Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 09:54
Static task
static1
Behavioral task
behavioral1
Sample
5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe
Resource
win10v2004-20230915-en
General
-
Target
5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe
-
Size
907KB
-
MD5
3f499a1933024166466a48c80ea6de27
-
SHA1
ca25d4bf7c2bdd0fe452332e7eed098946b18996
-
SHA256
5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa
-
SHA512
532216c4d2a7b7cc664e2fb187c7639e41d03afc131f3aff76288e7f2974ab0cc19a29e3705a45860cdcbf1c2f48552280d82228c7fb242a64a47c4c202bb807
-
SSDEEP
24576:RyraXEXASfGulWICYPf9nC+rouv47jeM+5DnTY9uz:EraEjG4WI339P6/ejY9u
Malware Config
Extracted
mystic
http://5.42.92.211/loghub/master
Signatures
-
Detect Mystic stealer payload 8 IoCs
resource yara_rule behavioral1/memory/2772-49-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2772-51-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2772-53-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2772-56-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2772-58-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2772-60-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2772-61-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2772-66-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Executes dropped EXE 4 IoCs
pid Process 2228 x1768154.exe 2220 x7044605.exe 2364 x4323957.exe 2812 g1148226.exe -
Loads dropped DLL 13 IoCs
pid Process 2232 5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe 2228 x1768154.exe 2228 x1768154.exe 2220 x7044605.exe 2220 x7044605.exe 2364 x4323957.exe 2364 x4323957.exe 2364 x4323957.exe 2812 g1148226.exe 2552 WerFault.exe 2552 WerFault.exe 2552 WerFault.exe 2552 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x7044605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x4323957.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x1768154.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2812 set thread context of 2772 2812 g1148226.exe 32 -
Program crash 1 IoCs
pid pid_target Process procid_target 2552 2812 WerFault.exe 31 -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2228 2232 5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe 28 PID 2232 wrote to memory of 2228 2232 5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe 28 PID 2232 wrote to memory of 2228 2232 5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe 28 PID 2232 wrote to memory of 2228 2232 5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe 28 PID 2232 wrote to memory of 2228 2232 5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe 28 PID 2232 wrote to memory of 2228 2232 5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe 28 PID 2232 wrote to memory of 2228 2232 5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe 28 PID 2228 wrote to memory of 2220 2228 x1768154.exe 29 PID 2228 wrote to memory of 2220 2228 x1768154.exe 29 PID 2228 wrote to memory of 2220 2228 x1768154.exe 29 PID 2228 wrote to memory of 2220 2228 x1768154.exe 29 PID 2228 wrote to memory of 2220 2228 x1768154.exe 29 PID 2228 wrote to memory of 2220 2228 x1768154.exe 29 PID 2228 wrote to memory of 2220 2228 x1768154.exe 29 PID 2220 wrote to memory of 2364 2220 x7044605.exe 30 PID 2220 wrote to memory of 2364 2220 x7044605.exe 30 PID 2220 wrote to memory of 2364 2220 x7044605.exe 30 PID 2220 wrote to memory of 2364 2220 x7044605.exe 30 PID 2220 wrote to memory of 2364 2220 x7044605.exe 30 PID 2220 wrote to memory of 2364 2220 x7044605.exe 30 PID 2220 wrote to memory of 2364 2220 x7044605.exe 30 PID 2364 wrote to memory of 2812 2364 x4323957.exe 31 PID 2364 wrote to memory of 2812 2364 x4323957.exe 31 PID 2364 wrote to memory of 2812 2364 x4323957.exe 31 PID 2364 wrote to memory of 2812 2364 x4323957.exe 31 PID 2364 wrote to memory of 2812 2364 x4323957.exe 31 PID 2364 wrote to memory of 2812 2364 x4323957.exe 31 PID 2364 wrote to memory of 2812 2364 x4323957.exe 31 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2772 2812 g1148226.exe 32 PID 2812 wrote to memory of 2552 2812 g1148226.exe 33 PID 2812 wrote to memory of 2552 2812 g1148226.exe 33 PID 2812 wrote to memory of 2552 2812 g1148226.exe 33 PID 2812 wrote to memory of 2552 2812 g1148226.exe 33 PID 2812 wrote to memory of 2552 2812 g1148226.exe 33 PID 2812 wrote to memory of 2552 2812 g1148226.exe 33 PID 2812 wrote to memory of 2552 2812 g1148226.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe"C:\Users\Admin\AppData\Local\Temp\5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1768154.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1768154.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7044605.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7044605.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4323957.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4323957.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 2726⤵
- Loads dropped DLL
- Program crash
PID:2552
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
805KB
MD59d26e1a538d4c9b9019ec6c310204841
SHA1c03d69ff5b8431aee079884e51812ff80f67c228
SHA2566d19912db2db6ee80402c2a16fc453b813f0b5a4308d56a6ccc1495a27402540
SHA5123f5330b6e9ea29ee57d2ebb8b779d059c517e19ee377509c5f9df06aae56d6b6c299822a010e59419ded980d07336c022bcf693acd86075aa544d9c67bd5673f
-
Filesize
805KB
MD59d26e1a538d4c9b9019ec6c310204841
SHA1c03d69ff5b8431aee079884e51812ff80f67c228
SHA2566d19912db2db6ee80402c2a16fc453b813f0b5a4308d56a6ccc1495a27402540
SHA5123f5330b6e9ea29ee57d2ebb8b779d059c517e19ee377509c5f9df06aae56d6b6c299822a010e59419ded980d07336c022bcf693acd86075aa544d9c67bd5673f
-
Filesize
545KB
MD52ca58f57dc6b9f082c5a4410817ca893
SHA13cb6333701247941b0d301d3c7b8dd1c6877abde
SHA256087ed6703349157f3c45c4de130c617e9cde926ee77123d90931c529663f8477
SHA51216cf3b13c2c81e0075f7098b09a4c1934e6810ddfff8de2df0f706aa07d00744865e05430c5eef46c791aeb08239852d40cde233fd506e92c018c82eb4730e48
-
Filesize
545KB
MD52ca58f57dc6b9f082c5a4410817ca893
SHA13cb6333701247941b0d301d3c7b8dd1c6877abde
SHA256087ed6703349157f3c45c4de130c617e9cde926ee77123d90931c529663f8477
SHA51216cf3b13c2c81e0075f7098b09a4c1934e6810ddfff8de2df0f706aa07d00744865e05430c5eef46c791aeb08239852d40cde233fd506e92c018c82eb4730e48
-
Filesize
379KB
MD54d42dba5a8b1d996d7dd8a6ea069a2a9
SHA11bcf34d3abfa648a079b240f56d8cfe27b9bf841
SHA256cbfd38264b09960b5a6327832c7a20435dfefa29268b1fca81afd8b853be0ffa
SHA5126f71c2269d2458799042ea7b285dcc69f7af55c0c8334c1d49cab31c9714c3b140908445ff96c8f1c59159f9dc3cccdae5b10abe76298cb473c58c250ba6237c
-
Filesize
379KB
MD54d42dba5a8b1d996d7dd8a6ea069a2a9
SHA11bcf34d3abfa648a079b240f56d8cfe27b9bf841
SHA256cbfd38264b09960b5a6327832c7a20435dfefa29268b1fca81afd8b853be0ffa
SHA5126f71c2269d2458799042ea7b285dcc69f7af55c0c8334c1d49cab31c9714c3b140908445ff96c8f1c59159f9dc3cccdae5b10abe76298cb473c58c250ba6237c
-
Filesize
350KB
MD59b761f165d26f5d8586102316b452643
SHA1d6e9bca2cd581edf3cc78f0bff610a0b534a85b2
SHA256a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32
SHA51269e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d
-
Filesize
350KB
MD59b761f165d26f5d8586102316b452643
SHA1d6e9bca2cd581edf3cc78f0bff610a0b534a85b2
SHA256a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32
SHA51269e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d
-
Filesize
350KB
MD59b761f165d26f5d8586102316b452643
SHA1d6e9bca2cd581edf3cc78f0bff610a0b534a85b2
SHA256a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32
SHA51269e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d
-
Filesize
805KB
MD59d26e1a538d4c9b9019ec6c310204841
SHA1c03d69ff5b8431aee079884e51812ff80f67c228
SHA2566d19912db2db6ee80402c2a16fc453b813f0b5a4308d56a6ccc1495a27402540
SHA5123f5330b6e9ea29ee57d2ebb8b779d059c517e19ee377509c5f9df06aae56d6b6c299822a010e59419ded980d07336c022bcf693acd86075aa544d9c67bd5673f
-
Filesize
805KB
MD59d26e1a538d4c9b9019ec6c310204841
SHA1c03d69ff5b8431aee079884e51812ff80f67c228
SHA2566d19912db2db6ee80402c2a16fc453b813f0b5a4308d56a6ccc1495a27402540
SHA5123f5330b6e9ea29ee57d2ebb8b779d059c517e19ee377509c5f9df06aae56d6b6c299822a010e59419ded980d07336c022bcf693acd86075aa544d9c67bd5673f
-
Filesize
545KB
MD52ca58f57dc6b9f082c5a4410817ca893
SHA13cb6333701247941b0d301d3c7b8dd1c6877abde
SHA256087ed6703349157f3c45c4de130c617e9cde926ee77123d90931c529663f8477
SHA51216cf3b13c2c81e0075f7098b09a4c1934e6810ddfff8de2df0f706aa07d00744865e05430c5eef46c791aeb08239852d40cde233fd506e92c018c82eb4730e48
-
Filesize
545KB
MD52ca58f57dc6b9f082c5a4410817ca893
SHA13cb6333701247941b0d301d3c7b8dd1c6877abde
SHA256087ed6703349157f3c45c4de130c617e9cde926ee77123d90931c529663f8477
SHA51216cf3b13c2c81e0075f7098b09a4c1934e6810ddfff8de2df0f706aa07d00744865e05430c5eef46c791aeb08239852d40cde233fd506e92c018c82eb4730e48
-
Filesize
379KB
MD54d42dba5a8b1d996d7dd8a6ea069a2a9
SHA11bcf34d3abfa648a079b240f56d8cfe27b9bf841
SHA256cbfd38264b09960b5a6327832c7a20435dfefa29268b1fca81afd8b853be0ffa
SHA5126f71c2269d2458799042ea7b285dcc69f7af55c0c8334c1d49cab31c9714c3b140908445ff96c8f1c59159f9dc3cccdae5b10abe76298cb473c58c250ba6237c
-
Filesize
379KB
MD54d42dba5a8b1d996d7dd8a6ea069a2a9
SHA11bcf34d3abfa648a079b240f56d8cfe27b9bf841
SHA256cbfd38264b09960b5a6327832c7a20435dfefa29268b1fca81afd8b853be0ffa
SHA5126f71c2269d2458799042ea7b285dcc69f7af55c0c8334c1d49cab31c9714c3b140908445ff96c8f1c59159f9dc3cccdae5b10abe76298cb473c58c250ba6237c
-
Filesize
350KB
MD59b761f165d26f5d8586102316b452643
SHA1d6e9bca2cd581edf3cc78f0bff610a0b534a85b2
SHA256a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32
SHA51269e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d
-
Filesize
350KB
MD59b761f165d26f5d8586102316b452643
SHA1d6e9bca2cd581edf3cc78f0bff610a0b534a85b2
SHA256a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32
SHA51269e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d
-
Filesize
350KB
MD59b761f165d26f5d8586102316b452643
SHA1d6e9bca2cd581edf3cc78f0bff610a0b534a85b2
SHA256a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32
SHA51269e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d
-
Filesize
350KB
MD59b761f165d26f5d8586102316b452643
SHA1d6e9bca2cd581edf3cc78f0bff610a0b534a85b2
SHA256a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32
SHA51269e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d
-
Filesize
350KB
MD59b761f165d26f5d8586102316b452643
SHA1d6e9bca2cd581edf3cc78f0bff610a0b534a85b2
SHA256a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32
SHA51269e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d
-
Filesize
350KB
MD59b761f165d26f5d8586102316b452643
SHA1d6e9bca2cd581edf3cc78f0bff610a0b534a85b2
SHA256a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32
SHA51269e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d
-
Filesize
350KB
MD59b761f165d26f5d8586102316b452643
SHA1d6e9bca2cd581edf3cc78f0bff610a0b534a85b2
SHA256a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32
SHA51269e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d