Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2023, 09:12

General

  • Target

    12497ca29546c2775dfa623384b97953811561d7f20875d8272e4178a7dec6be.exe

  • Size

    1.5MB

  • MD5

    b39ba711f58d8e4f686077a89c3b1994

  • SHA1

    e60b9219b60c3fa79259c0980adc26172979ff57

  • SHA256

    12497ca29546c2775dfa623384b97953811561d7f20875d8272e4178a7dec6be

  • SHA512

    5d1c7d028e2fcd8021335a0e565214e1291c7736bf0b161f0b54fd66daa1d5f309362830b49ed97f10e9ed8b1671c32a86d06e2eaa1b03f0b78b41d2be4cda9c

  • SSDEEP

    49152:9GxCiy1l8+EVsikThv/PvKjud2shGoXQtMuscUyT:0wiyg7iLlv/Ku5koXQtv

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12497ca29546c2775dfa623384b97953811561d7f20875d8272e4178a7dec6be.exe
    "C:\Users\Admin\AppData\Local\Temp\12497ca29546c2775dfa623384b97953811561d7f20875d8272e4178a7dec6be.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TY3SO02.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TY3SO02.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xa8Aa00.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xa8Aa00.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nb0zG42.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nb0zG42.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2688
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1AL55oV6.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1AL55oV6.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2648
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2yN4531.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2yN4531.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2612
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:3064
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 284
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2828

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TY3SO02.exe

      Filesize

      1.4MB

      MD5

      96ca176e0c0841180befefb973e5142b

      SHA1

      34ef3e0f0f36d29317b12e87f794fb45431866f9

      SHA256

      9af366f7966723f086c77a52de05c7e44e63b0a9ef8db6a56fd6fc86d8d8cc95

      SHA512

      5747d68a3d14d334e36dd5b12e3d53150eda59c31ef58251a3df674651af8ea33e747af5cde6327a22fd4df73e41d7fdc74956afd25a3029b5c4613f78d7652c

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TY3SO02.exe

      Filesize

      1.4MB

      MD5

      96ca176e0c0841180befefb973e5142b

      SHA1

      34ef3e0f0f36d29317b12e87f794fb45431866f9

      SHA256

      9af366f7966723f086c77a52de05c7e44e63b0a9ef8db6a56fd6fc86d8d8cc95

      SHA512

      5747d68a3d14d334e36dd5b12e3d53150eda59c31ef58251a3df674651af8ea33e747af5cde6327a22fd4df73e41d7fdc74956afd25a3029b5c4613f78d7652c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xa8Aa00.exe

      Filesize

      985KB

      MD5

      27e5f682cef4230516b74e81ae0af215

      SHA1

      d24fcd2fc838f82689607940bcecc873c760a636

      SHA256

      6fa804e001b2f108bd2aee43a115aa44cecc8d2377400d2658e898270716ef4b

      SHA512

      eff5006ae456d94409c4bbae610bbf802b7616e4338e313b496baad5fbdddd6fae5ca2f83d10edb82dc1278cbe402764998dcbead8011be6fb724dace8b36346

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xa8Aa00.exe

      Filesize

      985KB

      MD5

      27e5f682cef4230516b74e81ae0af215

      SHA1

      d24fcd2fc838f82689607940bcecc873c760a636

      SHA256

      6fa804e001b2f108bd2aee43a115aa44cecc8d2377400d2658e898270716ef4b

      SHA512

      eff5006ae456d94409c4bbae610bbf802b7616e4338e313b496baad5fbdddd6fae5ca2f83d10edb82dc1278cbe402764998dcbead8011be6fb724dace8b36346

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nb0zG42.exe

      Filesize

      598KB

      MD5

      d5020124ce25d96dfe71660ad4991691

      SHA1

      64039fd9d1402b5fff84c1a7dea596b84032bd67

      SHA256

      43a52e3915ebbe598ba421c653c4eb5679e6967126c3d395665d495ba97b9649

      SHA512

      827a3f8683d9eed7e0d321c73e8c976135cfd72f55c0c52c599c2ff763a325092d8e66dae2174ffe3a8be527881265088b3ae79676cdb7b6d9fa0e55a1c2a37b

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nb0zG42.exe

      Filesize

      598KB

      MD5

      d5020124ce25d96dfe71660ad4991691

      SHA1

      64039fd9d1402b5fff84c1a7dea596b84032bd67

      SHA256

      43a52e3915ebbe598ba421c653c4eb5679e6967126c3d395665d495ba97b9649

      SHA512

      827a3f8683d9eed7e0d321c73e8c976135cfd72f55c0c52c599c2ff763a325092d8e66dae2174ffe3a8be527881265088b3ae79676cdb7b6d9fa0e55a1c2a37b

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1AL55oV6.exe

      Filesize

      192KB

      MD5

      8904f85abd522c7d0cb5789d9583ccff

      SHA1

      5b34d8595b37c9e1fb9682b06dc5228efe07f0c6

      SHA256

      7624b62fe97c8e370c82bc86f69c2f627328e701ce1f3d9bed92a1e5fe11fd7f

      SHA512

      04dd0c4e612b6287af6a655425085d687538d756dcd639ecb6c62bcdafddde52c56ae305a6240ee1329a95d9cc59dee6de5000d273a5a560ad1adc3284e00e12

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1AL55oV6.exe

      Filesize

      192KB

      MD5

      8904f85abd522c7d0cb5789d9583ccff

      SHA1

      5b34d8595b37c9e1fb9682b06dc5228efe07f0c6

      SHA256

      7624b62fe97c8e370c82bc86f69c2f627328e701ce1f3d9bed92a1e5fe11fd7f

      SHA512

      04dd0c4e612b6287af6a655425085d687538d756dcd639ecb6c62bcdafddde52c56ae305a6240ee1329a95d9cc59dee6de5000d273a5a560ad1adc3284e00e12

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2yN4531.exe

      Filesize

      1.4MB

      MD5

      6f08aa0f1624b8c9c13e746e6e8d29d2

      SHA1

      0fc34fe7ed64a7dd8d5b1967cf1ac5984aaacdcd

      SHA256

      7ab9ec95b6688eb3de8403c0c5c04aed352250237397da30d974640d8eeea62e

      SHA512

      6c5f978d2c52cfc8c60d6fbaeaf0afd5eb7f591e1cbcfd9baccd5f6e433dca5100e222bfd8a574d98595802c20226fe851aaf7adea65ea232a250aa8289c6f7f

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2yN4531.exe

      Filesize

      1.4MB

      MD5

      6f08aa0f1624b8c9c13e746e6e8d29d2

      SHA1

      0fc34fe7ed64a7dd8d5b1967cf1ac5984aaacdcd

      SHA256

      7ab9ec95b6688eb3de8403c0c5c04aed352250237397da30d974640d8eeea62e

      SHA512

      6c5f978d2c52cfc8c60d6fbaeaf0afd5eb7f591e1cbcfd9baccd5f6e433dca5100e222bfd8a574d98595802c20226fe851aaf7adea65ea232a250aa8289c6f7f

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\TY3SO02.exe

      Filesize

      1.4MB

      MD5

      96ca176e0c0841180befefb973e5142b

      SHA1

      34ef3e0f0f36d29317b12e87f794fb45431866f9

      SHA256

      9af366f7966723f086c77a52de05c7e44e63b0a9ef8db6a56fd6fc86d8d8cc95

      SHA512

      5747d68a3d14d334e36dd5b12e3d53150eda59c31ef58251a3df674651af8ea33e747af5cde6327a22fd4df73e41d7fdc74956afd25a3029b5c4613f78d7652c

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\TY3SO02.exe

      Filesize

      1.4MB

      MD5

      96ca176e0c0841180befefb973e5142b

      SHA1

      34ef3e0f0f36d29317b12e87f794fb45431866f9

      SHA256

      9af366f7966723f086c77a52de05c7e44e63b0a9ef8db6a56fd6fc86d8d8cc95

      SHA512

      5747d68a3d14d334e36dd5b12e3d53150eda59c31ef58251a3df674651af8ea33e747af5cde6327a22fd4df73e41d7fdc74956afd25a3029b5c4613f78d7652c

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Xa8Aa00.exe

      Filesize

      985KB

      MD5

      27e5f682cef4230516b74e81ae0af215

      SHA1

      d24fcd2fc838f82689607940bcecc873c760a636

      SHA256

      6fa804e001b2f108bd2aee43a115aa44cecc8d2377400d2658e898270716ef4b

      SHA512

      eff5006ae456d94409c4bbae610bbf802b7616e4338e313b496baad5fbdddd6fae5ca2f83d10edb82dc1278cbe402764998dcbead8011be6fb724dace8b36346

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Xa8Aa00.exe

      Filesize

      985KB

      MD5

      27e5f682cef4230516b74e81ae0af215

      SHA1

      d24fcd2fc838f82689607940bcecc873c760a636

      SHA256

      6fa804e001b2f108bd2aee43a115aa44cecc8d2377400d2658e898270716ef4b

      SHA512

      eff5006ae456d94409c4bbae610bbf802b7616e4338e313b496baad5fbdddd6fae5ca2f83d10edb82dc1278cbe402764998dcbead8011be6fb724dace8b36346

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\nb0zG42.exe

      Filesize

      598KB

      MD5

      d5020124ce25d96dfe71660ad4991691

      SHA1

      64039fd9d1402b5fff84c1a7dea596b84032bd67

      SHA256

      43a52e3915ebbe598ba421c653c4eb5679e6967126c3d395665d495ba97b9649

      SHA512

      827a3f8683d9eed7e0d321c73e8c976135cfd72f55c0c52c599c2ff763a325092d8e66dae2174ffe3a8be527881265088b3ae79676cdb7b6d9fa0e55a1c2a37b

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\nb0zG42.exe

      Filesize

      598KB

      MD5

      d5020124ce25d96dfe71660ad4991691

      SHA1

      64039fd9d1402b5fff84c1a7dea596b84032bd67

      SHA256

      43a52e3915ebbe598ba421c653c4eb5679e6967126c3d395665d495ba97b9649

      SHA512

      827a3f8683d9eed7e0d321c73e8c976135cfd72f55c0c52c599c2ff763a325092d8e66dae2174ffe3a8be527881265088b3ae79676cdb7b6d9fa0e55a1c2a37b

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1AL55oV6.exe

      Filesize

      192KB

      MD5

      8904f85abd522c7d0cb5789d9583ccff

      SHA1

      5b34d8595b37c9e1fb9682b06dc5228efe07f0c6

      SHA256

      7624b62fe97c8e370c82bc86f69c2f627328e701ce1f3d9bed92a1e5fe11fd7f

      SHA512

      04dd0c4e612b6287af6a655425085d687538d756dcd639ecb6c62bcdafddde52c56ae305a6240ee1329a95d9cc59dee6de5000d273a5a560ad1adc3284e00e12

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1AL55oV6.exe

      Filesize

      192KB

      MD5

      8904f85abd522c7d0cb5789d9583ccff

      SHA1

      5b34d8595b37c9e1fb9682b06dc5228efe07f0c6

      SHA256

      7624b62fe97c8e370c82bc86f69c2f627328e701ce1f3d9bed92a1e5fe11fd7f

      SHA512

      04dd0c4e612b6287af6a655425085d687538d756dcd639ecb6c62bcdafddde52c56ae305a6240ee1329a95d9cc59dee6de5000d273a5a560ad1adc3284e00e12

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yN4531.exe

      Filesize

      1.4MB

      MD5

      6f08aa0f1624b8c9c13e746e6e8d29d2

      SHA1

      0fc34fe7ed64a7dd8d5b1967cf1ac5984aaacdcd

      SHA256

      7ab9ec95b6688eb3de8403c0c5c04aed352250237397da30d974640d8eeea62e

      SHA512

      6c5f978d2c52cfc8c60d6fbaeaf0afd5eb7f591e1cbcfd9baccd5f6e433dca5100e222bfd8a574d98595802c20226fe851aaf7adea65ea232a250aa8289c6f7f

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yN4531.exe

      Filesize

      1.4MB

      MD5

      6f08aa0f1624b8c9c13e746e6e8d29d2

      SHA1

      0fc34fe7ed64a7dd8d5b1967cf1ac5984aaacdcd

      SHA256

      7ab9ec95b6688eb3de8403c0c5c04aed352250237397da30d974640d8eeea62e

      SHA512

      6c5f978d2c52cfc8c60d6fbaeaf0afd5eb7f591e1cbcfd9baccd5f6e433dca5100e222bfd8a574d98595802c20226fe851aaf7adea65ea232a250aa8289c6f7f

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yN4531.exe

      Filesize

      1.4MB

      MD5

      6f08aa0f1624b8c9c13e746e6e8d29d2

      SHA1

      0fc34fe7ed64a7dd8d5b1967cf1ac5984aaacdcd

      SHA256

      7ab9ec95b6688eb3de8403c0c5c04aed352250237397da30d974640d8eeea62e

      SHA512

      6c5f978d2c52cfc8c60d6fbaeaf0afd5eb7f591e1cbcfd9baccd5f6e433dca5100e222bfd8a574d98595802c20226fe851aaf7adea65ea232a250aa8289c6f7f

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yN4531.exe

      Filesize

      1.4MB

      MD5

      6f08aa0f1624b8c9c13e746e6e8d29d2

      SHA1

      0fc34fe7ed64a7dd8d5b1967cf1ac5984aaacdcd

      SHA256

      7ab9ec95b6688eb3de8403c0c5c04aed352250237397da30d974640d8eeea62e

      SHA512

      6c5f978d2c52cfc8c60d6fbaeaf0afd5eb7f591e1cbcfd9baccd5f6e433dca5100e222bfd8a574d98595802c20226fe851aaf7adea65ea232a250aa8289c6f7f

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yN4531.exe

      Filesize

      1.4MB

      MD5

      6f08aa0f1624b8c9c13e746e6e8d29d2

      SHA1

      0fc34fe7ed64a7dd8d5b1967cf1ac5984aaacdcd

      SHA256

      7ab9ec95b6688eb3de8403c0c5c04aed352250237397da30d974640d8eeea62e

      SHA512

      6c5f978d2c52cfc8c60d6fbaeaf0afd5eb7f591e1cbcfd9baccd5f6e433dca5100e222bfd8a574d98595802c20226fe851aaf7adea65ea232a250aa8289c6f7f

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yN4531.exe

      Filesize

      1.4MB

      MD5

      6f08aa0f1624b8c9c13e746e6e8d29d2

      SHA1

      0fc34fe7ed64a7dd8d5b1967cf1ac5984aaacdcd

      SHA256

      7ab9ec95b6688eb3de8403c0c5c04aed352250237397da30d974640d8eeea62e

      SHA512

      6c5f978d2c52cfc8c60d6fbaeaf0afd5eb7f591e1cbcfd9baccd5f6e433dca5100e222bfd8a574d98595802c20226fe851aaf7adea65ea232a250aa8289c6f7f

    • memory/2648-61-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-69-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-65-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-59-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-57-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-55-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-51-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-49-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-47-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-43-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-67-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-53-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-45-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-40-0x0000000000450000-0x000000000046E000-memory.dmp

      Filesize

      120KB

    • memory/2648-41-0x00000000006B0000-0x00000000006CC000-memory.dmp

      Filesize

      112KB

    • memory/2648-63-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2648-42-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/3064-80-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3064-86-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3064-88-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/3064-89-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3064-91-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3064-93-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3064-94-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3064-84-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3064-82-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3064-78-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3064-98-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3064-76-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB