Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 09:54

General

  • Target

    5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe

  • Size

    907KB

  • MD5

    3f499a1933024166466a48c80ea6de27

  • SHA1

    ca25d4bf7c2bdd0fe452332e7eed098946b18996

  • SHA256

    5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa

  • SHA512

    532216c4d2a7b7cc664e2fb187c7639e41d03afc131f3aff76288e7f2974ab0cc19a29e3705a45860cdcbf1c2f48552280d82228c7fb242a64a47c4c202bb807

  • SSDEEP

    24576:RyraXEXASfGulWICYPf9nC+rouv47jeM+5DnTY9uz:EraEjG4WI339P6/ejY9u

Malware Config

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Signatures

  • Detect Mystic stealer payload 8 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe
    "C:\Users\Admin\AppData\Local\Temp\5b2c2ea338d66d44bb85255778ab29baa28d224601564b78248529a6a9f676fa.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1768154.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1768154.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7044605.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7044605.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2220
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4323957.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4323957.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2364
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2812
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2772
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 272
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2552

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1768154.exe

      Filesize

      805KB

      MD5

      9d26e1a538d4c9b9019ec6c310204841

      SHA1

      c03d69ff5b8431aee079884e51812ff80f67c228

      SHA256

      6d19912db2db6ee80402c2a16fc453b813f0b5a4308d56a6ccc1495a27402540

      SHA512

      3f5330b6e9ea29ee57d2ebb8b779d059c517e19ee377509c5f9df06aae56d6b6c299822a010e59419ded980d07336c022bcf693acd86075aa544d9c67bd5673f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1768154.exe

      Filesize

      805KB

      MD5

      9d26e1a538d4c9b9019ec6c310204841

      SHA1

      c03d69ff5b8431aee079884e51812ff80f67c228

      SHA256

      6d19912db2db6ee80402c2a16fc453b813f0b5a4308d56a6ccc1495a27402540

      SHA512

      3f5330b6e9ea29ee57d2ebb8b779d059c517e19ee377509c5f9df06aae56d6b6c299822a010e59419ded980d07336c022bcf693acd86075aa544d9c67bd5673f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7044605.exe

      Filesize

      545KB

      MD5

      2ca58f57dc6b9f082c5a4410817ca893

      SHA1

      3cb6333701247941b0d301d3c7b8dd1c6877abde

      SHA256

      087ed6703349157f3c45c4de130c617e9cde926ee77123d90931c529663f8477

      SHA512

      16cf3b13c2c81e0075f7098b09a4c1934e6810ddfff8de2df0f706aa07d00744865e05430c5eef46c791aeb08239852d40cde233fd506e92c018c82eb4730e48

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7044605.exe

      Filesize

      545KB

      MD5

      2ca58f57dc6b9f082c5a4410817ca893

      SHA1

      3cb6333701247941b0d301d3c7b8dd1c6877abde

      SHA256

      087ed6703349157f3c45c4de130c617e9cde926ee77123d90931c529663f8477

      SHA512

      16cf3b13c2c81e0075f7098b09a4c1934e6810ddfff8de2df0f706aa07d00744865e05430c5eef46c791aeb08239852d40cde233fd506e92c018c82eb4730e48

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4323957.exe

      Filesize

      379KB

      MD5

      4d42dba5a8b1d996d7dd8a6ea069a2a9

      SHA1

      1bcf34d3abfa648a079b240f56d8cfe27b9bf841

      SHA256

      cbfd38264b09960b5a6327832c7a20435dfefa29268b1fca81afd8b853be0ffa

      SHA512

      6f71c2269d2458799042ea7b285dcc69f7af55c0c8334c1d49cab31c9714c3b140908445ff96c8f1c59159f9dc3cccdae5b10abe76298cb473c58c250ba6237c

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4323957.exe

      Filesize

      379KB

      MD5

      4d42dba5a8b1d996d7dd8a6ea069a2a9

      SHA1

      1bcf34d3abfa648a079b240f56d8cfe27b9bf841

      SHA256

      cbfd38264b09960b5a6327832c7a20435dfefa29268b1fca81afd8b853be0ffa

      SHA512

      6f71c2269d2458799042ea7b285dcc69f7af55c0c8334c1d49cab31c9714c3b140908445ff96c8f1c59159f9dc3cccdae5b10abe76298cb473c58c250ba6237c

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe

      Filesize

      350KB

      MD5

      9b761f165d26f5d8586102316b452643

      SHA1

      d6e9bca2cd581edf3cc78f0bff610a0b534a85b2

      SHA256

      a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32

      SHA512

      69e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe

      Filesize

      350KB

      MD5

      9b761f165d26f5d8586102316b452643

      SHA1

      d6e9bca2cd581edf3cc78f0bff610a0b534a85b2

      SHA256

      a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32

      SHA512

      69e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe

      Filesize

      350KB

      MD5

      9b761f165d26f5d8586102316b452643

      SHA1

      d6e9bca2cd581edf3cc78f0bff610a0b534a85b2

      SHA256

      a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32

      SHA512

      69e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x1768154.exe

      Filesize

      805KB

      MD5

      9d26e1a538d4c9b9019ec6c310204841

      SHA1

      c03d69ff5b8431aee079884e51812ff80f67c228

      SHA256

      6d19912db2db6ee80402c2a16fc453b813f0b5a4308d56a6ccc1495a27402540

      SHA512

      3f5330b6e9ea29ee57d2ebb8b779d059c517e19ee377509c5f9df06aae56d6b6c299822a010e59419ded980d07336c022bcf693acd86075aa544d9c67bd5673f

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x1768154.exe

      Filesize

      805KB

      MD5

      9d26e1a538d4c9b9019ec6c310204841

      SHA1

      c03d69ff5b8431aee079884e51812ff80f67c228

      SHA256

      6d19912db2db6ee80402c2a16fc453b813f0b5a4308d56a6ccc1495a27402540

      SHA512

      3f5330b6e9ea29ee57d2ebb8b779d059c517e19ee377509c5f9df06aae56d6b6c299822a010e59419ded980d07336c022bcf693acd86075aa544d9c67bd5673f

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x7044605.exe

      Filesize

      545KB

      MD5

      2ca58f57dc6b9f082c5a4410817ca893

      SHA1

      3cb6333701247941b0d301d3c7b8dd1c6877abde

      SHA256

      087ed6703349157f3c45c4de130c617e9cde926ee77123d90931c529663f8477

      SHA512

      16cf3b13c2c81e0075f7098b09a4c1934e6810ddfff8de2df0f706aa07d00744865e05430c5eef46c791aeb08239852d40cde233fd506e92c018c82eb4730e48

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x7044605.exe

      Filesize

      545KB

      MD5

      2ca58f57dc6b9f082c5a4410817ca893

      SHA1

      3cb6333701247941b0d301d3c7b8dd1c6877abde

      SHA256

      087ed6703349157f3c45c4de130c617e9cde926ee77123d90931c529663f8477

      SHA512

      16cf3b13c2c81e0075f7098b09a4c1934e6810ddfff8de2df0f706aa07d00744865e05430c5eef46c791aeb08239852d40cde233fd506e92c018c82eb4730e48

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x4323957.exe

      Filesize

      379KB

      MD5

      4d42dba5a8b1d996d7dd8a6ea069a2a9

      SHA1

      1bcf34d3abfa648a079b240f56d8cfe27b9bf841

      SHA256

      cbfd38264b09960b5a6327832c7a20435dfefa29268b1fca81afd8b853be0ffa

      SHA512

      6f71c2269d2458799042ea7b285dcc69f7af55c0c8334c1d49cab31c9714c3b140908445ff96c8f1c59159f9dc3cccdae5b10abe76298cb473c58c250ba6237c

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x4323957.exe

      Filesize

      379KB

      MD5

      4d42dba5a8b1d996d7dd8a6ea069a2a9

      SHA1

      1bcf34d3abfa648a079b240f56d8cfe27b9bf841

      SHA256

      cbfd38264b09960b5a6327832c7a20435dfefa29268b1fca81afd8b853be0ffa

      SHA512

      6f71c2269d2458799042ea7b285dcc69f7af55c0c8334c1d49cab31c9714c3b140908445ff96c8f1c59159f9dc3cccdae5b10abe76298cb473c58c250ba6237c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe

      Filesize

      350KB

      MD5

      9b761f165d26f5d8586102316b452643

      SHA1

      d6e9bca2cd581edf3cc78f0bff610a0b534a85b2

      SHA256

      a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32

      SHA512

      69e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe

      Filesize

      350KB

      MD5

      9b761f165d26f5d8586102316b452643

      SHA1

      d6e9bca2cd581edf3cc78f0bff610a0b534a85b2

      SHA256

      a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32

      SHA512

      69e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe

      Filesize

      350KB

      MD5

      9b761f165d26f5d8586102316b452643

      SHA1

      d6e9bca2cd581edf3cc78f0bff610a0b534a85b2

      SHA256

      a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32

      SHA512

      69e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe

      Filesize

      350KB

      MD5

      9b761f165d26f5d8586102316b452643

      SHA1

      d6e9bca2cd581edf3cc78f0bff610a0b534a85b2

      SHA256

      a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32

      SHA512

      69e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe

      Filesize

      350KB

      MD5

      9b761f165d26f5d8586102316b452643

      SHA1

      d6e9bca2cd581edf3cc78f0bff610a0b534a85b2

      SHA256

      a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32

      SHA512

      69e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe

      Filesize

      350KB

      MD5

      9b761f165d26f5d8586102316b452643

      SHA1

      d6e9bca2cd581edf3cc78f0bff610a0b534a85b2

      SHA256

      a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32

      SHA512

      69e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g1148226.exe

      Filesize

      350KB

      MD5

      9b761f165d26f5d8586102316b452643

      SHA1

      d6e9bca2cd581edf3cc78f0bff610a0b534a85b2

      SHA256

      a0ab90ef1ff5bb23e3dfe2c6c520cd864afbb09788acdef434478f4f4de74c32

      SHA512

      69e784b80a90504418299b568a0102884a278bfb2c1b5735d4d73537e5eb79e0c79b01c68c4e03e9877395e42aee343bcc26ac3b4edeb52d45056aec05ef153d

    • memory/2772-51-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2772-53-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2772-55-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2772-56-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2772-58-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2772-60-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2772-61-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2772-43-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2772-49-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2772-47-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2772-45-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2772-66-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB