Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 22:17

General

  • Target

    fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe

  • Size

    928KB

  • MD5

    ccdb878d630fde0f0dd9f2b394605f3d

  • SHA1

    c73f01d4a171fb9b46b0d8a059551c71d13c355d

  • SHA256

    fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827

  • SHA512

    471f05d8b31a4f1dd892e00657b2fc90ffdfc8798bf55449e5919503a119be51f7b7b3b1017cfdd3d0aac411a52c436266d135d176922d080b3d2c91f8d4093b

  • SSDEEP

    24576:ry/e658JE7Z178dF7TNDPJm9hKoKoOF9QXE4lhbKV8:e/e6FH8xk9hKZuXEs

Malware Config

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Signatures

  • Detect Mystic stealer payload 8 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe
    "C:\Users\Admin\AppData\Local\Temp\fea83d0257e158a68f352194a75f8ff5bf350e77f045b2b734698f490b12c827.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2178722.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2178722.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2956423.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2956423.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5762320.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5762320.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2620
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2976
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 276
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2536

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2178722.exe

      Filesize

      826KB

      MD5

      53205f4f9873e04adee8052e7b2e023c

      SHA1

      f243264aa408081f877ac4d6e41e62c9c7a903d1

      SHA256

      373eb9ddc82c29fe1e0b4b892943d81a7d12a75b17e58700375f5c2d87b2c7d1

      SHA512

      4010ec898899138a61872db4b7f25ff7165a922d2b955d20f7edb7e1458a37378ae0dd0cc90fd4163c2a85b0664762156248ad8d774ba0c3b86343774266140b

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2178722.exe

      Filesize

      826KB

      MD5

      53205f4f9873e04adee8052e7b2e023c

      SHA1

      f243264aa408081f877ac4d6e41e62c9c7a903d1

      SHA256

      373eb9ddc82c29fe1e0b4b892943d81a7d12a75b17e58700375f5c2d87b2c7d1

      SHA512

      4010ec898899138a61872db4b7f25ff7165a922d2b955d20f7edb7e1458a37378ae0dd0cc90fd4163c2a85b0664762156248ad8d774ba0c3b86343774266140b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2956423.exe

      Filesize

      556KB

      MD5

      a70aaebe9564cb5398443886fa7dfc18

      SHA1

      43a3abd09994152c6bdcf2af35d6da993343d177

      SHA256

      7377e9cd0a05410baa8f0b76b7a7798bf368630042f46d3863068fa966362c00

      SHA512

      965bb70459028af028b5a3b21b1afb7702ca0443199ed126ef8d0d49c6ab3a733d356b70fa33c2062b083509453c933128177ebddc273311d8d9e53561fcdbb0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2956423.exe

      Filesize

      556KB

      MD5

      a70aaebe9564cb5398443886fa7dfc18

      SHA1

      43a3abd09994152c6bdcf2af35d6da993343d177

      SHA256

      7377e9cd0a05410baa8f0b76b7a7798bf368630042f46d3863068fa966362c00

      SHA512

      965bb70459028af028b5a3b21b1afb7702ca0443199ed126ef8d0d49c6ab3a733d356b70fa33c2062b083509453c933128177ebddc273311d8d9e53561fcdbb0

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5762320.exe

      Filesize

      390KB

      MD5

      52e6bfda11be9c7f5f4fbaa119e54ac8

      SHA1

      9c1de1bcbe31b2e2fc1a1b8862571837632b8264

      SHA256

      20f91a9f41f238feb0c67fdf87057b0b4f130a014dc33977989d500381032262

      SHA512

      e8a3a9e24710780d8d0d97c932db6fd4d45490f3ab416dd622bf81ea279c063f6d7db52e7b82b8dba9969a7b05555a67468f907a709f92b53e7212d0fc1f3587

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5762320.exe

      Filesize

      390KB

      MD5

      52e6bfda11be9c7f5f4fbaa119e54ac8

      SHA1

      9c1de1bcbe31b2e2fc1a1b8862571837632b8264

      SHA256

      20f91a9f41f238feb0c67fdf87057b0b4f130a014dc33977989d500381032262

      SHA512

      e8a3a9e24710780d8d0d97c932db6fd4d45490f3ab416dd622bf81ea279c063f6d7db52e7b82b8dba9969a7b05555a67468f907a709f92b53e7212d0fc1f3587

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe

      Filesize

      356KB

      MD5

      e2a7fb4215581c10aa65ad047a3a818c

      SHA1

      13e0b97e71b42cf7db6dfef300e83feae0416f64

      SHA256

      c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523

      SHA512

      3cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe

      Filesize

      356KB

      MD5

      e2a7fb4215581c10aa65ad047a3a818c

      SHA1

      13e0b97e71b42cf7db6dfef300e83feae0416f64

      SHA256

      c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523

      SHA512

      3cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe

      Filesize

      356KB

      MD5

      e2a7fb4215581c10aa65ad047a3a818c

      SHA1

      13e0b97e71b42cf7db6dfef300e83feae0416f64

      SHA256

      c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523

      SHA512

      3cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x2178722.exe

      Filesize

      826KB

      MD5

      53205f4f9873e04adee8052e7b2e023c

      SHA1

      f243264aa408081f877ac4d6e41e62c9c7a903d1

      SHA256

      373eb9ddc82c29fe1e0b4b892943d81a7d12a75b17e58700375f5c2d87b2c7d1

      SHA512

      4010ec898899138a61872db4b7f25ff7165a922d2b955d20f7edb7e1458a37378ae0dd0cc90fd4163c2a85b0664762156248ad8d774ba0c3b86343774266140b

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x2178722.exe

      Filesize

      826KB

      MD5

      53205f4f9873e04adee8052e7b2e023c

      SHA1

      f243264aa408081f877ac4d6e41e62c9c7a903d1

      SHA256

      373eb9ddc82c29fe1e0b4b892943d81a7d12a75b17e58700375f5c2d87b2c7d1

      SHA512

      4010ec898899138a61872db4b7f25ff7165a922d2b955d20f7edb7e1458a37378ae0dd0cc90fd4163c2a85b0664762156248ad8d774ba0c3b86343774266140b

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x2956423.exe

      Filesize

      556KB

      MD5

      a70aaebe9564cb5398443886fa7dfc18

      SHA1

      43a3abd09994152c6bdcf2af35d6da993343d177

      SHA256

      7377e9cd0a05410baa8f0b76b7a7798bf368630042f46d3863068fa966362c00

      SHA512

      965bb70459028af028b5a3b21b1afb7702ca0443199ed126ef8d0d49c6ab3a733d356b70fa33c2062b083509453c933128177ebddc273311d8d9e53561fcdbb0

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x2956423.exe

      Filesize

      556KB

      MD5

      a70aaebe9564cb5398443886fa7dfc18

      SHA1

      43a3abd09994152c6bdcf2af35d6da993343d177

      SHA256

      7377e9cd0a05410baa8f0b76b7a7798bf368630042f46d3863068fa966362c00

      SHA512

      965bb70459028af028b5a3b21b1afb7702ca0443199ed126ef8d0d49c6ab3a733d356b70fa33c2062b083509453c933128177ebddc273311d8d9e53561fcdbb0

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x5762320.exe

      Filesize

      390KB

      MD5

      52e6bfda11be9c7f5f4fbaa119e54ac8

      SHA1

      9c1de1bcbe31b2e2fc1a1b8862571837632b8264

      SHA256

      20f91a9f41f238feb0c67fdf87057b0b4f130a014dc33977989d500381032262

      SHA512

      e8a3a9e24710780d8d0d97c932db6fd4d45490f3ab416dd622bf81ea279c063f6d7db52e7b82b8dba9969a7b05555a67468f907a709f92b53e7212d0fc1f3587

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x5762320.exe

      Filesize

      390KB

      MD5

      52e6bfda11be9c7f5f4fbaa119e54ac8

      SHA1

      9c1de1bcbe31b2e2fc1a1b8862571837632b8264

      SHA256

      20f91a9f41f238feb0c67fdf87057b0b4f130a014dc33977989d500381032262

      SHA512

      e8a3a9e24710780d8d0d97c932db6fd4d45490f3ab416dd622bf81ea279c063f6d7db52e7b82b8dba9969a7b05555a67468f907a709f92b53e7212d0fc1f3587

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe

      Filesize

      356KB

      MD5

      e2a7fb4215581c10aa65ad047a3a818c

      SHA1

      13e0b97e71b42cf7db6dfef300e83feae0416f64

      SHA256

      c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523

      SHA512

      3cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe

      Filesize

      356KB

      MD5

      e2a7fb4215581c10aa65ad047a3a818c

      SHA1

      13e0b97e71b42cf7db6dfef300e83feae0416f64

      SHA256

      c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523

      SHA512

      3cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe

      Filesize

      356KB

      MD5

      e2a7fb4215581c10aa65ad047a3a818c

      SHA1

      13e0b97e71b42cf7db6dfef300e83feae0416f64

      SHA256

      c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523

      SHA512

      3cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe

      Filesize

      356KB

      MD5

      e2a7fb4215581c10aa65ad047a3a818c

      SHA1

      13e0b97e71b42cf7db6dfef300e83feae0416f64

      SHA256

      c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523

      SHA512

      3cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe

      Filesize

      356KB

      MD5

      e2a7fb4215581c10aa65ad047a3a818c

      SHA1

      13e0b97e71b42cf7db6dfef300e83feae0416f64

      SHA256

      c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523

      SHA512

      3cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe

      Filesize

      356KB

      MD5

      e2a7fb4215581c10aa65ad047a3a818c

      SHA1

      13e0b97e71b42cf7db6dfef300e83feae0416f64

      SHA256

      c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523

      SHA512

      3cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8619343.exe

      Filesize

      356KB

      MD5

      e2a7fb4215581c10aa65ad047a3a818c

      SHA1

      13e0b97e71b42cf7db6dfef300e83feae0416f64

      SHA256

      c826fa04ee7b3744ef3863b2665d1f1d57f25375e237413af032fd52e0b13523

      SHA512

      3cbf489ab7d7815af4c10568f8ddda08f9772ffafed2330b46e72b83f112171620b2792fbfc7e1432c783c09ec7e4584b4f8e859a58f7ea40cdd9b6bbe2b689a

    • memory/2976-56-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2976-58-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2976-55-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2976-53-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2976-51-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2976-60-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2976-61-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2976-45-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2976-47-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2976-49-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2976-65-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2976-43-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB