Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

f31c1587e9...73.exe

windows7-x64

1

f31c1587e9...73.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    14/12/2023, 20:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe

  • Size

    1.7MB

  • MD5

    100c7080888f38bb0fa57d3380b0c9dc

  • SHA1

    1b791a5b09e883f388ab06f56a22823743ab483a

  • SHA256

    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73

  • SHA512

    7ac3c8bde8282a92bdba737211c5caf70d9949045e7f1e03d4afb0b9c8aec38d0fb695de7fad8bf0ed394a955f144642f5ba1b855613b6437da3c75cb49c76a9

  • SSDEEP

    24576:u2QpUGbjXOnUxvF6FxoP0E8/7jKeRZMZPjyN4DSVXT5Xf5qqya:u2EbYUx96FxNEA7jL4WN9XT5XRv1

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    "C:\Users\Admin\AppData\Local\Temp\f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2016

Network

  • flag-us
    DNS
    flingtrainer.com
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
    Response
    flingtrainer.com
    IN A
    188.114.97.2
    flingtrainer.com
    IN A
    188.114.96.2
  • flag-us
    GET
    https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    Remote address:
    188.114.97.2:443
    Request
    GET /wp-content/check-for-trainer-update/get-trainer-update HTTP/1.1
    User-Agent: FLiNGTrainer
    Host: flingtrainer.com
    Response
    HTTP/1.1 200 OK
    Date: Thu, 14 Dec 2023 20:01:07 GMT
    Content-Length: 6
    Connection: keep-alive
    last-modified: Tue, 09 May 2023 12:34:22 GMT
    etag: "6-5fb41f9908f80"
    accept-ranges: bytes
    Cache-Control: no-cache, no-store, must-revalidate
    pragma: no-cache
    expires: 0
    x-frame-options: SAMEORIGIN
    x-xss-protection: 1; mode=block
    x-content-type-options: nosniff
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gADoKXF1y8gfVuY%2BR%2FU3LKS0FHKkj9GhGnGkbF1tbfI%2FQwzcwUgkxspuD%2BRsNlC44Jc3VWDjsGNHn9uOMMg%2FxaxRzYuNj2XVtt73WfMYU%2BNpRlGaAEb1VTwlb7kF1kclGH8m"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8359096fa9f323e9-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    apps.identrust.com
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    Remote address:
    8.8.8.8:53
    Request
    apps.identrust.com
    IN A
    Response
    apps.identrust.com
    IN CNAME
    identrust.edgesuite.net
    identrust.edgesuite.net
    IN CNAME
    a1952.dscq.akamai.net
    a1952.dscq.akamai.net
    IN A
    96.17.179.184
    a1952.dscq.akamai.net
    IN A
    96.17.179.205
  • flag-gb
    GET
    http://apps.identrust.com/roots/dstrootcax3.p7c
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    Remote address:
    96.17.179.184:80
    Request
    GET /roots/dstrootcax3.p7c HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: apps.identrust.com
    Response
    HTTP/1.1 200 OK
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    X-Robots-Tag: noindex
    Referrer-Policy: same-origin
    Last-Modified: Fri, 13 Oct 2023 16:28:31 GMT
    ETag: "37d-6079b8c0929c0"
    Accept-Ranges: bytes
    Content-Length: 893
    X-Content-Type-Options: nosniff
    X-Frame-Options: sameorigin
    Content-Type: application/pkcs7-mime
    Cache-Control: max-age=3600
    Expires: Thu, 14 Dec 2023 21:01:05 GMT
    Date: Thu, 14 Dec 2023 20:01:05 GMT
    Connection: keep-alive
  • flag-us
    DNS
    x2.c.lencr.org
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    Remote address:
    8.8.8.8:53
    Request
    x2.c.lencr.org
    IN A
    Response
    x2.c.lencr.org
    IN CNAME
    crl.root-x1.letsencrypt.org.edgekey.net
    crl.root-x1.letsencrypt.org.edgekey.net
    IN CNAME
    e8652.dscx.akamaiedge.net
    e8652.dscx.akamaiedge.net
    IN A
    104.103.158.127
  • flag-gb
    GET
    http://x2.c.lencr.org/
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    Remote address:
    104.103.158.127:80
    Request
    GET / HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: x2.c.lencr.org
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Content-Type: application/pkix-crl
    Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT
    ETag: "64cd6654-12c"
    Cache-Control: max-age=3600
    Expires: Thu, 14 Dec 2023 21:01:06 GMT
    Date: Thu, 14 Dec 2023 20:01:06 GMT
    Content-Length: 300
    Connection: keep-alive
  • flag-us
    GET
    https://flingtrainer.com/wp-content/check-for-trainer-update/wo-long-fallen-dynasty-trainer
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    Remote address:
    188.114.97.2:443
    Request
    GET /wp-content/check-for-trainer-update/wo-long-fallen-dynasty-trainer HTTP/1.1
    User-Agent: FLiNGTrainer
    Host: flingtrainer.com
    Response
    HTTP/1.1 200 OK
    Date: Thu, 14 Dec 2023 20:01:08 GMT
    Content-Length: 12
    Connection: keep-alive
    last-modified: Thu, 14 Dec 2023 18:17:17 GMT
    etag: "c-60c7c4b348604"
    accept-ranges: bytes
    Cache-Control: no-cache, no-store, must-revalidate
    pragma: no-cache
    expires: 0
    x-frame-options: SAMEORIGIN
    x-xss-protection: 1; mode=block
    x-content-type-options: nosniff
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R5rsf%2Fbb0npvUYqOc8mWHek1XxBVO5HfWbJyR0MXfHBxuplGE3KRd46rRm0KD%2F9ysLig6P8HnMtP5IThPsAfm5LK5UCQD7vbNzrhm2BATyNDW3lyTuwovx7dRn8DOFe31UPJ"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8359097598ed0712-LHR
    alt-svc: h3=":443"; ma=86400
  • 188.114.97.2:443
    https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update
    tls, http
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    950 B
     7.0kB
     11
    11

    HTTP Request

    GET https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update

    HTTP Response

    200
  • 96.17.179.184:80
    http://apps.identrust.com/roots/dstrootcax3.p7c
    http
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    421 B
     1.6kB
     6
    5

    HTTP Request

    GET http://apps.identrust.com/roots/dstrootcax3.p7c

    HTTP Response

    200
  • 104.103.158.127:80
    http://x2.c.lencr.org/
    http
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    396 B
     1.4kB
     6
    4

    HTTP Request

    GET http://x2.c.lencr.org/

    HTTP Response

    200
  • 188.114.97.2:443
    https://flingtrainer.com/wp-content/check-for-trainer-update/wo-long-fallen-dynasty-trainer
    tls, http
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    902 B
     7.0kB
     9
    11

    HTTP Request

    GET https://flingtrainer.com/wp-content/check-for-trainer-update/wo-long-fallen-dynasty-trainer

    HTTP Response

    200
  • 8.8.8.8:53
    flingtrainer.com
    dns
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    62 B
     94 B
     1
    1

    DNS Request

    flingtrainer.com

    DNS Response

    188.114.97.2
    188.114.96.2

  • 8.8.8.8:53
    apps.identrust.com
    dns
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    64 B
     165 B
     1
    1

    DNS Request

    apps.identrust.com

    DNS Response

    96.17.179.184
    96.17.179.205

  • 8.8.8.8:53
    x2.c.lencr.org
    dns
    f31c1587e95ca26a03d4b0609925750c4a55cbfd4b302324c9a2e030e589ac73.exe
    60 B
     165 B
     1
    1

    DNS Request

    x2.c.lencr.org

    DNS Response

    104.103.158.127

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    ee89f2549b22ccc844863a46ae2bca60

    SHA1

    456d69d35a470e834ef35fc294d5ad2491584abe

    SHA256

    04c6eda9f273a1469592f190c9d20d75e001d1d4a83ec58095debbce27baecb7

    SHA512

    f3ca757924f4ff5b65e4fa55afb6f035f303f5c779d6f55057324b0d40dd13fdc7a3c4164c6e78b7a0566fc0005f79cd84e886be4d2a20197c6785fe08bebbfc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab5717.tmp
    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar5866.tmp
    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    Download Submit

  • memory/2016-3-0x0000000002720000-0x00000000027A0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2016-5-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2016-4-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2016-10-0x0000000002720000-0x00000000027A0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2016-6-0x0000000002720000-0x00000000027A0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2016-0-0x0000000001D60000-0x0000000001D94000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2016-2-0x0000000002720000-0x00000000027A0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2016-1-0x000007FEF5470000-0x000007FEF5E5C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2016-157-0x000007FEF5470000-0x000007FEF5E5C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2016-158-0x0000000002720000-0x00000000027A0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2016-159-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

    Filesize

    40KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.