Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe
Resource
win10v2004-20230915-en
General
-
Target
fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe
-
Size
928KB
-
MD5
ccdb878d630fde0f0dd9f2b394605f3d
-
SHA1
c73f01d4a171fb9b46b0d8a059551c71d13c355d
-
SHA256
fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827
-
SHA512
471f05d8b31a4f1dd892e00657b2fc90ffdfc8798bf55449e5919503a119be51f7b7b3b1017cfdd3d0aac411a52c436266d135d176922d080b3d2c91f8d4093b
-
SSDEEP
24576:ry/e658JE7Z178dF7TNDPJm9hKoKoOF9QXE4lhbKV8:e/e6FH8xk9hKZuXEs
Malware Config
Extracted
mystic
http://5.42.92.211/loghub/master
Signatures
-
Detect Mystic stealer payload 8 IoCs
resource yara_rule behavioral1/memory/2976-49-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2976-56-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2976-58-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2976-53-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2976-51-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2976-60-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2976-61-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2976-65-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Executes dropped EXE 4 IoCs
pid Process 2580 x2178722.exe 2748 x2956423.exe 2592 x5762320.exe 2620 g8619343.exe -
Loads dropped DLL 13 IoCs
pid Process 2568 fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe 2580 x2178722.exe 2580 x2178722.exe 2748 x2956423.exe 2748 x2956423.exe 2592 x5762320.exe 2592 x5762320.exe 2592 x5762320.exe 2620 g8619343.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x2178722.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x2956423.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x5762320.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2620 set thread context of 2976 2620 g8619343.exe 33 -
Program crash 1 IoCs
pid pid_target Process procid_target 2536 2620 WerFault.exe 31 -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2580 2568 fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe 28 PID 2568 wrote to memory of 2580 2568 fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe 28 PID 2568 wrote to memory of 2580 2568 fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe 28 PID 2568 wrote to memory of 2580 2568 fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe 28 PID 2568 wrote to memory of 2580 2568 fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe 28 PID 2568 wrote to memory of 2580 2568 fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe 28 PID 2568 wrote to memory of 2580 2568 fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe 28 PID 2580 wrote to memory of 2748 2580 x2178722.exe 29 PID 2580 wrote to memory of 2748 2580 x2178722.exe 29 PID 2580 wrote to memory of 2748 2580 x2178722.exe 29 PID 2580 wrote to memory of 2748 2580 x2178722.exe 29 PID 2580 wrote to memory of 2748 2580 x2178722.exe 29 PID 2580 wrote to memory of 2748 2580 x2178722.exe 29 PID 2580 wrote to memory of 2748 2580 x2178722.exe 29 PID 2748 wrote to memory of 2592 2748 x2956423.exe 30 PID 2748 wrote to memory of 2592 2748 x2956423.exe 30 PID 2748 wrote to memory of 2592 2748 x2956423.exe 30 PID 2748 wrote to memory of 2592 2748 x2956423.exe 30 PID 2748 wrote to memory of 2592 2748 x2956423.exe 30 PID 2748 wrote to memory of 2592 2748 x2956423.exe 30 PID 2748 wrote to memory of 2592 2748 x2956423.exe 30 PID 2592 wrote to memory of 2620 2592 x5762320.exe 31 PID 2592 wrote to memory of 2620 2592 x5762320.exe 31 PID 2592 wrote to memory of 2620 2592 x5762320.exe 31 PID 2592 wrote to memory of 2620 2592 x5762320.exe 31 PID 2592 wrote to memory of 2620 2592 x5762320.exe 31 PID 2592 wrote to memory of 2620 2592 x5762320.exe 31 PID 2592 wrote to memory of 2620 2592 x5762320.exe 31 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2976 2620 g8619343.exe 33 PID 2620 wrote to memory of 2536 2620 g8619343.exe 34 PID 2620 wrote to memory of 2536 2620 g8619343.exe 34 PID 2620 wrote to memory of 2536 2620 g8619343.exe 34 PID 2620 wrote to memory of 2536 2620 g8619343.exe 34 PID 2620 wrote to memory of 2536 2620 g8619343.exe 34 PID 2620 wrote to memory of 2536 2620 g8619343.exe 34 PID 2620 wrote to memory of 2536 2620 g8619343.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe"C:\Users\Admin\AppData\Local\Temp\fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2178722.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2178722.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2956423.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2956423.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5762320.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5762320.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 2766⤵
- Loads dropped DLL
- Program crash
PID:2536
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
826KB
MD553205f4f9873e04adee8052e7b2e023c
SHA1f243264aa408081f877ac4d6e41e62c9c7a903d1
SHA256373eb9ddc82c29fe1e0b4b892943d81a7d12a75b17e58700375f5c2d87b2c7d1
SHA5124010ec898899138a61872db4b7f25ff7165a922d2b955d20f7edb7e1458a37378ae0dd0cc90fd4163c2a85b0664762156248ad8d774ba0c3b86343774266140b
-
Filesize
826KB
MD553205f4f9873e04adee8052e7b2e023c
SHA1f243264aa408081f877ac4d6e41e62c9c7a903d1
SHA256373eb9ddc82c29fe1e0b4b892943d81a7d12a75b17e58700375f5c2d87b2c7d1
SHA5124010ec898899138a61872db4b7f25ff7165a922d2b955d20f7edb7e1458a37378ae0dd0cc90fd4163c2a85b0664762156248ad8d774ba0c3b86343774266140b
-
Filesize
556KB
MD5a70aaebe9564cb5398443886fa7dfc18
SHA143a3abd09994152c6bdcf2af35d6da993343d177
SHA2567377e9cd0a05410baa8f0b76b7a7798bf368630042f46d3863068fa966362c00
SHA512965bb70459028af028b5a3b21b1afb7702ca0443199ed126ef8d0d49c6ab3a733d356b70fa33c2062b083509453c933128177ebddc273311d8d9e53561fcdbb0
-
Filesize
556KB
MD5a70aaebe9564cb5398443886fa7dfc18
SHA143a3abd09994152c6bdcf2af35d6da993343d177
SHA2567377e9cd0a05410baa8f0b76b7a7798bf368630042f46d3863068fa966362c00
SHA512965bb70459028af028b5a3b21b1afb7702ca0443199ed126ef8d0d49c6ab3a733d356b70fa33c2062b083509453c933128177ebddc273311d8d9e53561fcdbb0
-
Filesize
390KB
MD552e6bfda11be9c7f5f4fbaa119e54ac8
SHA19c1de1bcbe31b2e2fc1a1b8862571837632b8264
SHA25620f91a9f41f238feb0c67fdf87057b0b4f130a014dc33977989d500381032262
SHA512e8a3a9e24710780d8d0d97c932db6fd4d45490f3ab416dd622bf81ea279c063f6d7db52e7b82b8dba9969a7b05555a67468f907a709f92b53e7212d0fc1f3587
-
Filesize
390KB
MD552e6bfda11be9c7f5f4fbaa119e54ac8
SHA19c1de1bcbe31b2e2fc1a1b8862571837632b8264
SHA25620f91a9f41f238feb0c67fdf87057b0b4f130a014dc33977989d500381032262
SHA512e8a3a9e24710780d8d0d97c932db6fd4d45490f3ab416dd622bf81ea279c063f6d7db52e7b82b8dba9969a7b05555a67468f907a709f92b53e7212d0fc1f3587
-
Filesize
356KB
MD5e2a7fb4215581c10aa65ad047a3a818c
SHA113e0b97e71b42cf7db6dfef300e83feae0416f64
SHA256c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523
SHA5123cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a
-
Filesize
356KB
MD5e2a7fb4215581c10aa65ad047a3a818c
SHA113e0b97e71b42cf7db6dfef300e83feae0416f64
SHA256c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523
SHA5123cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a
-
Filesize
356KB
MD5e2a7fb4215581c10aa65ad047a3a818c
SHA113e0b97e71b42cf7db6dfef300e83feae0416f64
SHA256c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523
SHA5123cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a
-
Filesize
826KB
MD553205f4f9873e04adee8052e7b2e023c
SHA1f243264aa408081f877ac4d6e41e62c9c7a903d1
SHA256373eb9ddc82c29fe1e0b4b892943d81a7d12a75b17e58700375f5c2d87b2c7d1
SHA5124010ec898899138a61872db4b7f25ff7165a922d2b955d20f7edb7e1458a37378ae0dd0cc90fd4163c2a85b0664762156248ad8d774ba0c3b86343774266140b
-
Filesize
826KB
MD553205f4f9873e04adee8052e7b2e023c
SHA1f243264aa408081f877ac4d6e41e62c9c7a903d1
SHA256373eb9ddc82c29fe1e0b4b892943d81a7d12a75b17e58700375f5c2d87b2c7d1
SHA5124010ec898899138a61872db4b7f25ff7165a922d2b955d20f7edb7e1458a37378ae0dd0cc90fd4163c2a85b0664762156248ad8d774ba0c3b86343774266140b
-
Filesize
556KB
MD5a70aaebe9564cb5398443886fa7dfc18
SHA143a3abd09994152c6bdcf2af35d6da993343d177
SHA2567377e9cd0a05410baa8f0b76b7a7798bf368630042f46d3863068fa966362c00
SHA512965bb70459028af028b5a3b21b1afb7702ca0443199ed126ef8d0d49c6ab3a733d356b70fa33c2062b083509453c933128177ebddc273311d8d9e53561fcdbb0
-
Filesize
556KB
MD5a70aaebe9564cb5398443886fa7dfc18
SHA143a3abd09994152c6bdcf2af35d6da993343d177
SHA2567377e9cd0a05410baa8f0b76b7a7798bf368630042f46d3863068fa966362c00
SHA512965bb70459028af028b5a3b21b1afb7702ca0443199ed126ef8d0d49c6ab3a733d356b70fa33c2062b083509453c933128177ebddc273311d8d9e53561fcdbb0
-
Filesize
390KB
MD552e6bfda11be9c7f5f4fbaa119e54ac8
SHA19c1de1bcbe31b2e2fc1a1b8862571837632b8264
SHA25620f91a9f41f238feb0c67fdf87057b0b4f130a014dc33977989d500381032262
SHA512e8a3a9e24710780d8d0d97c932db6fd4d45490f3ab416dd622bf81ea279c063f6d7db52e7b82b8dba9969a7b05555a67468f907a709f92b53e7212d0fc1f3587
-
Filesize
390KB
MD552e6bfda11be9c7f5f4fbaa119e54ac8
SHA19c1de1bcbe31b2e2fc1a1b8862571837632b8264
SHA25620f91a9f41f238feb0c67fdf87057b0b4f130a014dc33977989d500381032262
SHA512e8a3a9e24710780d8d0d97c932db6fd4d45490f3ab416dd622bf81ea279c063f6d7db52e7b82b8dba9969a7b05555a67468f907a709f92b53e7212d0fc1f3587
-
Filesize
356KB
MD5e2a7fb4215581c10aa65ad047a3a818c
SHA113e0b97e71b42cf7db6dfef300e83feae0416f64
SHA256c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523
SHA5123cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a
-
Filesize
356KB
MD5e2a7fb4215581c10aa65ad047a3a818c
SHA113e0b97e71b42cf7db6dfef300e83feae0416f64
SHA256c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523
SHA5123cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a
-
Filesize
356KB
MD5e2a7fb4215581c10aa65ad047a3a818c
SHA113e0b97e71b42cf7db6dfef300e83feae0416f64
SHA256c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523
SHA5123cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a
-
Filesize
356KB
MD5e2a7fb4215581c10aa65ad047a3a818c
SHA113e0b97e71b42cf7db6dfef300e83feae0416f64
SHA256c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523
SHA5123cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a
-
Filesize
356KB
MD5e2a7fb4215581c10aa65ad047a3a818c
SHA113e0b97e71b42cf7db6dfef300e83feae0416f64
SHA256c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523
SHA5123cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a
-
Filesize
356KB
MD5e2a7fb4215581c10aa65ad047a3a818c
SHA113e0b97e71b42cf7db6dfef300e83feae0416f64
SHA256c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523
SHA5123cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a
-
Filesize
356KB
MD5e2a7fb4215581c10aa65ad047a3a818c
SHA113e0b97e71b42cf7db6dfef300e83feae0416f64
SHA256c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523
SHA5123cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a