Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 12:46
Static task
static1
Behavioral task
behavioral1
Sample
9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe
Resource
win10v2004-20230915-en
General
-
Target
9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe
-
Size
942KB
-
MD5
5d5ebc7e0ba580b44caaa751f7da5965
-
SHA1
91cbb2a41d5bcacd64a228dbadb8ad2eadd50acd
-
SHA256
9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9
-
SHA512
fd88845fc9aeb0ffda094188f0393b80c3c67ce1d40be433532f8263bd8ad5e6ea3fc487c022101a5a20801adbf14a135cf33980e8819f192fc1e6c371cb80c9
-
SSDEEP
12288:fMrQy90LsXhBgI5ol9HFRLm8mdpVNLwsSMXAMyuCuAlzsvaGQixSg+SrofLx74oR:PySsLi97Lmf5wACOiGvY2iLJ4oKtvHw
Malware Config
Signatures
-
Detect Mystic stealer payload 6 IoCs
resource yara_rule behavioral1/memory/2464-48-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2464-47-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2464-46-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2464-50-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2464-52-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2464-54-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Executes dropped EXE 4 IoCs
pid Process 3064 x1016529.exe 2728 x1516362.exe 2672 x9564736.exe 2644 g2570099.exe -
Loads dropped DLL 13 IoCs
pid Process 2896 9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe 3064 x1016529.exe 3064 x1016529.exe 2728 x1516362.exe 2728 x1516362.exe 2672 x9564736.exe 2672 x9564736.exe 2672 x9564736.exe 2644 g2570099.exe 2548 WerFault.exe 2548 WerFault.exe 2548 WerFault.exe 2548 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x1016529.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x1516362.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x9564736.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2644 set thread context of 2464 2644 g2570099.exe 33 -
Program crash 2 IoCs
pid pid_target Process procid_target 2540 2464 WerFault.exe 33 2548 2644 WerFault.exe 31 -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2896 wrote to memory of 3064 2896 9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe 28 PID 2896 wrote to memory of 3064 2896 9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe 28 PID 2896 wrote to memory of 3064 2896 9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe 28 PID 2896 wrote to memory of 3064 2896 9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe 28 PID 2896 wrote to memory of 3064 2896 9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe 28 PID 2896 wrote to memory of 3064 2896 9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe 28 PID 2896 wrote to memory of 3064 2896 9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe 28 PID 3064 wrote to memory of 2728 3064 x1016529.exe 29 PID 3064 wrote to memory of 2728 3064 x1016529.exe 29 PID 3064 wrote to memory of 2728 3064 x1016529.exe 29 PID 3064 wrote to memory of 2728 3064 x1016529.exe 29 PID 3064 wrote to memory of 2728 3064 x1016529.exe 29 PID 3064 wrote to memory of 2728 3064 x1016529.exe 29 PID 3064 wrote to memory of 2728 3064 x1016529.exe 29 PID 2728 wrote to memory of 2672 2728 x1516362.exe 30 PID 2728 wrote to memory of 2672 2728 x1516362.exe 30 PID 2728 wrote to memory of 2672 2728 x1516362.exe 30 PID 2728 wrote to memory of 2672 2728 x1516362.exe 30 PID 2728 wrote to memory of 2672 2728 x1516362.exe 30 PID 2728 wrote to memory of 2672 2728 x1516362.exe 30 PID 2728 wrote to memory of 2672 2728 x1516362.exe 30 PID 2672 wrote to memory of 2644 2672 x9564736.exe 31 PID 2672 wrote to memory of 2644 2672 x9564736.exe 31 PID 2672 wrote to memory of 2644 2672 x9564736.exe 31 PID 2672 wrote to memory of 2644 2672 x9564736.exe 31 PID 2672 wrote to memory of 2644 2672 x9564736.exe 31 PID 2672 wrote to memory of 2644 2672 x9564736.exe 31 PID 2672 wrote to memory of 2644 2672 x9564736.exe 31 PID 2644 wrote to memory of 2872 2644 g2570099.exe 32 PID 2644 wrote to memory of 2872 2644 g2570099.exe 32 PID 2644 wrote to memory of 2872 2644 g2570099.exe 32 PID 2644 wrote to memory of 2872 2644 g2570099.exe 32 PID 2644 wrote to memory of 2872 2644 g2570099.exe 32 PID 2644 wrote to memory of 2872 2644 g2570099.exe 32 PID 2644 wrote to memory of 2872 2644 g2570099.exe 32 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2644 wrote to memory of 2464 2644 g2570099.exe 33 PID 2464 wrote to memory of 2540 2464 AppLaunch.exe 34 PID 2464 wrote to memory of 2540 2464 AppLaunch.exe 34 PID 2464 wrote to memory of 2540 2464 AppLaunch.exe 34 PID 2464 wrote to memory of 2540 2464 AppLaunch.exe 34 PID 2464 wrote to memory of 2540 2464 AppLaunch.exe 34 PID 2464 wrote to memory of 2540 2464 AppLaunch.exe 34 PID 2644 wrote to memory of 2548 2644 g2570099.exe 35 PID 2644 wrote to memory of 2548 2644 g2570099.exe 35 PID 2644 wrote to memory of 2548 2644 g2570099.exe 35 PID 2464 wrote to memory of 2540 2464 AppLaunch.exe 34 PID 2644 wrote to memory of 2548 2644 g2570099.exe 35 PID 2644 wrote to memory of 2548 2644 g2570099.exe 35 PID 2644 wrote to memory of 2548 2644 g2570099.exe 35 PID 2644 wrote to memory of 2548 2644 g2570099.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe"C:\Users\Admin\AppData\Local\Temp\9da7f30d54632e48b35fe2cb1ac12208eeff3f39f737e3840c0c0853f70c0ef9.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1016529.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1016529.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1516362.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1516362.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9564736.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9564736.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2570099.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2872
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 2687⤵
- Program crash
PID:2540
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 2806⤵
- Loads dropped DLL
- Program crash
PID:2548
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
840KB
MD5d58e531fe14e081a3487aa0217bea776
SHA1aff688a495cd11adcc8bc72408daf68449b8c7af
SHA256edad8e439c3f2f5f6048a2981c70f18ee5c75e3b1138f5ef074db5e1d4c4e29d
SHA5124c67c6c06cc1f8fc4b5638fb384dcdda50244af150a0aa6136cfea38a1fc2a372f06dd8ee5fb5348bcde85ef274ec48299c8a1bd0d5ea6470c4fc3625506fd55
-
Filesize
840KB
MD5d58e531fe14e081a3487aa0217bea776
SHA1aff688a495cd11adcc8bc72408daf68449b8c7af
SHA256edad8e439c3f2f5f6048a2981c70f18ee5c75e3b1138f5ef074db5e1d4c4e29d
SHA5124c67c6c06cc1f8fc4b5638fb384dcdda50244af150a0aa6136cfea38a1fc2a372f06dd8ee5fb5348bcde85ef274ec48299c8a1bd0d5ea6470c4fc3625506fd55
-
Filesize
562KB
MD5ee54b1196dc84dbce0dde1520a3f7684
SHA1599091311e1df6476d37cca87f912fa1b101107c
SHA256511f2cae1f9b7e71e244d17db11e01070e0801fcfd14f8908e784ef5909f1743
SHA51267df098dad6e15c3c0e2dcab99015f564fdcedb2a35d3d455a3c6763913735d95d228f5193ef3d46cc97a4d5885c4a5d3974eb02fb69316b9764ff69d1038124
-
Filesize
562KB
MD5ee54b1196dc84dbce0dde1520a3f7684
SHA1599091311e1df6476d37cca87f912fa1b101107c
SHA256511f2cae1f9b7e71e244d17db11e01070e0801fcfd14f8908e784ef5909f1743
SHA51267df098dad6e15c3c0e2dcab99015f564fdcedb2a35d3d455a3c6763913735d95d228f5193ef3d46cc97a4d5885c4a5d3974eb02fb69316b9764ff69d1038124
-
Filesize
396KB
MD50e0dd7d2d24831b3d7d92418cbb9f612
SHA163857e22eb4fcdd614982da1b9257569929da5b6
SHA256c08f31e22aa7a06918a7ec37f58138cab06b9ae9dab84016216615a56c352ea7
SHA5124ab7be88c5736a6a96cdcf0166e43f95c6781d07564581488c3635a79513d453cab988052da050ef28ab40d302449a55a6091ee660b1da52172fc89a79257871
-
Filesize
396KB
MD50e0dd7d2d24831b3d7d92418cbb9f612
SHA163857e22eb4fcdd614982da1b9257569929da5b6
SHA256c08f31e22aa7a06918a7ec37f58138cab06b9ae9dab84016216615a56c352ea7
SHA5124ab7be88c5736a6a96cdcf0166e43f95c6781d07564581488c3635a79513d453cab988052da050ef28ab40d302449a55a6091ee660b1da52172fc89a79257871
-
Filesize
379KB
MD53842b43cab0215976e1bb12f498a320d
SHA1b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89
SHA256767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2
SHA512ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c
-
Filesize
379KB
MD53842b43cab0215976e1bb12f498a320d
SHA1b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89
SHA256767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2
SHA512ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c
-
Filesize
379KB
MD53842b43cab0215976e1bb12f498a320d
SHA1b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89
SHA256767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2
SHA512ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c
-
Filesize
840KB
MD5d58e531fe14e081a3487aa0217bea776
SHA1aff688a495cd11adcc8bc72408daf68449b8c7af
SHA256edad8e439c3f2f5f6048a2981c70f18ee5c75e3b1138f5ef074db5e1d4c4e29d
SHA5124c67c6c06cc1f8fc4b5638fb384dcdda50244af150a0aa6136cfea38a1fc2a372f06dd8ee5fb5348bcde85ef274ec48299c8a1bd0d5ea6470c4fc3625506fd55
-
Filesize
840KB
MD5d58e531fe14e081a3487aa0217bea776
SHA1aff688a495cd11adcc8bc72408daf68449b8c7af
SHA256edad8e439c3f2f5f6048a2981c70f18ee5c75e3b1138f5ef074db5e1d4c4e29d
SHA5124c67c6c06cc1f8fc4b5638fb384dcdda50244af150a0aa6136cfea38a1fc2a372f06dd8ee5fb5348bcde85ef274ec48299c8a1bd0d5ea6470c4fc3625506fd55
-
Filesize
562KB
MD5ee54b1196dc84dbce0dde1520a3f7684
SHA1599091311e1df6476d37cca87f912fa1b101107c
SHA256511f2cae1f9b7e71e244d17db11e01070e0801fcfd14f8908e784ef5909f1743
SHA51267df098dad6e15c3c0e2dcab99015f564fdcedb2a35d3d455a3c6763913735d95d228f5193ef3d46cc97a4d5885c4a5d3974eb02fb69316b9764ff69d1038124
-
Filesize
562KB
MD5ee54b1196dc84dbce0dde1520a3f7684
SHA1599091311e1df6476d37cca87f912fa1b101107c
SHA256511f2cae1f9b7e71e244d17db11e01070e0801fcfd14f8908e784ef5909f1743
SHA51267df098dad6e15c3c0e2dcab99015f564fdcedb2a35d3d455a3c6763913735d95d228f5193ef3d46cc97a4d5885c4a5d3974eb02fb69316b9764ff69d1038124
-
Filesize
396KB
MD50e0dd7d2d24831b3d7d92418cbb9f612
SHA163857e22eb4fcdd614982da1b9257569929da5b6
SHA256c08f31e22aa7a06918a7ec37f58138cab06b9ae9dab84016216615a56c352ea7
SHA5124ab7be88c5736a6a96cdcf0166e43f95c6781d07564581488c3635a79513d453cab988052da050ef28ab40d302449a55a6091ee660b1da52172fc89a79257871
-
Filesize
396KB
MD50e0dd7d2d24831b3d7d92418cbb9f612
SHA163857e22eb4fcdd614982da1b9257569929da5b6
SHA256c08f31e22aa7a06918a7ec37f58138cab06b9ae9dab84016216615a56c352ea7
SHA5124ab7be88c5736a6a96cdcf0166e43f95c6781d07564581488c3635a79513d453cab988052da050ef28ab40d302449a55a6091ee660b1da52172fc89a79257871
-
Filesize
379KB
MD53842b43cab0215976e1bb12f498a320d
SHA1b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89
SHA256767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2
SHA512ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c
-
Filesize
379KB
MD53842b43cab0215976e1bb12f498a320d
SHA1b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89
SHA256767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2
SHA512ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c
-
Filesize
379KB
MD53842b43cab0215976e1bb12f498a320d
SHA1b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89
SHA256767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2
SHA512ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c
-
Filesize
379KB
MD53842b43cab0215976e1bb12f498a320d
SHA1b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89
SHA256767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2
SHA512ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c
-
Filesize
379KB
MD53842b43cab0215976e1bb12f498a320d
SHA1b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89
SHA256767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2
SHA512ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c
-
Filesize
379KB
MD53842b43cab0215976e1bb12f498a320d
SHA1b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89
SHA256767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2
SHA512ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c
-
Filesize
379KB
MD53842b43cab0215976e1bb12f498a320d
SHA1b3b2b679f5b573d6d7c61a726f3a16f49ebdcc89
SHA256767ff488adb690d860af9cd23645350a69f1b0efaee985ec16abdb8d33732ec2
SHA512ff49e6adb2ebe1849e5fd530abafd71d5c690b4f8cdba32f6a62c62603edddf701c0a4286fca4254c182178606f54161df5f8e5f5d6ef289e9ef9068d695798c