Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe
-
Size
379KB
-
MD5
c9d3c669fdbeedde0fcf7f36a9608584
-
SHA1
c7511046992d060853b95fd16689f3a62291d10e
-
SHA256
17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c
-
SHA512
8d5667763dc26a38a4b7146ee3d425eb2dddc1b40d7f3dbf1e787bacdfaad918a30e15d638816f922b1af64c50266b60a8f6e9df3058e21ab82250663068b0a4
-
SSDEEP
6144:pXXcRgs3r9vIum2Tg0N63KAOjUB1RkrwjYlz3PwJ/sGg3F:pXsRP3r9HmeJUJU3fwJs3F
Malware Config
Signatures
-
Detect Mystic stealer payload 6 IoCs
resource yara_rule behavioral1/memory/1984-3-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/1984-4-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/1984-5-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/1984-7-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/1984-9-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/1984-11-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2404 set thread context of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 -
Program crash 2 IoCs
pid pid_target Process procid_target 2132 2404 WerFault.exe 17 2696 1984 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 1984 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 28 PID 2404 wrote to memory of 2132 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 29 PID 2404 wrote to memory of 2132 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 29 PID 2404 wrote to memory of 2132 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 29 PID 2404 wrote to memory of 2132 2404 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe 29 PID 1984 wrote to memory of 2696 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 2696 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 2696 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 2696 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 2696 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 2696 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 2696 1984 AppLaunch.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe"C:\Users\Admin\AppData\Local\Temp\17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 1963⤵
- Program crash
PID:2696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 922⤵
- Program crash
PID:2132
-