Windows Analysis Report
https://trinitymedia.ai/player/trinity-player.php?pageURL=https%3A%2F%2Fwww.abqjournal.com%2Fnews%2Flocal%2Fattorney-in-child-porn-case-sentenced-to-3-years%2Farticle_fae7a521-e040-5e6f-9998-73122f02005c.html&partner=Flex&FAB=1&textSelector=I2FydGljbGUtYm9keQ%3D%3D&unitId=2900003117&userId=b9604d43-

Overview

General Information

Sample URL:	https://trinitymedia.ai/player/trinity-player.php?pageURL=https%3A%2F%2Fwww.abqjournal.com%2Fnews%2Flocal%2Fattorney-in-child-porn-case-sentenced-to-3-years%2Farticle_fae7a521-e040-5e6f-9998-73122f020
Analysis ID:	1417170
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: https://trinitymedia.ai/player/trinity-player.php?pageURL=https%3A%2F%2Fwww.abqjournal.com%2Fnews%2Flocal%2Fattorney-in-child-porn-case-sentenced-to-3-years%2Farticle_fae7a521-e040-5e6f-9998-73122f02005c.html&partner=Flex&FAB=1&textSelector=I2FydGljbGUtYm9keQ%3D%3D&unitId=2900003117&userId=b9604d43-a8d2-4660-99e4-98a4b6d34073&isLegacyBrowser=false&isPartitioningSupport=1&version=20240326_55ac2d82cc134f115fe47a2f6d79101d1306d03c&useBunnyCDN=0&themeId=140&unitType=tts-player

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 104.97.85.28
Source: unknown	TCP traffic detected without corresponding DNS query: 104.97.85.28
Source: unknown	TCP traffic detected without corresponding DNS query: 104.97.85.28
Source: unknown	TCP traffic detected without corresponding DNS query: 104.97.85.28
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /player/trinity-player.php?pageURL=https%3A%2F%2Fwww.abqjournal.com%2Fnews%2Flocal%2Fattorney-in-child-porn-case-sentenced-to-3-years%2Farticle_fae7a521-e040-5e6f-9998-73122f02005c.html&partner=Flex&FAB=1&textSelector=I2FydGljbGUtYm9keQ%3D%3D&unitId=2900003117&userId=b9604d43-a8d2-4660-99e4-98a4b6d34073&isLegacyBrowser=false&isPartitioningSupport=1&version=20240326_55ac2d82cc134f115fe47a2f6d79101d1306d03c&useBunnyCDN=0&themeId=140&unitType=tts-player HTTP/1.1Host: trinitymedia.aiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /trinity-player/buttons/trinity-484fef5e39bd1f12260ad07d5cc3499d.js HTTP/1.1Host: vd.trinitymedia.aiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://trinitymedia.aisec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://trinitymedia.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /trinity-player/tts-player/20240326_55ac2d82cc134f115fe47a2f6d79101d1306d03c/trinity-player.js HTTP/1.1Host: vd.trinitymedia.aiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://trinitymedia.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AUID=b9604d43-a8d2-4660-99e4-98a4b6d34073
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: trinitymedia.aiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://trinitymedia.ai/player/trinity-player.php?pageURL=https%3A%2F%2Fwww.abqjournal.com%2Fnews%2Flocal%2Fattorney-in-child-porn-case-sentenced-to-3-years%2Farticle_fae7a521-e040-5e6f-9998-73122f02005c.html&partner=Flex&FAB=1&textSelector=I2FydGljbGUtYm9keQ%3D%3D&unitId=2900003117&userId=b9604d43-a8d2-4660-99e4-98a4b6d34073&isLegacyBrowser=false&isPartitioningSupport=1&version=20240326_55ac2d82cc134f115fe47a2f6d79101d1306d03c&useBunnyCDN=0&themeId=140&unitType=tts-playerAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=D/MkacpweWbRlyMa5NwgwnZ+OAF/1UrstWJzEfz6olow+KEV0V3jkAQDKEK3aUvEk/Vo2jUi7CDjHbC2ZcyfZdrF2uqvSBczGwcJdBD3N33hAZYEbN2JTLX2A0ba; AWSALBCORS=D/MkacpweWbRlyMa5NwgwnZ+OAF/1UrstWJzEfz6olow+KEV0V3jkAQDKEK3aUvEk/Vo2jUi7CDjHbC2ZcyfZdrF2uqvSBczGwcJdBD3N33hAZYEbN2JTLX2A0ba; AUID=b9604d43-a8d2-4660-99e4-98a4b6d34073
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: unknown

DNS traffic detected: queries for: trinitymedia.ai

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 16:58:32 GMTContent-Type: text/html; charset=UTF-8Content-Length: 119Connection: closeSet-Cookie: AWSALB=KRPKreP5yUNiLU0Q6ejh3jmUv/FQj87+XKtHUgydOvvWqcO5ZXpQ13OS1Kjn34mocQD15YL+nRJV/bljZEPO/ID553//FRYwI43F92EX/f6D3fQxHKYj0YJqsIXZ; Expires=Thu, 04 Apr 2024 16:58:32 GMT; Path=/Set-Cookie: AWSALBCORS=KRPKreP5yUNiLU0Q6ejh3jmUv/FQj87+XKtHUgydOvvWqcO5ZXpQ13OS1Kjn34mocQD15YL+nRJV/bljZEPO/ID553//FRYwI43F92EX/f6D3fQxHKYj0YJqsIXZ; Expires=Thu, 04 Apr 2024 16:58:32 GMT; Path=/; SameSite=None; SecureServer: ApacheLast-Modified: Tue, 26 Mar 2024 10:10:32 GMTETag: "77-6148d80159c00"Accept-Ranges: bytesAccess-Control-Allow-Origin: *

Source: chromecache_46.2.dr	String found in binary or memory: https://vd.trinitymedia.ai/trinity-player/buttons/trinity-484fef5e39bd1f12260ad07d5cc3499d.js
Source: chromecache_46.2.dr	String found in binary or memory: https://vd.trinitymedia.ai/trinity-player/tts-player/20240326_55ac2d82cc134f115fe47a2f6d79101d1306d0

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@16/8@6/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1996,i,10663766250546669235,16865027596360018043,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://trinitymedia.ai/player/trinity-player.php?pageURL=https%3A%2F%2Fwww.abqjournal.com%2Fnews%2Flocal%2Fattorney-in-child-porn-case-sentenced-to-3-years%2Farticle_fae7a521-e040-5e6f-9998-73122f02005c.html&partner=Flex&FAB=1&textSelector=I2FydGljbGUtYm9keQ%3D%3D&unitId=2900003117&userId=b9604d43-a8d2-4660-99e4-98a4b6d34073&isLegacyBrowser=false&isPartitioningSupport=1&version=20240326_55ac2d82cc134f115fe47a2f6d79101d1306d03c&useBunnyCDN=0&themeId=140&unitType=tts-player"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1996,i,10663766250546669235,16865027596360018043,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
37.19.207.34	staticvim.b-cdn.net	Ukraine	31343	INTERTELECOMUA	false
54.85.243.212	audio-trinitymedia-ai-alb-1817329827.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.16.99	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

Contacted Domains

Name	IP	Active
staticvim.b-cdn.net	37.19.207.34	true
www.google.com	142.251.16.99	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
audio-trinitymedia-ai-alb-1817329827.us-east-1.elb.amazonaws.com	54.85.243.212	true
vd.trinitymedia.ai	unknown	unknown
trinitymedia.ai	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://trinitymedia.ai/player/trinity-player.php?pageURL=https%3A%2F%2Fwww.abqjournal.com%2Fnews%2Flocal%2Fattorney-in-child-porn-case-sentenced-to-3-years%2Farticle_fae7a521-e040-5e6f-9998-73122f02005c.html&partner=Flex&FAB=1&textSelector=I2FydGljbGUtYm9keQ%3D%3D&unitId=2900003117&userId=b9604d43-a8d2-4660-99e4-98a4b6d34073&isLegacyBrowser=false&isPartitioningSupport=1&version=20240326_55ac2d82cc134f115fe47a2f6d79101d1306d03c&useBunnyCDN=0&themeId=140&unitType=tts-player	false		unknown
https://vd.trinitymedia.ai/trinity-player/buttons/trinity-484fef5e39bd1f12260ad07d5cc3499d.js	false	Avira URL Cloud: safe	unknown
https://trinitymedia.ai/favicon.ico	false	Avira URL Cloud: safe	unknown
https://vd.trinitymedia.ai/trinity-player/tts-player/20240326_55ac2d82cc134f115fe47a2f6d79101d1306d03c/trinity-player.js	false	Avira URL Cloud: safe	unknown

ID:	1417170
Product:	CloudBasic
Start time:	17:57:40
Start date:	28.03.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 44	ASCII text, with very long lines (65536), with no line terminators	81F00BB1F52510697DB4512C7A5E2766	B27DAC316A6EAF1F0E7E75D475053C1D15A4793A	ABBF1D84370ABCD71CA1EDAA45EDE3A7042A74A5476C9CCDD0DBF656DA8B6300
Chrome Cache Entry: 45	HTML document, ASCII text	FCE022E387FF6C2F6D73EDF21806F31E	2804564CB8FA16CF0D857888792BEDC5308EE47C	6E66B3644B52EA1456E4DC6C0F9CD8012BA781A270BD4FF3C613F14D9105195B
Chrome Cache Entry: 46	HTML document, ASCII text, with very long lines (8978)	A60BF765A07E78F27E9D5870927E1CA6	74487C40B8442270513FF71D26F713B6235E2C51	6AFF136136DAA22CCD40A72028C396AB2CDA5D31231DBEF7B49AA0A20BF492F7
Chrome Cache Entry: 47	ASCII text, with very long lines (453)	444F9BDE622BEA25C2686485C1E13E40	59CA62DFFC3DFA9A75CCDD3F3C704D225AA068A8	BC7B889274BB4E05E2DFBD158E8DAF8300BC9D47C5ABEAAD0B5A6F8F8E250F80

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs