Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25/01/2025, 09:46 UTC
General
-
Target
b5ab1092ba541f555f6cfa9dd4687a8ab53ceb253cbafcaec3189e165f674406.exe
-
Size
1.3MB
-
MD5
06dd77f0295ad6b6eb30d39892fc396f
-
SHA1
96bb95a9ee02284ae64931a68ee4d26b206092d8
-
SHA256
b5ab1092ba541f555f6cfa9dd4687a8ab53ceb253cbafcaec3189e165f674406
-
SHA512
40862259afa3f197797c5bfe616effeacefccc3b2c949ea2f4138a6f5b40d87c896beb16e1522f0bbba17bc7fc43511744e6793167ad9d0affc12fcc8e0b7060
-
SSDEEP
24576:mAxiglNQtmfZn0DrnDn6t5WnXDXbJ7qDSWvx:XNQExnirb6t8nX7V7Ex
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5ab1092ba541f555f6cfa9dd4687a8ab53ceb253cbafcaec3189e165f674406.exe"C:\Users\Admin\AppData\Local\Temp\b5ab1092ba541f555f6cfa9dd4687a8ab53ceb253cbafcaec3189e165f674406.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNS11.153.16.2.in-addr.arpaRemote address:8.8.8.8:53Request11.153.16.2.in-addr.arpaIN PTRResponse11.153.16.2.in-addr.arpaIN PTRa2-16-153-11deploystaticakamaitechnologiescom
-
DNS0.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request0.159.190.20.in-addr.arpaIN PTRResponse
-
DNSflingtrainer.comRemote address:8.8.8.8:53Requestflingtrainer.comIN AResponseflingtrainer.comIN A104.26.14.72flingtrainer.comIN A172.67.73.26flingtrainer.comIN A104.26.15.72
-
GEThttps://flingtrainer.com/wp-content/check-for-trainer-update/yakuza-3-remastered-trainerRemote address:104.26.14.72:443RequestGET /wp-content/check-for-trainer-update/yakuza-3-remastered-trainer HTTP/1.1
User-Agent: FLiNGTrainer
Host: flingtrainer.com
ResponseHTTP/1.1 200 OK
Date: Sat, 25 Jan 2025 09:46:57 GMT
Content-Length: 11
Connection: keep-alive
vary: User-Agent
last-modified: Sun, 31 Jan 2021 03:07:55 GMT
etag: "b-5ba298b2d98c0"
accept-ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JIMhN0eYV6%2FXyfW4IpP%2FzABynb40CWt2AdMqooLWrEsheUYfM%2FtS4j6qgsfBOxaGfWdCvqWgFsQIQ87EOefGDtNZnCi4A7v%2F3JdtxINP3yRLaYoT65v9m896bLtKgUqilYE%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 907756ca6c739601-LHR
server-timing: cfL4;desc="?proto=TCP&rtt=29912&min_rtt=25974&rtt_var=8697&sent=6&recv=9&lost=0&retrans=0&sent_bytes=3299&recv_bytes=436&delivery_rate=156414&cwnd=251&unsent_bytes=0&cid=a571f0308f2e44b8&ts=563&x=0"
-
DNSc.pki.googRemote address:8.8.8.8:53Requestc.pki.googIN AResponsec.pki.googIN CNAMEpki-goog.l.google.compki-goog.l.google.comIN A142.250.187.227
-
GEThttp://c.pki.goog/r/gsr1.crlRemote address:142.250.187.227:80RequestGET /r/gsr1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 1739
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 25 Jan 2025 09:41:13 GMT
Expires: Sat, 25 Jan 2025 10:31:13 GMT
Cache-Control: public, max-age=3000
Age: 343
Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
-
GEThttp://c.pki.goog/r/r4.crlRemote address:142.250.187.227:80RequestGET /r/r4.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 436
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 25 Jan 2025 09:45:01 GMT
Expires: Sat, 25 Jan 2025 10:35:01 GMT
Cache-Control: public, max-age=3000
Age: 115
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
-
DNS218.158.40.23.in-addr.arpaRemote address:8.8.8.8:53Request218.158.40.23.in-addr.arpaIN PTRResponse218.158.40.23.in-addr.arpaIN PTRa23-40-158-218deploystaticakamaitechnologiescom
-
DNS72.14.26.104.in-addr.arpaRemote address:8.8.8.8:53Request72.14.26.104.in-addr.arpaIN PTRResponse
-
DNS227.187.250.142.in-addr.arpaRemote address:8.8.8.8:53Request227.187.250.142.in-addr.arpaIN PTRResponse227.187.250.142.in-addr.arpaIN PTRlhr25s34-in-f31e100net
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
DNS212.20.149.52.in-addr.arpaRemote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
DNS212.20.149.52.in-addr.arpaRemote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTR
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTR
-
DNS11.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
104.26.14.72:443https://flingtrainer.com/wp-content/check-for-trainer-update/yakuza-3-remastered-trainertls, http
HTTP Request
GET https://flingtrainer.com/wp-content/check-for-trainer-update/yakuza-3-remastered-trainerHTTP Response
200 -
142.250.187.227:80http://c.pki.goog/r/r4.crlhttp
HTTP Request
GET http://c.pki.goog/r/gsr1.crlHTTP Response
200HTTP Request
GET http://c.pki.goog/r/r4.crlHTTP Response
200
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:5311.153.16.2.in-addr.arpadns
DNS Request
11.153.16.2.in-addr.arpa
-
8.8.8.8:530.159.190.20.in-addr.arpadns
DNS Request
0.159.190.20.in-addr.arpa
-
8.8.8.8:53flingtrainer.comdns
DNS Request
flingtrainer.com
DNS Response
104.26.14.72172.67.73.26104.26.15.72
-
8.8.8.8:53c.pki.googdns
DNS Request
c.pki.goog
DNS Response
142.250.187.227
-
8.8.8.8:53218.158.40.23.in-addr.arpadns
DNS Request
218.158.40.23.in-addr.arpa
-
8.8.8.8:5372.14.26.104.in-addr.arpadns
DNS Request
72.14.26.104.in-addr.arpa
-
8.8.8.8:53227.187.250.142.in-addr.arpadns
DNS Request
227.187.250.142.in-addr.arpa
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:53212.20.149.52.in-addr.arpadns
DNS Request
212.20.149.52.in-addr.arpa
DNS Request
212.20.149.52.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
DNS Request
172.210.232.199.in-addr.arpa
-
8.8.8.8:5311.227.111.52.in-addr.arpadns
DNS Request
11.227.111.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
200KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB