Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
205s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 05:57
Static task
static1
Behavioral task
behavioral1
Sample
a4f1bc63fa2e4afce5187f4dca16a2740c9a0467a29cccea99359aec58978114.exe
Resource
win7-20230831-en
General
-
Target
a4f1bc63fa2e4afce5187f4dca16a2740c9a0467a29cccea99359aec58978114.exe
-
Size
1.1MB
-
MD5
38632233845254a2918bf7b43f194c1b
-
SHA1
e38ef1326b592b0f295d68ed77fdf0d0fdd78c20
-
SHA256
a4f1bc63fa2e4afce5187f4dca16a2740c9a0467a29cccea99359aec58978114
-
SHA512
6f5e238177b21d135e216fab35211f2fad3bab32191fc1063feac61327a2abe6b14c6bed2f90782c2156377f0eb3cee83efd0d6cb02ae5e003d7e1b2a0851e75
-
SSDEEP
24576:Iya/mJtYAl+jUNEHcn+ZFw4OuehoGSGo4jKDpSuLkrxCr4jLtE:P+KtYAlEzB7O/qGSJ4jxuLkrwr4j
Malware Config
Signatures
-
Detect Mystic stealer payload 4 IoCs
resource yara_rule behavioral2/memory/1460-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1460-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1460-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1460-47-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
resource yara_rule behavioral2/memory/1832-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
Executes dropped EXE 6 IoCs
pid Process 2292 z8802024.exe 2548 z3536989.exe 4300 z4110671.exe 4752 z4385511.exe 2816 q5240595.exe 4716 r0363003.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a4f1bc63fa2e4afce5187f4dca16a2740c9a0467a29cccea99359aec58978114.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z8802024.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z3536989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z4110671.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z4385511.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2816 set thread context of 1832 2816 q5240595.exe 93 PID 4716 set thread context of 1460 4716 r0363003.exe 102 -
Program crash 1 IoCs
pid pid_target Process procid_target 1452 2816 WerFault.exe 91 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1832 AppLaunch.exe 1832 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1832 AppLaunch.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 396 wrote to memory of 2292 396 a4f1bc63fa2e4afce5187f4dca16a2740c9a0467a29cccea99359aec58978114.exe 87 PID 396 wrote to memory of 2292 396 a4f1bc63fa2e4afce5187f4dca16a2740c9a0467a29cccea99359aec58978114.exe 87 PID 396 wrote to memory of 2292 396 a4f1bc63fa2e4afce5187f4dca16a2740c9a0467a29cccea99359aec58978114.exe 87 PID 2292 wrote to memory of 2548 2292 z8802024.exe 88 PID 2292 wrote to memory of 2548 2292 z8802024.exe 88 PID 2292 wrote to memory of 2548 2292 z8802024.exe 88 PID 2548 wrote to memory of 4300 2548 z3536989.exe 89 PID 2548 wrote to memory of 4300 2548 z3536989.exe 89 PID 2548 wrote to memory of 4300 2548 z3536989.exe 89 PID 4300 wrote to memory of 4752 4300 z4110671.exe 90 PID 4300 wrote to memory of 4752 4300 z4110671.exe 90 PID 4300 wrote to memory of 4752 4300 z4110671.exe 90 PID 4752 wrote to memory of 2816 4752 z4385511.exe 91 PID 4752 wrote to memory of 2816 4752 z4385511.exe 91 PID 4752 wrote to memory of 2816 4752 z4385511.exe 91 PID 2816 wrote to memory of 1832 2816 q5240595.exe 93 PID 2816 wrote to memory of 1832 2816 q5240595.exe 93 PID 2816 wrote to memory of 1832 2816 q5240595.exe 93 PID 2816 wrote to memory of 1832 2816 q5240595.exe 93 PID 2816 wrote to memory of 1832 2816 q5240595.exe 93 PID 2816 wrote to memory of 1832 2816 q5240595.exe 93 PID 2816 wrote to memory of 1832 2816 q5240595.exe 93 PID 2816 wrote to memory of 1832 2816 q5240595.exe 93 PID 4752 wrote to memory of 4716 4752 z4385511.exe 99 PID 4752 wrote to memory of 4716 4752 z4385511.exe 99 PID 4752 wrote to memory of 4716 4752 z4385511.exe 99 PID 4716 wrote to memory of 1460 4716 r0363003.exe 102 PID 4716 wrote to memory of 1460 4716 r0363003.exe 102 PID 4716 wrote to memory of 1460 4716 r0363003.exe 102 PID 4716 wrote to memory of 1460 4716 r0363003.exe 102 PID 4716 wrote to memory of 1460 4716 r0363003.exe 102 PID 4716 wrote to memory of 1460 4716 r0363003.exe 102 PID 4716 wrote to memory of 1460 4716 r0363003.exe 102 PID 4716 wrote to memory of 1460 4716 r0363003.exe 102 PID 4716 wrote to memory of 1460 4716 r0363003.exe 102 PID 4716 wrote to memory of 1460 4716 r0363003.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4f1bc63fa2e4afce5187f4dca16a2740c9a0467a29cccea99359aec58978114.exe"C:\Users\Admin\AppData\Local\Temp\a4f1bc63fa2e4afce5187f4dca16a2740c9a0467a29cccea99359aec58978114.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8802024.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8802024.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3536989.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3536989.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4110671.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4110671.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4385511.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4385511.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5240595.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5240595.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 1527⤵
- Program crash
PID:1452
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0363003.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0363003.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1460
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2816 -ip 28161⤵PID:3504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4716 -ip 47161⤵PID:2028
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
983KB
MD55dd0edf953157aa36723581ccd761217
SHA11f68bedf537b8ddaa9c7cd5deb89c69702fe1dda
SHA2567b8bd3d7507ae5a960100c029bde5f3f5debfd8b181d6ac32dffddf6882bb63c
SHA5121a0d3edc789bf2e88f78adcfd91545399f56fc3967751313947b940e3d191d69afee13fb8ec6fd6d65c10704cf2343f98ec07b02fd84bacc0da237c8d65d22c4
-
Filesize
983KB
MD55dd0edf953157aa36723581ccd761217
SHA11f68bedf537b8ddaa9c7cd5deb89c69702fe1dda
SHA2567b8bd3d7507ae5a960100c029bde5f3f5debfd8b181d6ac32dffddf6882bb63c
SHA5121a0d3edc789bf2e88f78adcfd91545399f56fc3967751313947b940e3d191d69afee13fb8ec6fd6d65c10704cf2343f98ec07b02fd84bacc0da237c8d65d22c4
-
Filesize
800KB
MD5b2f30e20df8c03e0ca879b32c2083296
SHA1527a7d9c3f00965661ebed41a5d48efea63b6d7c
SHA256b0f6dcbb8278624beaf5e46e13d3f3c3be3c6cbce35eeea2ca14610da5ea56a5
SHA512d401da8d08f6a91a6eccf6165ab3058daf0803989e81420f1ee1fc8b1a2c01edc90cf229ef31f47072e6b84b0a59990423a9d95de72b3771090fe5d8d8bef52c
-
Filesize
800KB
MD5b2f30e20df8c03e0ca879b32c2083296
SHA1527a7d9c3f00965661ebed41a5d48efea63b6d7c
SHA256b0f6dcbb8278624beaf5e46e13d3f3c3be3c6cbce35eeea2ca14610da5ea56a5
SHA512d401da8d08f6a91a6eccf6165ab3058daf0803989e81420f1ee1fc8b1a2c01edc90cf229ef31f47072e6b84b0a59990423a9d95de72b3771090fe5d8d8bef52c
-
Filesize
617KB
MD5157f76febfc185735378979e5c696c12
SHA1fa6d83dfca266084c739bcfbb00d90e6ddf76ac9
SHA256c833844127ddfd3faef6587694fb5d89238e959d2ced04ed1a09369426693d6a
SHA512d642189f05b04cc55050594567022ddcfbdb20793b7ce41f2ba198177097a270dc9f494ccfb711f46df2904f5fdd422709c2d60872c951b83695ed205783dade
-
Filesize
617KB
MD5157f76febfc185735378979e5c696c12
SHA1fa6d83dfca266084c739bcfbb00d90e6ddf76ac9
SHA256c833844127ddfd3faef6587694fb5d89238e959d2ced04ed1a09369426693d6a
SHA512d642189f05b04cc55050594567022ddcfbdb20793b7ce41f2ba198177097a270dc9f494ccfb711f46df2904f5fdd422709c2d60872c951b83695ed205783dade
-
Filesize
346KB
MD500371b2cd7064ef8355af6baf1200028
SHA11e9eacd485322c5d54b6624e24e2eb2e972e2d1c
SHA256dde9a73c0d795c182e9f6dda5b53fa30f546fd07656fc3679c2437c17a2ec656
SHA512064e6f7e90a29041aa07b2688c36cc9db965145520af14db600b0241c2dcd08c1d313d2def594dd00d76c0e3f36b82d5f5620c9133639249cc00982d6a625162
-
Filesize
346KB
MD500371b2cd7064ef8355af6baf1200028
SHA11e9eacd485322c5d54b6624e24e2eb2e972e2d1c
SHA256dde9a73c0d795c182e9f6dda5b53fa30f546fd07656fc3679c2437c17a2ec656
SHA512064e6f7e90a29041aa07b2688c36cc9db965145520af14db600b0241c2dcd08c1d313d2def594dd00d76c0e3f36b82d5f5620c9133639249cc00982d6a625162
-
Filesize
227KB
MD5493dc7d8138fc4c2f7008173581938e9
SHA12e07cfce2dd0a024f95553e57cc57c7036d5f1e1
SHA256cc9e18805ba98ed8846428a56904dda8f3855dff0fb00022b278f6bd4f2cf0ab
SHA512d3e8777674f41e28b88823d950197c7af04b84dfb3f55a5efb71935ec2d06cf4fbc27d079f208dca30ca75694acc7a11806322566349110bae1cf15404cfab0e
-
Filesize
227KB
MD5493dc7d8138fc4c2f7008173581938e9
SHA12e07cfce2dd0a024f95553e57cc57c7036d5f1e1
SHA256cc9e18805ba98ed8846428a56904dda8f3855dff0fb00022b278f6bd4f2cf0ab
SHA512d3e8777674f41e28b88823d950197c7af04b84dfb3f55a5efb71935ec2d06cf4fbc27d079f208dca30ca75694acc7a11806322566349110bae1cf15404cfab0e
-
Filesize
356KB
MD5b4d2f435a2a0f4d9e8657a74bcac5e26
SHA1941d9445eb5e76425e39eee5134441733d469b8e
SHA2567dfaa8cf6458143ae95efb3d20e7aa271ac4b21e7b27725f7853940d21e8adc0
SHA51260832939f294e61f82646ed041b28e9e9cabd49294425dc7765b809d91d72786154e56487399d8d8700b68b47b5f0457b76aba6ad084452baa64511fa757553f
-
Filesize
356KB
MD5b4d2f435a2a0f4d9e8657a74bcac5e26
SHA1941d9445eb5e76425e39eee5134441733d469b8e
SHA2567dfaa8cf6458143ae95efb3d20e7aa271ac4b21e7b27725f7853940d21e8adc0
SHA51260832939f294e61f82646ed041b28e9e9cabd49294425dc7765b809d91d72786154e56487399d8d8700b68b47b5f0457b76aba6ad084452baa64511fa757553f