Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
230s -
max time network
219s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 08:53
Static task
static1
Behavioral task
behavioral1
Sample
e40060da295bfcf077543a7ae8f6e93fa4f91c3b071e53e37b73ad0b3bdec3c8.exe
Resource
win7-20230831-en
General
-
Target
e40060da295bfcf077543a7ae8f6e93fa4f91c3b071e53e37b73ad0b3bdec3c8.exe
-
Size
1.3MB
-
MD5
3816ebf28daa09e6c7059e4bb28d077c
-
SHA1
783d792e84761634c06568cb80d210b4d9ef51b6
-
SHA256
e40060da295bfcf077543a7ae8f6e93fa4f91c3b071e53e37b73ad0b3bdec3c8
-
SHA512
b6af71b6a9a17a15d9b7e984e5ae14ae68f61209ab94d4e81c59327721ff1bb6e3ded80ba5bfbdc4ff57db1f5768bce42903554e42da2bdce7d9a5479652766f
-
SSDEEP
24576:1yMDhhLbG+9tBDREXKjNcTfv5rmGxX7TnOtEe3/khaDVcudE:QMDhhLl9tBDeXqoZSGxPQEePkhaJ
Malware Config
Signatures
-
Detect Mystic stealer payload 4 IoCs
resource yara_rule behavioral2/memory/3744-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3744-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3744-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3744-47-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
resource yara_rule behavioral2/memory/4904-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
Executes dropped EXE 6 IoCs
pid Process 4840 z4874342.exe 1672 z1070254.exe 400 z8059138.exe 3616 z6786393.exe 1932 q3272334.exe 4668 r6249605.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z6786393.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e40060da295bfcf077543a7ae8f6e93fa4f91c3b071e53e37b73ad0b3bdec3c8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4874342.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z1070254.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z8059138.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1932 set thread context of 4904 1932 q3272334.exe 92 PID 4668 set thread context of 3744 4668 r6249605.exe 100 -
Program crash 3 IoCs
pid pid_target Process procid_target 3276 1932 WerFault.exe 90 4580 4668 WerFault.exe 98 5016 3744 WerFault.exe 100 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4904 AppLaunch.exe 4904 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4904 AppLaunch.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4692 wrote to memory of 4840 4692 e40060da295bfcf077543a7ae8f6e93fa4f91c3b071e53e37b73ad0b3bdec3c8.exe 86 PID 4692 wrote to memory of 4840 4692 e40060da295bfcf077543a7ae8f6e93fa4f91c3b071e53e37b73ad0b3bdec3c8.exe 86 PID 4692 wrote to memory of 4840 4692 e40060da295bfcf077543a7ae8f6e93fa4f91c3b071e53e37b73ad0b3bdec3c8.exe 86 PID 4840 wrote to memory of 1672 4840 z4874342.exe 87 PID 4840 wrote to memory of 1672 4840 z4874342.exe 87 PID 4840 wrote to memory of 1672 4840 z4874342.exe 87 PID 1672 wrote to memory of 400 1672 z1070254.exe 88 PID 1672 wrote to memory of 400 1672 z1070254.exe 88 PID 1672 wrote to memory of 400 1672 z1070254.exe 88 PID 400 wrote to memory of 3616 400 z8059138.exe 89 PID 400 wrote to memory of 3616 400 z8059138.exe 89 PID 400 wrote to memory of 3616 400 z8059138.exe 89 PID 3616 wrote to memory of 1932 3616 z6786393.exe 90 PID 3616 wrote to memory of 1932 3616 z6786393.exe 90 PID 3616 wrote to memory of 1932 3616 z6786393.exe 90 PID 1932 wrote to memory of 4904 1932 q3272334.exe 92 PID 1932 wrote to memory of 4904 1932 q3272334.exe 92 PID 1932 wrote to memory of 4904 1932 q3272334.exe 92 PID 1932 wrote to memory of 4904 1932 q3272334.exe 92 PID 1932 wrote to memory of 4904 1932 q3272334.exe 92 PID 1932 wrote to memory of 4904 1932 q3272334.exe 92 PID 1932 wrote to memory of 4904 1932 q3272334.exe 92 PID 1932 wrote to memory of 4904 1932 q3272334.exe 92 PID 3616 wrote to memory of 4668 3616 z6786393.exe 98 PID 3616 wrote to memory of 4668 3616 z6786393.exe 98 PID 3616 wrote to memory of 4668 3616 z6786393.exe 98 PID 4668 wrote to memory of 3744 4668 r6249605.exe 100 PID 4668 wrote to memory of 3744 4668 r6249605.exe 100 PID 4668 wrote to memory of 3744 4668 r6249605.exe 100 PID 4668 wrote to memory of 3744 4668 r6249605.exe 100 PID 4668 wrote to memory of 3744 4668 r6249605.exe 100 PID 4668 wrote to memory of 3744 4668 r6249605.exe 100 PID 4668 wrote to memory of 3744 4668 r6249605.exe 100 PID 4668 wrote to memory of 3744 4668 r6249605.exe 100 PID 4668 wrote to memory of 3744 4668 r6249605.exe 100 PID 4668 wrote to memory of 3744 4668 r6249605.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\e40060da295bfcf077543a7ae8f6e93fa4f91c3b071e53e37b73ad0b3bdec3c8.exe"C:\Users\Admin\AppData\Local\Temp\e40060da295bfcf077543a7ae8f6e93fa4f91c3b071e53e37b73ad0b3bdec3c8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4874342.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4874342.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1070254.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1070254.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8059138.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8059138.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6786393.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6786393.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3272334.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3272334.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 6087⤵
- Program crash
PID:3276
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6249605.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6249605.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 5408⤵
- Program crash
PID:5016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1527⤵
- Program crash
PID:4580
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1932 -ip 19321⤵PID:4588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4668 -ip 46681⤵PID:4028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3744 -ip 37441⤵PID:3380
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5ce27086f7b1ce8381e84f92f8fadbd05
SHA16c3a072e5fcf638d5104a9bb5c5949bd8e87eeae
SHA2564c26acde338005b531f85c3dc0687fb63852c6b72594ca07906ea3cf30f11e35
SHA512058c4cb76cd4f21174bffea5b45612873eb3e1e3603c7d0f17051e4f5c8b8cf65d20bac32c93a669c5b2b6db1819fb68ba919c437d2c62b10572dd36b057e61f
-
Filesize
1.2MB
MD5ce27086f7b1ce8381e84f92f8fadbd05
SHA16c3a072e5fcf638d5104a9bb5c5949bd8e87eeae
SHA2564c26acde338005b531f85c3dc0687fb63852c6b72594ca07906ea3cf30f11e35
SHA512058c4cb76cd4f21174bffea5b45612873eb3e1e3603c7d0f17051e4f5c8b8cf65d20bac32c93a669c5b2b6db1819fb68ba919c437d2c62b10572dd36b057e61f
-
Filesize
1.0MB
MD5ca2dac76d10f189021c96b895cc1937a
SHA15d0ffadd73e2ee0c458562e3e791d07157fcde27
SHA2566d1a0b95baa9e86b57ceff552ddc8538adc41f57862bb1840f3b0343d828da0f
SHA512ee429a754f6a370be96ce5a969263b38ca3dcefeb032c245a06853ed25c74d0b29aa07a65031e13d3461ca68e63cd07af643f94856c2632fe2141b70c8d2170e
-
Filesize
1.0MB
MD5ca2dac76d10f189021c96b895cc1937a
SHA15d0ffadd73e2ee0c458562e3e791d07157fcde27
SHA2566d1a0b95baa9e86b57ceff552ddc8538adc41f57862bb1840f3b0343d828da0f
SHA512ee429a754f6a370be96ce5a969263b38ca3dcefeb032c245a06853ed25c74d0b29aa07a65031e13d3461ca68e63cd07af643f94856c2632fe2141b70c8d2170e
-
Filesize
880KB
MD5fe4e217ba5bbac3099e5868da70a3a7e
SHA14525dac81c15af26062ef642d8b2c003941e8e42
SHA256278ee11335785d20dae591ec13e883118dbf8865232516d5f8825f9a441fe171
SHA512606ef09ea58ebd8c7201e26c3a7e80e074647ca8f8f4d3dae903a26fdbc1790045da069230034738fc970cab1d441e683a082feb3e27cd9182113b97c2f43b56
-
Filesize
880KB
MD5fe4e217ba5bbac3099e5868da70a3a7e
SHA14525dac81c15af26062ef642d8b2c003941e8e42
SHA256278ee11335785d20dae591ec13e883118dbf8865232516d5f8825f9a441fe171
SHA512606ef09ea58ebd8c7201e26c3a7e80e074647ca8f8f4d3dae903a26fdbc1790045da069230034738fc970cab1d441e683a082feb3e27cd9182113b97c2f43b56
-
Filesize
490KB
MD56dadabded965520a92d507929c6da9f1
SHA1ae904d23ff3cadae7ba733be2e2e3d84a4e7abbd
SHA2565ac92f9db2b9213478b6826581ab6f33ae114b8e4bf0e18536829ee1789240b6
SHA5121c654b9c322661f568878940107e7377c8ba10befa6d68ea7a04c15985364e966aaa71a1fbc369c4ed94cff29a90fa10dfba225a5ab499151f19c6478c11a1ba
-
Filesize
490KB
MD56dadabded965520a92d507929c6da9f1
SHA1ae904d23ff3cadae7ba733be2e2e3d84a4e7abbd
SHA2565ac92f9db2b9213478b6826581ab6f33ae114b8e4bf0e18536829ee1789240b6
SHA5121c654b9c322661f568878940107e7377c8ba10befa6d68ea7a04c15985364e966aaa71a1fbc369c4ed94cff29a90fa10dfba225a5ab499151f19c6478c11a1ba
-
Filesize
860KB
MD5fd9a03e7cdd87a9d560bad35fcf33522
SHA13c0b74781934dc76128789cd54898528dd3bd22c
SHA256c0d2213946f127ce55111f44cb8456b3fb60d9f2d2897f95a6a7e080c432c962
SHA51254ed97fc9bc85b4f717e4795dd4d68250ee4246cc156f8354ba12cb1a165b170d17c0dd510fa907cc87006e53af9d298ca3b8822afb06a3d8917e3f3d3f83240
-
Filesize
860KB
MD5fd9a03e7cdd87a9d560bad35fcf33522
SHA13c0b74781934dc76128789cd54898528dd3bd22c
SHA256c0d2213946f127ce55111f44cb8456b3fb60d9f2d2897f95a6a7e080c432c962
SHA51254ed97fc9bc85b4f717e4795dd4d68250ee4246cc156f8354ba12cb1a165b170d17c0dd510fa907cc87006e53af9d298ca3b8822afb06a3d8917e3f3d3f83240
-
Filesize
1016KB
MD5b4f5d1965bd91d4bbf652edec00c83ca
SHA132ae8c644df173c37d603d6d481d814840d77550
SHA2565262e8df19d56b6fb8b2d2ad1ac641fe10ac6dadd8f35c52304c60e6f6ace698
SHA512754e80b1e424c4bf2a2e4e568a6ce1bfe6396d3ac2cd849cedc0ff977f2eefad70a6a8ed9d047969a97903c2fa97418b7a0b0b24b00faf8832bdf332293784f5
-
Filesize
1016KB
MD5b4f5d1965bd91d4bbf652edec00c83ca
SHA132ae8c644df173c37d603d6d481d814840d77550
SHA2565262e8df19d56b6fb8b2d2ad1ac641fe10ac6dadd8f35c52304c60e6f6ace698
SHA512754e80b1e424c4bf2a2e4e568a6ce1bfe6396d3ac2cd849cedc0ff977f2eefad70a6a8ed9d047969a97903c2fa97418b7a0b0b24b00faf8832bdf332293784f5