Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 12:46

General

  • Target

    9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe

  • Size

    942KB

  • MD5

    5d5ebc7e0ba580b44caaa751f7da5965

  • SHA1

    91cbb2a41d5bcacd64a228dbadb8ad2eadd50acd

  • SHA256

    9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9

  • SHA512

    fd88845fc9aeb0ffda094188f0393b80c3c67ce1d40be433532f8263bd8ad5e6ea3fc487c022101a5a20801adbf14a135cf33980e8819f192fc1e6c371cb80c9

  • SSDEEP

    12288:fMrQy90LsXhBgI5ol9HFRLm8mdpVNLwsSMXAMyuCuAlzsvaGQixSg+SrofLx74oR:PySsLi97Lmf5wACOiGvY2iLJ4oKtvHw

Malware Config

Signatures

  • Detect Mystic stealer payload 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe
    "C:\Users\Admin\AppData\Local\Temp\9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1016529.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1016529.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1516362.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1516362.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2728
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9564736.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9564736.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2672
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2644
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2872
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2464
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 268
                  7⤵
                  • Program crash
                  PID:2540
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 280
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2548

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1016529.exe

      Filesize

      840KB

      MD5

      d58e531fe14e081a3487aa0217bea776

      SHA1

      aff688a495cd11adcc8bc72408daf68449b8c7af

      SHA256

      edad8e439c3f2f5f6048a2981c70f18ee5c75e3b1138f5ef074db5e1d4c4e29d

      SHA512

      4c67c6c06cc1f8fc4b5638fb384dcdda50244af150a0aa6136cfea38a1fc2a372f06dd8ee5fb5348bcde85ef274ec48299c8a1bd0d5ea6470c4fc3625506fd55

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1016529.exe

      Filesize

      840KB

      MD5

      d58e531fe14e081a3487aa0217bea776

      SHA1

      aff688a495cd11adcc8bc72408daf68449b8c7af

      SHA256

      edad8e439c3f2f5f6048a2981c70f18ee5c75e3b1138f5ef074db5e1d4c4e29d

      SHA512

      4c67c6c06cc1f8fc4b5638fb384dcdda50244af150a0aa6136cfea38a1fc2a372f06dd8ee5fb5348bcde85ef274ec48299c8a1bd0d5ea6470c4fc3625506fd55

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1516362.exe

      Filesize

      562KB

      MD5

      ee54b1196dc84dbce0dde1520a3f7684

      SHA1

      599091311e1df6476d37cca87f912fa1b101107c

      SHA256

      511f2cae1f9b7e71e244d17db11e01070e0801fcfd14f8908e784ef5909f1743

      SHA512

      67df098dad6e15c3c0e2dcab99015f564fdcedb2a35d3d455a3c6763913735d95d228f5193ef3d46cc97a4d5885c4a5d3974eb02fb69316b9764ff69d1038124

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1516362.exe

      Filesize

      562KB

      MD5

      ee54b1196dc84dbce0dde1520a3f7684

      SHA1

      599091311e1df6476d37cca87f912fa1b101107c

      SHA256

      511f2cae1f9b7e71e244d17db11e01070e0801fcfd14f8908e784ef5909f1743

      SHA512

      67df098dad6e15c3c0e2dcab99015f564fdcedb2a35d3d455a3c6763913735d95d228f5193ef3d46cc97a4d5885c4a5d3974eb02fb69316b9764ff69d1038124

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9564736.exe

      Filesize

      396KB

      MD5

      0e0dd7d2d24831b3d7d92418cbb9f612

      SHA1

      63857e22eb4fcdd614982da1b9257569929da5b6

      SHA256

      c08f31e22aa7a06918a7ec37f58138cab06b9ae9dab84016216615a56c352ea7

      SHA512

      4ab7be88c5736a6a96cdcf0166e43f95c6781d07564581488c3635a79513d453cab988052da050ef28ab40d302449a55a6091ee660b1da52172fc89a79257871

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9564736.exe

      Filesize

      396KB

      MD5

      0e0dd7d2d24831b3d7d92418cbb9f612

      SHA1

      63857e22eb4fcdd614982da1b9257569929da5b6

      SHA256

      c08f31e22aa7a06918a7ec37f58138cab06b9ae9dab84016216615a56c352ea7

      SHA512

      4ab7be88c5736a6a96cdcf0166e43f95c6781d07564581488c3635a79513d453cab988052da050ef28ab40d302449a55a6091ee660b1da52172fc89a79257871

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe

      Filesize

      379KB

      MD5

      3842b43cab0215976e1bb12f498a320d

      SHA1

      b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89

      SHA256

      767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2

      SHA512

      ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe

      Filesize

      379KB

      MD5

      3842b43cab0215976e1bb12f498a320d

      SHA1

      b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89

      SHA256

      767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2

      SHA512

      ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe

      Filesize

      379KB

      MD5

      3842b43cab0215976e1bb12f498a320d

      SHA1

      b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89

      SHA256

      767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2

      SHA512

      ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x1016529.exe

      Filesize

      840KB

      MD5

      d58e531fe14e081a3487aa0217bea776

      SHA1

      aff688a495cd11adcc8bc72408daf68449b8c7af

      SHA256

      edad8e439c3f2f5f6048a2981c70f18ee5c75e3b1138f5ef074db5e1d4c4e29d

      SHA512

      4c67c6c06cc1f8fc4b5638fb384dcdda50244af150a0aa6136cfea38a1fc2a372f06dd8ee5fb5348bcde85ef274ec48299c8a1bd0d5ea6470c4fc3625506fd55

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x1016529.exe

      Filesize

      840KB

      MD5

      d58e531fe14e081a3487aa0217bea776

      SHA1

      aff688a495cd11adcc8bc72408daf68449b8c7af

      SHA256

      edad8e439c3f2f5f6048a2981c70f18ee5c75e3b1138f5ef074db5e1d4c4e29d

      SHA512

      4c67c6c06cc1f8fc4b5638fb384dcdda50244af150a0aa6136cfea38a1fc2a372f06dd8ee5fb5348bcde85ef274ec48299c8a1bd0d5ea6470c4fc3625506fd55

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x1516362.exe

      Filesize

      562KB

      MD5

      ee54b1196dc84dbce0dde1520a3f7684

      SHA1

      599091311e1df6476d37cca87f912fa1b101107c

      SHA256

      511f2cae1f9b7e71e244d17db11e01070e0801fcfd14f8908e784ef5909f1743

      SHA512

      67df098dad6e15c3c0e2dcab99015f564fdcedb2a35d3d455a3c6763913735d95d228f5193ef3d46cc97a4d5885c4a5d3974eb02fb69316b9764ff69d1038124

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x1516362.exe

      Filesize

      562KB

      MD5

      ee54b1196dc84dbce0dde1520a3f7684

      SHA1

      599091311e1df6476d37cca87f912fa1b101107c

      SHA256

      511f2cae1f9b7e71e244d17db11e01070e0801fcfd14f8908e784ef5909f1743

      SHA512

      67df098dad6e15c3c0e2dcab99015f564fdcedb2a35d3d455a3c6763913735d95d228f5193ef3d46cc97a4d5885c4a5d3974eb02fb69316b9764ff69d1038124

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x9564736.exe

      Filesize

      396KB

      MD5

      0e0dd7d2d24831b3d7d92418cbb9f612

      SHA1

      63857e22eb4fcdd614982da1b9257569929da5b6

      SHA256

      c08f31e22aa7a06918a7ec37f58138cab06b9ae9dab84016216615a56c352ea7

      SHA512

      4ab7be88c5736a6a96cdcf0166e43f95c6781d07564581488c3635a79513d453cab988052da050ef28ab40d302449a55a6091ee660b1da52172fc89a79257871

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x9564736.exe

      Filesize

      396KB

      MD5

      0e0dd7d2d24831b3d7d92418cbb9f612

      SHA1

      63857e22eb4fcdd614982da1b9257569929da5b6

      SHA256

      c08f31e22aa7a06918a7ec37f58138cab06b9ae9dab84016216615a56c352ea7

      SHA512

      4ab7be88c5736a6a96cdcf0166e43f95c6781d07564581488c3635a79513d453cab988052da050ef28ab40d302449a55a6091ee660b1da52172fc89a79257871

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe

      Filesize

      379KB

      MD5

      3842b43cab0215976e1bb12f498a320d

      SHA1

      b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89

      SHA256

      767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2

      SHA512

      ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe

      Filesize

      379KB

      MD5

      3842b43cab0215976e1bb12f498a320d

      SHA1

      b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89

      SHA256

      767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2

      SHA512

      ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe

      Filesize

      379KB

      MD5

      3842b43cab0215976e1bb12f498a320d

      SHA1

      b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89

      SHA256

      767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2

      SHA512

      ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe

      Filesize

      379KB

      MD5

      3842b43cab0215976e1bb12f498a320d

      SHA1

      b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89

      SHA256

      767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2

      SHA512

      ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe

      Filesize

      379KB

      MD5

      3842b43cab0215976e1bb12f498a320d

      SHA1

      b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89

      SHA256

      767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2

      SHA512

      ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe

      Filesize

      379KB

      MD5

      3842b43cab0215976e1bb12f498a320d

      SHA1

      b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89

      SHA256

      767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2

      SHA512

      ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe

      Filesize

      379KB

      MD5

      3842b43cab0215976e1bb12f498a320d

      SHA1

      b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89

      SHA256

      767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2

      SHA512

      ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c

    • memory/2464-49-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2464-47-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2464-46-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2464-50-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2464-52-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2464-54-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2464-48-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2464-44-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2464-45-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2464-43-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB