Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 06:20

General

  • Target

    14bc88936f16cc3e89403e71e28caa14e9adba4e0517f45c253bee216bce57e4.exe

  • Size

    927KB

  • MD5

    29e8556f9a3b0da65e69a749bc7ba9f1

  • SHA1

    7a7d5b374792a76c0a445f2cf903dd839989ebdc

  • SHA256

    14bc88936f16cc3e89403e71e28caa14e9adba4e0517f45c253bee216bce57e4

  • SHA512

    691bea750d217024bd5810d8491d112f3b6dbe020220e120ccf35a451448c2f2ea74d0c519b284bd513f7f591c3f6f7fca54e207bf5b45d7c6e36acc03ce32bb

  • SSDEEP

    12288:2MrOy903S/L8GGyFLkiHWkhgUd6ghP5diqPZhW18dGLMDJHV09mdeRvgeuHh:cyCSD8GGyFgEGzYzZhP4MDJ69vR8Hh

Malware Config

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Signatures

  • Detect Mystic stealer payload 8 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14bc88936f16cc3e89403e71e28caa14e9adba4e0517f45c253bee216bce57e4.exe
    "C:\Users\Admin\AppData\Local\Temp\14bc88936f16cc3e89403e71e28caa14e9adba4e0517f45c253bee216bce57e4.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9269641.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9269641.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4064195.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4064195.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9153426.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9153426.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2600
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:1548
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 276
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9269641.exe

      Filesize

      826KB

      MD5

      1ccf60a640436858d17917060f0b6d24

      SHA1

      32f26bf09cd892be7b85ac3be9fb3cc4ff70cce1

      SHA256

      57fa3a6065237940d928469891d6fdadaf4623d1aaf8a2a41d1f756b21fb6c04

      SHA512

      4ecf5feb87f87ee07f111c938575dab92c0fb2a0b3e37a49b7628f1cc852cd01a2382cbdb856b8d91d1846be27fa49c0d8b3ebb4980eace1f2844ef07b0ef680

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9269641.exe

      Filesize

      826KB

      MD5

      1ccf60a640436858d17917060f0b6d24

      SHA1

      32f26bf09cd892be7b85ac3be9fb3cc4ff70cce1

      SHA256

      57fa3a6065237940d928469891d6fdadaf4623d1aaf8a2a41d1f756b21fb6c04

      SHA512

      4ecf5feb87f87ee07f111c938575dab92c0fb2a0b3e37a49b7628f1cc852cd01a2382cbdb856b8d91d1846be27fa49c0d8b3ebb4980eace1f2844ef07b0ef680

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4064195.exe

      Filesize

      555KB

      MD5

      c25ad9c8d5d867d10d820e9c2677c5df

      SHA1

      0c8a3135b83f03f905effa904471e97a6f5bff10

      SHA256

      bd78ce7659c914eb3210175059a8513b4e4bca4998c091e9483d906296fd3a24

      SHA512

      ff90644ddd3f16b6496baf17b5ea40bfeb5c344d868b6f4804d95eec67748a2bf6361234a32e2b7a7836191b2359a681fd22b44ec91d41ed9721b2aeed372f36

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4064195.exe

      Filesize

      555KB

      MD5

      c25ad9c8d5d867d10d820e9c2677c5df

      SHA1

      0c8a3135b83f03f905effa904471e97a6f5bff10

      SHA256

      bd78ce7659c914eb3210175059a8513b4e4bca4998c091e9483d906296fd3a24

      SHA512

      ff90644ddd3f16b6496baf17b5ea40bfeb5c344d868b6f4804d95eec67748a2bf6361234a32e2b7a7836191b2359a681fd22b44ec91d41ed9721b2aeed372f36

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9153426.exe

      Filesize

      390KB

      MD5

      d42221c127f88bca6c93f383e57089c8

      SHA1

      0789a6f5f5ab346fcb702637318cbbec6563d3a5

      SHA256

      c7014a23d82c4a22c11d17a00594e6e440ee62f79ee2b58f524a6378d5ee950f

      SHA512

      d766efd8b1a70f1a8b48ff88caa3ba0933a5982ed2a77f58abfeef919335c15ffae5164f2d5e8c17379ffa6cac08cabb581854eac5350e4cfe1ac6f3d71a82a5

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9153426.exe

      Filesize

      390KB

      MD5

      d42221c127f88bca6c93f383e57089c8

      SHA1

      0789a6f5f5ab346fcb702637318cbbec6563d3a5

      SHA256

      c7014a23d82c4a22c11d17a00594e6e440ee62f79ee2b58f524a6378d5ee950f

      SHA512

      d766efd8b1a70f1a8b48ff88caa3ba0933a5982ed2a77f58abfeef919335c15ffae5164f2d5e8c17379ffa6cac08cabb581854eac5350e4cfe1ac6f3d71a82a5

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe

      Filesize

      356KB

      MD5

      c230996cbf08f369c9a0ce1f0dfd44b1

      SHA1

      c13e8505e0c678fd074cbcd4e1009a6bb761215b

      SHA256

      cbaf03a1e5ac1403b1380c640296869f40a3a3ea80c06217a049ab3554c01755

      SHA512

      857f3a92339b8319160901d178ec6c274174090b13cdf3c8a1e0018528e0ee004007b0be8ba682cf4ecac02a946e962b3b2a7519204c06bbd6398edd001b5c9a

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe

      Filesize

      356KB

      MD5

      c230996cbf08f369c9a0ce1f0dfd44b1

      SHA1

      c13e8505e0c678fd074cbcd4e1009a6bb761215b

      SHA256

      cbaf03a1e5ac1403b1380c640296869f40a3a3ea80c06217a049ab3554c01755

      SHA512

      857f3a92339b8319160901d178ec6c274174090b13cdf3c8a1e0018528e0ee004007b0be8ba682cf4ecac02a946e962b3b2a7519204c06bbd6398edd001b5c9a

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe

      Filesize

      356KB

      MD5

      c230996cbf08f369c9a0ce1f0dfd44b1

      SHA1

      c13e8505e0c678fd074cbcd4e1009a6bb761215b

      SHA256

      cbaf03a1e5ac1403b1380c640296869f40a3a3ea80c06217a049ab3554c01755

      SHA512

      857f3a92339b8319160901d178ec6c274174090b13cdf3c8a1e0018528e0ee004007b0be8ba682cf4ecac02a946e962b3b2a7519204c06bbd6398edd001b5c9a

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x9269641.exe

      Filesize

      826KB

      MD5

      1ccf60a640436858d17917060f0b6d24

      SHA1

      32f26bf09cd892be7b85ac3be9fb3cc4ff70cce1

      SHA256

      57fa3a6065237940d928469891d6fdadaf4623d1aaf8a2a41d1f756b21fb6c04

      SHA512

      4ecf5feb87f87ee07f111c938575dab92c0fb2a0b3e37a49b7628f1cc852cd01a2382cbdb856b8d91d1846be27fa49c0d8b3ebb4980eace1f2844ef07b0ef680

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x9269641.exe

      Filesize

      826KB

      MD5

      1ccf60a640436858d17917060f0b6d24

      SHA1

      32f26bf09cd892be7b85ac3be9fb3cc4ff70cce1

      SHA256

      57fa3a6065237940d928469891d6fdadaf4623d1aaf8a2a41d1f756b21fb6c04

      SHA512

      4ecf5feb87f87ee07f111c938575dab92c0fb2a0b3e37a49b7628f1cc852cd01a2382cbdb856b8d91d1846be27fa49c0d8b3ebb4980eace1f2844ef07b0ef680

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x4064195.exe

      Filesize

      555KB

      MD5

      c25ad9c8d5d867d10d820e9c2677c5df

      SHA1

      0c8a3135b83f03f905effa904471e97a6f5bff10

      SHA256

      bd78ce7659c914eb3210175059a8513b4e4bca4998c091e9483d906296fd3a24

      SHA512

      ff90644ddd3f16b6496baf17b5ea40bfeb5c344d868b6f4804d95eec67748a2bf6361234a32e2b7a7836191b2359a681fd22b44ec91d41ed9721b2aeed372f36

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x4064195.exe

      Filesize

      555KB

      MD5

      c25ad9c8d5d867d10d820e9c2677c5df

      SHA1

      0c8a3135b83f03f905effa904471e97a6f5bff10

      SHA256

      bd78ce7659c914eb3210175059a8513b4e4bca4998c091e9483d906296fd3a24

      SHA512

      ff90644ddd3f16b6496baf17b5ea40bfeb5c344d868b6f4804d95eec67748a2bf6361234a32e2b7a7836191b2359a681fd22b44ec91d41ed9721b2aeed372f36

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x9153426.exe

      Filesize

      390KB

      MD5

      d42221c127f88bca6c93f383e57089c8

      SHA1

      0789a6f5f5ab346fcb702637318cbbec6563d3a5

      SHA256

      c7014a23d82c4a22c11d17a00594e6e440ee62f79ee2b58f524a6378d5ee950f

      SHA512

      d766efd8b1a70f1a8b48ff88caa3ba0933a5982ed2a77f58abfeef919335c15ffae5164f2d5e8c17379ffa6cac08cabb581854eac5350e4cfe1ac6f3d71a82a5

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x9153426.exe

      Filesize

      390KB

      MD5

      d42221c127f88bca6c93f383e57089c8

      SHA1

      0789a6f5f5ab346fcb702637318cbbec6563d3a5

      SHA256

      c7014a23d82c4a22c11d17a00594e6e440ee62f79ee2b58f524a6378d5ee950f

      SHA512

      d766efd8b1a70f1a8b48ff88caa3ba0933a5982ed2a77f58abfeef919335c15ffae5164f2d5e8c17379ffa6cac08cabb581854eac5350e4cfe1ac6f3d71a82a5

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe

      Filesize

      356KB

      MD5

      c230996cbf08f369c9a0ce1f0dfd44b1

      SHA1

      c13e8505e0c678fd074cbcd4e1009a6bb761215b

      SHA256

      cbaf03a1e5ac1403b1380c640296869f40a3a3ea80c06217a049ab3554c01755

      SHA512

      857f3a92339b8319160901d178ec6c274174090b13cdf3c8a1e0018528e0ee004007b0be8ba682cf4ecac02a946e962b3b2a7519204c06bbd6398edd001b5c9a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe

      Filesize

      356KB

      MD5

      c230996cbf08f369c9a0ce1f0dfd44b1

      SHA1

      c13e8505e0c678fd074cbcd4e1009a6bb761215b

      SHA256

      cbaf03a1e5ac1403b1380c640296869f40a3a3ea80c06217a049ab3554c01755

      SHA512

      857f3a92339b8319160901d178ec6c274174090b13cdf3c8a1e0018528e0ee004007b0be8ba682cf4ecac02a946e962b3b2a7519204c06bbd6398edd001b5c9a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe

      Filesize

      356KB

      MD5

      c230996cbf08f369c9a0ce1f0dfd44b1

      SHA1

      c13e8505e0c678fd074cbcd4e1009a6bb761215b

      SHA256

      cbaf03a1e5ac1403b1380c640296869f40a3a3ea80c06217a049ab3554c01755

      SHA512

      857f3a92339b8319160901d178ec6c274174090b13cdf3c8a1e0018528e0ee004007b0be8ba682cf4ecac02a946e962b3b2a7519204c06bbd6398edd001b5c9a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe

      Filesize

      356KB

      MD5

      c230996cbf08f369c9a0ce1f0dfd44b1

      SHA1

      c13e8505e0c678fd074cbcd4e1009a6bb761215b

      SHA256

      cbaf03a1e5ac1403b1380c640296869f40a3a3ea80c06217a049ab3554c01755

      SHA512

      857f3a92339b8319160901d178ec6c274174090b13cdf3c8a1e0018528e0ee004007b0be8ba682cf4ecac02a946e962b3b2a7519204c06bbd6398edd001b5c9a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe

      Filesize

      356KB

      MD5

      c230996cbf08f369c9a0ce1f0dfd44b1

      SHA1

      c13e8505e0c678fd074cbcd4e1009a6bb761215b

      SHA256

      cbaf03a1e5ac1403b1380c640296869f40a3a3ea80c06217a049ab3554c01755

      SHA512

      857f3a92339b8319160901d178ec6c274174090b13cdf3c8a1e0018528e0ee004007b0be8ba682cf4ecac02a946e962b3b2a7519204c06bbd6398edd001b5c9a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe

      Filesize

      356KB

      MD5

      c230996cbf08f369c9a0ce1f0dfd44b1

      SHA1

      c13e8505e0c678fd074cbcd4e1009a6bb761215b

      SHA256

      cbaf03a1e5ac1403b1380c640296869f40a3a3ea80c06217a049ab3554c01755

      SHA512

      857f3a92339b8319160901d178ec6c274174090b13cdf3c8a1e0018528e0ee004007b0be8ba682cf4ecac02a946e962b3b2a7519204c06bbd6398edd001b5c9a

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g8768763.exe

      Filesize

      356KB

      MD5

      c230996cbf08f369c9a0ce1f0dfd44b1

      SHA1

      c13e8505e0c678fd074cbcd4e1009a6bb761215b

      SHA256

      cbaf03a1e5ac1403b1380c640296869f40a3a3ea80c06217a049ab3554c01755

      SHA512

      857f3a92339b8319160901d178ec6c274174090b13cdf3c8a1e0018528e0ee004007b0be8ba682cf4ecac02a946e962b3b2a7519204c06bbd6398edd001b5c9a

    • memory/1548-50-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1548-48-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1548-45-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1548-43-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1548-54-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1548-56-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1548-57-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1548-49-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1548-52-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1548-51-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/1548-47-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1548-62-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB