accept-ranges: bytes
    Cache-Control: no-cache, no-store, must-revalidate
    pragma: no-cache
    expires: 0
    x-frame-options: SAMEORIGIN
    x-xss-protection: 1; mode=block
    x-content-type-options: nosniff
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ROKu%2Fyxe8d2d%2BfM4kN9LVQ3LG8cQKP15Y5TcXaSyBtGNfQjqrgDCHMh4uBx8wVlCbY4pps%2B7%2B2NokI2Y9lEhwhuhvcozNgLJjTiFK9E9Se%2FxB4T6JacmtCldXBWRe%2BxYNsxh"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 831688ef5b9c1afe-AMS
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    x2.c.lencr.org
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    Remote address:
    8.8.8.8:53
    Request
    x2.c.lencr.org
    IN A
    Response
    x2.c.lencr.org
    IN CNAME
    crl.root-x1.letsencrypt.org.edgekey.net
    crl.root-x1.letsencrypt.org.edgekey.net
    IN CNAME
    e8652.dscx.akamaiedge.net
    e8652.dscx.akamaiedge.net
    IN A
    23.206.95.234
  • flag-nl
    GET
    http://x2.c.lencr.org/
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    Remote address:
    23.206.95.234:80
    Request
    GET / HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: x2.c.lencr.org
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Content-Type: application/pkix-crl
    Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT
    ETag: "64cd6654-12c"
    Cache-Control: max-age=3600
    Expires: Wed, 06 Dec 2023 19:19:02 GMT
    Date: Wed, 06 Dec 2023 18:19:02 GMT
    Content-Length: 300
    Connection: keep-alive
  • 188.114.96.0:443
    https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update
    tls, http
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    846 B
     6.0kB
     9
    9

    HTTP Request

    GET https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update

    HTTP Response

    200
  • 104.110.240.226:80
    http://apps.identrust.com/roots/dstrootcax3.p7c
    http
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    369 B
     1.6kB
     5
    4

    HTTP Request

    GET http://apps.identrust.com/roots/dstrootcax3.p7c

    HTTP Response

    200
  • 188.114.96.0:443
    https://flingtrainer.com/wp-content/check-for-trainer-update/tevi-trainer
    tls, http
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    878 B
     6.1kB
     9
    10

    HTTP Request

    GET https://flingtrainer.com/wp-content/check-for-trainer-update/tevi-trainer

    HTTP Response

    200
  • 23.206.95.234:80
    http://x2.c.lencr.org/
    http
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    396 B
     1.4kB
     6
    4

    HTTP Request

    GET http://x2.c.lencr.org/

    HTTP Response

    200
  • 8.8.8.8:53
    flingtrainer.com
    dns
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    62 B
     94 B
     1
    1

    DNS Request

    flingtrainer.com

    DNS Response

    188.114.96.0
    188.114.97.0

  • 8.8.8.8:53
    apps.identrust.com
    dns
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    64 B
     165 B
     1
    1

    DNS Request

    apps.identrust.com

    DNS Response

    104.110.240.226
    104.110.240.216

  • 8.8.8.8:53
    x2.c.lencr.org
    dns
    581bfc3f0f2274d314eda0c878e0c69f1afa6d3c3a2483cd09b0602c82205394.exe
    60 B
     165 B
     1
    1

    DNS Request

    x2.c.lencr.org

    DNS Response

    23.206.95.234

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    f6aa0313e7c2289ad9448b281c752ecb

    SHA1

    47c5b14cec55add63c646b17ae0fa1a55e34ac99

    SHA256

    04d0696861c9781815db67eaba8bfe18c7e8144742b1d76abebaa7cd993eb514

    SHA512

    80a8b338f234c948429096c03494a952f90dffde616591f7410b28af8e2617a18abb7a3db93c7c86e059653371b0d15f67c3671f90f918f5e11d37eed8ba8f74

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab61C1.tmp
    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar6438.tmp
    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    Download Submit

  • memory/2120-3-0x000000001B080000-0x000000001B100000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2120-1-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2120-0-0x0000000001C70000-0x0000000001CA4000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2120-10-0x000000001B080000-0x000000001B100000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2120-2-0x000000001B080000-0x000000001B100000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2120-6-0x000000001B080000-0x000000001B100000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2120-4-0x0000000001E40000-0x0000000001E4A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2120-5-0x0000000001E40000-0x0000000001E4A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2120-117-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2120-118-0x0000000001E40000-0x0000000001E4A000-memory.dmp

    Filesize

    40KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.