Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/02/2024, 23:32 UTC
General
-
Target
d389814cdc38b9bcc1b251314309f1be70d01de724b4edd3f1df364de1b18d3e.exe
-
Size
1.7MB
-
MD5
8c236172b855d90bba67cc061bc06b7c
-
SHA1
ed880bcf3aaa21b542a2b781524a21e285d70363
-
SHA256
d389814cdc38b9bcc1b251314309f1be70d01de724b4edd3f1df364de1b18d3e
-
SHA512
edd704b8ef615076704676b82493e8e99a7043332ddf3f7479aa6f9a5e3cde3ce8b184f06eb450c1cae4a7b0af47a25653172c320e2123c58cbc584515353c3e
-
SSDEEP
49152:1kfKSSrSgRjrcGNvInXZJqXT5X+VlC51/:4SrSo/InXZJqD5OVlo1/
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d389814cdc38b9bcc1b251314309f1be70d01de724b4edd3f1df364de1b18d3e.exe"C:\Users\Admin\AppData\Local\Temp\d389814cdc38b9bcc1b251314309f1be70d01de724b4edd3f1df364de1b18d3e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse -
DNSflingtrainer.comRemote address:8.8.8.8:53Requestflingtrainer.comIN AResponseflingtrainer.comIN A104.21.85.118flingtrainer.comIN A172.67.205.150
-
GEThttps://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-updateRemote address:104.21.85.118:443RequestGET /wp-content/check-for-trainer-update/get-trainer-update HTTP/1.1
User-Agent: FLiNGTrainer
Host: flingtrainer.com
ResponseHTTP/1.1 200 OK
Date: Thu, 01 Feb 2024 23:33:00 GMT
Content-Length: 6
Connection: keep-alive
last-modified: Tue, 09 May 2023 12:34:22 GMT
etag: "6-5fb41f9908f80"
accept-ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OdlVNsXZWz0mtBF6pGxE73FSylOi9mulT6FW5y1Ea4d86Yep7QqqEisDx2IaLb37QRRzeh4HpOhO4DNpK3crqEUkUlZJyaLtv1JWtq7YPw5Jr3ZSKWU2EZOzVZeE5xZYjgz4"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 84edff34d96363f2-LHR
alt-svc: h3=":443"; ma=86400
-
GEThttps://flingtrainer.com/wp-content/check-for-trainer-update/resident-evil-4-trainerRemote address:104.21.85.118:443RequestGET /wp-content/check-for-trainer-update/resident-evil-4-trainer HTTP/1.1
User-Agent: FLiNGTrainer
Host: flingtrainer.com
ResponseHTTP/1.1 200 OK
Date: Thu, 01 Feb 2024 23:33:01 GMT
Content-Length: 12
Connection: keep-alive
last-modified: Tue, 26 Sep 2023 05:18:33 GMT
etag: "c-6063c34befc40"
accept-ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sm0O6pSyoI5FOvTwoMnQGkL9%2FC2eYeneQ5%2FnH7kUNTRThMRazE6s1yj75GqG5%2FkmTRTKg6CSa3%2B7m3LZxoKRVvaC5184gXrBsEWmGTvajEjQJ6FZ80AhVQVKp7Nl3BOrPoOI"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 84edff3d3b9063f2-LHR
alt-svc: h3=":443"; ma=86400
-
DNS0.204.248.87.in-addr.arpaRemote address:8.8.8.8:53Request0.204.248.87.in-addr.arpaIN PTRResponse0.204.248.87.in-addr.arpaIN PTRhttps-87-248-204-0lhrllnwnet
-
DNSx2.c.lencr.orgRemote address:8.8.8.8:53Requestx2.c.lencr.orgIN AResponsex2.c.lencr.orgIN CNAMEcrl.root-x1.letsencrypt.org.edgekey.netcrl.root-x1.letsencrypt.org.edgekey.netIN CNAMEe8652.dscx.akamaiedge.nete8652.dscx.akamaiedge.netIN A173.222.13.40
-
GEThttp://x2.c.lencr.org/Remote address:173.222.13.40:80RequestGET / HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: x2.c.lencr.org
ResponseHTTP/1.1 200 OK
Server: nginx
Content-Type: application/pkix-crl
Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT
ETag: "64cd6654-12c"
Cache-Control: max-age=3600
Expires: Fri, 02 Feb 2024 00:33:00 GMT
Date: Thu, 01 Feb 2024 23:33:00 GMT
Content-Length: 300
Connection: keep-alive
-
DNS118.85.21.104.in-addr.arpaRemote address:8.8.8.8:53Request118.85.21.104.in-addr.arpaIN PTRResponse
-
DNS68.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse
-
DNS40.13.222.173.in-addr.arpaRemote address:8.8.8.8:53Request40.13.222.173.in-addr.arpaIN PTRResponse40.13.222.173.in-addr.arpaIN PTRa173-222-13-40deploystaticakamaitechnologiescom
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNS178.223.142.52.in-addr.arpaRemote address:8.8.8.8:53Request178.223.142.52.in-addr.arpaIN PTRResponse
-
DNS103.169.127.40.in-addr.arpaRemote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS240.221.184.93.in-addr.arpaRemote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
DNS23.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request23.236.111.52.in-addr.arpaIN PTRResponse
-
23.44.234.16:80
-
138.91.171.81:80
-
104.21.85.118:443https://flingtrainer.com/wp-content/check-for-trainer-update/resident-evil-4-trainertls, http
HTTP Request
GET https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-updateHTTP Response
200HTTP Request
GET https://flingtrainer.com/wp-content/check-for-trainer-update/resident-evil-4-trainerHTTP Response
200 -
173.222.13.40:80http://x2.c.lencr.org/http
HTTP Request
GET http://x2.c.lencr.org/HTTP Response
200
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:53flingtrainer.comdns
DNS Request
flingtrainer.com
DNS Response
104.21.85.118172.67.205.150
-
8.8.8.8:530.204.248.87.in-addr.arpadns
DNS Request
0.204.248.87.in-addr.arpa
-
8.8.8.8:53x2.c.lencr.orgdns
DNS Request
x2.c.lencr.org
DNS Response
173.222.13.40
-
8.8.8.8:53118.85.21.104.in-addr.arpadns
DNS Request
118.85.21.104.in-addr.arpa
-
8.8.8.8:5368.32.126.40.in-addr.arpadns
DNS Request
68.32.126.40.in-addr.arpa
-
8.8.8.8:5340.13.222.173.in-addr.arpadns
DNS Request
40.13.222.173.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:53178.223.142.52.in-addr.arpadns
DNS Request
178.223.142.52.in-addr.arpa
-
8.8.8.8:53103.169.127.40.in-addr.arpadns
DNS Request
103.169.127.40.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:53240.221.184.93.in-addr.arpadns
DNS Request
240.221.184.93.in-addr.arpa
-
8.8.8.8:5323.236.111.52.in-addr.arpadns
DNS Request
23.236.111.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB