Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Cuphead v1...er.exe

windows7-x64

Cuphead v1...er.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    23s
  • max time network
    23s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 14:25 UTC

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Cuphead v1.3.2 Plus 8 Trainer.exe

  • Size

    1.3MB

  • MD5

    1a6192c1dbd34a4c1b3cc3f92e8b1954

  • SHA1

    40dfedd3a712bc5b918f12e9aa19ae94d5b611c0

  • SHA256

    3b3b74d2ae7cde356bd67fc10cb988b363ab3d8155a4cd90126dfd0e20a84727

  • SHA512

    466b12869ed21721c46070c7f95d7fd6dad0436e5f43285a402321257ec0f08ca3abdcedc7ee6b3e07990efba685dbfc547a3ad9f9bb6e5e1bbeb126b21a090a

  • SSDEEP

    24576:183/DwNbWtvuQXcyCHrbwbb4B8j88DSngtcbJ74A9:yckt2QsdPwe8YycV779

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cuphead v1.3.2 Plus 8 Trainer.exe
    "C:\Users\Admin\AppData\Local\Temp\Cuphead v1.3.2 Plus 8 Trainer.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1404
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2932
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2292

      Network

      • flag-us
        DNS
        flingtrainer.com
        Cuphead v1.3.2 Plus 8 Trainer.exe
        Remote address:
        8.8.8.8:53
        Request
        flingtrainer.com
        IN A
        Response
        flingtrainer.com
        IN A
        188.114.97.2
        flingtrainer.com
        IN A
        188.114.96.2
      • flag-us
        GET
        https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update
        Cuphead v1.3.2 Plus 8 Trainer.exe
        Remote address:
        188.114.97.2:443
        Request
        GET /wp-content/check-for-trainer-update/get-trainer-update HTTP/1.1
        User-Agent: FLiNGTrainer
        Host: flingtrainer.com
        Response
        HTTP/1.1 200 OK
        Date: Mon, 12 Feb 2024 14:28:04 GMT
        Content-Length: 6
        Connection: keep-alive
        last-modified: Tue, 09 May 2023 12:34:22 GMT
        etag: "6-5fb41f9908f80"
        accept-ranges: bytes
        Cache-Control: no-cache, no-store, must-revalidate
        pragma: no-cache
        expires: 0
        x-frame-options: SAMEORIGIN
        x-xss-protection: 1; mode=block
        x-content-type-options: nosniff
        CF-Cache-Status: DYNAMIC
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FlZ9e3sKnBg7P4EkKU0Id%2F8yyPh6REwAXSj5G2TSizI36KyBUXAYn3%2B3Ten91TMtD9%2Fk4ObtVPdhVZprXYRR%2FXlEIxMCemYk8QEeirJa2wGlM9caXPDN8Y51OdMn0tPRNvCe"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 85458418eea488aa-LHR
        alt-svc: h3=":443"; ma=86400
      • flag-us
        GET
        https://flingtrainer.com/wp-content/check-for-trainer-update/cuphead-trainer
        Cuphead v1.3.2 Plus 8 Trainer.exe
        Remote address:
        188.114.97.2:443
        Request
        GET /wp-content/check-for-trainer-update/cuphead-trainer HTTP/1.1
        User-Agent: FLiNGTrainer
        Host: flingtrainer.com
        Response
        HTTP/1.1 200 OK
        Date: Mon, 12 Feb 2024 14:28:05 GMT
        Content-Length: 11
        Connection: keep-alive
        last-modified: Sat, 02 Jul 2022 20:21:24 GMT
        etag: "b-5e2d83f28b900"
        accept-ranges: bytes
        Cache-Control: no-cache, no-store, must-revalidate
        pragma: no-cache
        expires: 0
        x-frame-options: SAMEORIGIN
        x-xss-protection: 1; mode=block
        x-content-type-options: nosniff
        CF-Cache-Status: DYNAMIC
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TqkNXj%2BzC9GoSLpg7nU%2F29rkuSIGgHDaZnA7lXNCjlMFlIFyhmDmYlkWsOLBgERVza0eeEdHaZobhzamu1k1n00G6nso7o%2B80iuCzlwqm9W08KGNgR%2Ft4Vpsu2C432GsN4YO"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 8545841bba1c88aa-LHR
        alt-svc: h3=":443"; ma=86400
      • flag-us
        DNS
        apps.identrust.com
        Cuphead v1.3.2 Plus 8 Trainer.exe
        Remote address:
        8.8.8.8:53
        Request
        apps.identrust.com
        IN A
        Response
        apps.identrust.com
        IN CNAME
        identrust.edgesuite.net
        identrust.edgesuite.net
        IN CNAME
        a1952.dscq.akamai.net
        a1952.dscq.akamai.net
        IN A
        96.17.179.205
        a1952.dscq.akamai.net
        IN A
        96.17.179.184
      • flag-gb
        GET
        http://apps.identrust.com/roots/dstrootcax3.p7c
        Cuphead v1.3.2 Plus 8 Trainer.exe
        Remote address:
        96.17.179.205:80
        Request
        GET /roots/dstrootcax3.p7c HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/6.1
        Host: apps.identrust.com
        Response
        HTTP/1.1 200 OK
        X-XSS-Protection: 1; mode=block
        X-Frame-Options: SAMEORIGIN
        X-Content-Type-Options: nosniff
        X-Robots-Tag: noindex
        Referrer-Policy: same-origin
        Last-Modified: Fri, 13 Oct 2023 16:28:31 GMT
        ETag: "37d-6079b8c0929c0"
        Accept-Ranges: bytes
        Content-Length: 893
        X-Content-Type-Options: nosniff
        X-Frame-Options: sameorigin
        Content-Type: application/pkcs7-mime
        Cache-Control: max-age=3600
        Expires: Mon, 12 Feb 2024 15:28:03 GMT
        Date: Mon, 12 Feb 2024 14:28:03 GMT
        Connection: keep-alive
      • flag-us
        DNS
        www.microsoft.com
        Cuphead v1.3.2 Plus 8 Trainer.exe
        Remote address:
        8.8.8.8:53
        Request
        www.microsoft.com
        IN A
        Response
        www.microsoft.com
        IN CNAME
        www.microsoft.com-c-3.edgekey.net
        www.microsoft.com-c-3.edgekey.net
        IN CNAME
        www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
        www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
        IN CNAME
        e13678.dscb.akamaiedge.net
        e13678.dscb.akamaiedge.net
        IN A
        2.17.5.133
      • flag-us
        DNS
        x2.c.lencr.org
        Cuphead v1.3.2 Plus 8 Trainer.exe
        Remote address:
        8.8.8.8:53
        Request
        x2.c.lencr.org
        IN A
        Response
        x2.c.lencr.org
        IN CNAME
        crl.root-x1.letsencrypt.org.edgekey.net
        crl.root-x1.letsencrypt.org.edgekey.net
        IN CNAME
        e8652.dscx.akamaiedge.net
        e8652.dscx.akamaiedge.net
        IN A
        173.222.13.40
      • flag-gb
        GET
        http://x2.c.lencr.org/
        Cuphead v1.3.2 Plus 8 Trainer.exe
        Remote address:
        173.222.13.40:80
        Request
        GET / HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/6.1
        Host: x2.c.lencr.org
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Content-Type: application/pkix-crl
        Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT
        ETag: "64cd6654-12c"
        Cache-Control: max-age=3600
        Expires: Mon, 12 Feb 2024 15:28:04 GMT
        Date: Mon, 12 Feb 2024 14:28:04 GMT
        Content-Length: 300
        Connection: keep-alive
      • 188.114.97.2:443
        https://flingtrainer.com/wp-content/check-for-trainer-update/cuphead-trainer
        tls, http
        Cuphead v1.3.2 Plus 8 Trainer.exe
        1.1kB
         7.1kB
         12
        12

        HTTP Request

        GET https://flingtrainer.com/wp-content/check-for-trainer-update/get-trainer-update

        HTTP Response

        200

        HTTP Request

        GET https://flingtrainer.com/wp-content/check-for-trainer-update/cuphead-trainer

        HTTP Response

        200
      • 96.17.179.205:80
        http://apps.identrust.com/roots/dstrootcax3.p7c
        http
        Cuphead v1.3.2 Plus 8 Trainer.exe
        421 B
         1.6kB
         6
        5

        HTTP Request

        GET http://apps.identrust.com/roots/dstrootcax3.p7c

        HTTP Response

        200
      • 173.222.13.40:80
        http://x2.c.lencr.org/
        http
        Cuphead v1.3.2 Plus 8 Trainer.exe
        396 B
         1.4kB
         6
        4

        HTTP Request

        GET http://x2.c.lencr.org/

        HTTP Response

        200
      • 8.8.8.8:53
        flingtrainer.com
        dns
        Cuphead v1.3.2 Plus 8 Trainer.exe
        62 B
         94 B
         1
        1

        DNS Request

        flingtrainer.com

        DNS Response

        188.114.97.2
        188.114.96.2

      • 8.8.8.8:53
        apps.identrust.com
        dns
        Cuphead v1.3.2 Plus 8 Trainer.exe
        64 B
         165 B
         1
        1

        DNS Request

        apps.identrust.com

        DNS Response

        96.17.179.205
        96.17.179.184

      • 8.8.8.8:53
        www.microsoft.com
        dns
        Cuphead v1.3.2 Plus 8 Trainer.exe
        63 B
         230 B
         1
        1

        DNS Request

        www.microsoft.com

        DNS Response

        2.17.5.133

      • 8.8.8.8:53
        x2.c.lencr.org
        dns
        Cuphead v1.3.2 Plus 8 Trainer.exe
        60 B
         165 B
         1
        1

        DNS Request

        x2.c.lencr.org

        DNS Response

        173.222.13.40

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
        Filesize

        65KB

        MD5

        ac05d27423a85adc1622c714f2cb6184

        SHA1

        b0fe2b1abddb97837ea0195be70ab2ff14d43198

        SHA256

        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

        SHA512

        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
        Filesize

        1KB

        MD5

        a266bb7dcc38a562631361bbf61dd11b

        SHA1

        3b1efd3a66ea28b16697394703a72ca340a05bd5

        SHA256

        df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

        SHA512

        0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        304B

        MD5

        11c1f2345df1ff664805fec7ff67e728

        SHA1

        318acd32c33690546792084b29f5890be41924f3

        SHA256

        a0bfa348109477c3e3593ccd31d40310882907038075b176e0de03cc40cf6039

        SHA512

        c47737c23f89f60b9c6f63b52f270ad58762815831f7d8fb043d4db2c371fd41429622fd382cc48632cc53fa55f05e197f3608b7072c63ff6db0991a73bd2a84

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
        Filesize

        242B

        MD5

        54805b24748099d434546fdfb29e3d42

        SHA1

        83b5d0deef3f7b6322ee744b10846c711e593504

        SHA256

        b3a66a526dac325e1de57475aac53f6fedf89f9692bf9cbb9b85901b85f5ac9f

        SHA512

        7b4e272d5d2c368a849e32d99a9e08c1edac92e703e418d9be284bc134b26c1a8da9a680072582489b5c75b5632403f0f929f1953004fcc8affe3db3ba6fa234

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar1403.tmp
        Filesize

        171KB

        MD5

        9c0c641c06238516f27941aa1166d427

        SHA1

        64cd549fb8cf014fcd9312aa7a5b023847b6c977

        SHA256

        4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

        SHA512

        936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

        Download Submit

      • memory/1404-9-0x000000001AFF0000-0x000000001B070000-memory.dmp

        Filesize

        512KB

        Download

      • memory/1404-7-0x0000000000380000-0x000000000038A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1404-2-0x0000000001CC0000-0x0000000001CF0000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1404-8-0x0000000000380000-0x000000000038A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1404-6-0x000000001AFF0000-0x000000001B070000-memory.dmp

        Filesize

        512KB

        Download

      • memory/1404-5-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/1404-121-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/1404-122-0x000000001AFF0000-0x000000001B070000-memory.dmp

        Filesize

        512KB

        Download

      • memory/1404-123-0x000000001AFF0000-0x000000001B070000-memory.dmp

        Filesize

        512KB

        Download

      • memory/1404-125-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2292-126-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2932-124-0x0000000002E10000-0x0000000002E11000-memory.dmp

        Filesize

        4KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.