Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 13:27

General

  • Target

    65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe

  • Size

    943KB

  • MD5

    6adc6ada2339ac051903999bc36faf3b

  • SHA1

    d03e60cb7c43b8af22028b9acb3bf6ef9c69d3c1

  • SHA256

    65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e

  • SHA512

    c73faa5d52818fd0ffab0ff273b96e3745f22e3b90321ef099617b895b1187245f16d7bb820ea415b1fbe62d4dc34b2c3ffa7786bf7d69abcf8933c4b3d00187

  • SSDEEP

    12288:ZMrMy90mejTjWI3jJlZ6Ra6wKX+6FTiVvGe3TBErdyqDXOF5rpFSwxKqzAh2Jpvb:dyWjNMRa6wJUm5BdSyRrpFflNsItt

Malware Config

Signatures

  • Detect Mystic stealer payload 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe
    "C:\Users\Admin\AppData\Local\Temp\65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8014184.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8014184.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2292
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0507411.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0507411.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5379935.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5379935.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2780
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2652
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2488
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 268
                7⤵
                • Program crash
                PID:2988
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 272
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8014184.exe

    Filesize

    840KB

    MD5

    6b6b3f8c9d927f682bcfe61d691975ad

    SHA1

    3372eff8f464750c93d9760728cdac0bff3667f0

    SHA256

    c37ad17236cb25a065ac7cdbef925d8019c0dab9c9de0f25c337f46331eb8113

    SHA512

    0badf2cba3c7991f8e18bf361bce4ac4ea616619fee21ce5e8465207af82bba05948577e9a78126e6da1366f75477439fe04a4a8036f14c676299207a4b880c4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8014184.exe

    Filesize

    840KB

    MD5

    6b6b3f8c9d927f682bcfe61d691975ad

    SHA1

    3372eff8f464750c93d9760728cdac0bff3667f0

    SHA256

    c37ad17236cb25a065ac7cdbef925d8019c0dab9c9de0f25c337f46331eb8113

    SHA512

    0badf2cba3c7991f8e18bf361bce4ac4ea616619fee21ce5e8465207af82bba05948577e9a78126e6da1366f75477439fe04a4a8036f14c676299207a4b880c4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0507411.exe

    Filesize

    563KB

    MD5

    928d21209f6f55e643983d0a6f67a6ef

    SHA1

    77ad9e90256cca3d295297b3eb11fd731f00f89a

    SHA256

    3aa14dcb8162faf16c0766546c4adf1796ae60272c43d4e4ff8e1598aaeb2a9c

    SHA512

    035393d743df98f16d594283dc8cc72fce8bdd9dcd9dd175e79675a1637252324147903269e9f18cf402f6fb4f917f20bf6ea3cff27527329c1c8ad5561bc781

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0507411.exe

    Filesize

    563KB

    MD5

    928d21209f6f55e643983d0a6f67a6ef

    SHA1

    77ad9e90256cca3d295297b3eb11fd731f00f89a

    SHA256

    3aa14dcb8162faf16c0766546c4adf1796ae60272c43d4e4ff8e1598aaeb2a9c

    SHA512

    035393d743df98f16d594283dc8cc72fce8bdd9dcd9dd175e79675a1637252324147903269e9f18cf402f6fb4f917f20bf6ea3cff27527329c1c8ad5561bc781

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5379935.exe

    Filesize

    397KB

    MD5

    28cb9be91ce739456924b29576ed6c1f

    SHA1

    7a1da9c629e658e80ff86f677a0c8ac95f08fd93

    SHA256

    bf72065e27e4c425f64c84b029d15fef07105565faf31cc947c03f6d0c043572

    SHA512

    4b8281c0ddaf457b4cff82f80cea1cc23ae2f01ecf90e21ab8c2580ae33dc54bb3c2a01c032e84b9e1aa05a1e89fadc1239eb19a419a1910ecc3e20bf482de33

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5379935.exe

    Filesize

    397KB

    MD5

    28cb9be91ce739456924b29576ed6c1f

    SHA1

    7a1da9c629e658e80ff86f677a0c8ac95f08fd93

    SHA256

    bf72065e27e4c425f64c84b029d15fef07105565faf31cc947c03f6d0c043572

    SHA512

    4b8281c0ddaf457b4cff82f80cea1cc23ae2f01ecf90e21ab8c2580ae33dc54bb3c2a01c032e84b9e1aa05a1e89fadc1239eb19a419a1910ecc3e20bf482de33

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe

    Filesize

    379KB

    MD5

    f09f02eea4e05534b673ea1eb54999f1

    SHA1

    dfe9ebbe4a3a2da11236ade6c1da153130446e2f

    SHA256

    a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2

    SHA512

    4c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe

    Filesize

    379KB

    MD5

    f09f02eea4e05534b673ea1eb54999f1

    SHA1

    dfe9ebbe4a3a2da11236ade6c1da153130446e2f

    SHA256

    a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2

    SHA512

    4c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe

    Filesize

    379KB

    MD5

    f09f02eea4e05534b673ea1eb54999f1

    SHA1

    dfe9ebbe4a3a2da11236ade6c1da153130446e2f

    SHA256

    a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2

    SHA512

    4c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x8014184.exe

    Filesize

    840KB

    MD5

    6b6b3f8c9d927f682bcfe61d691975ad

    SHA1

    3372eff8f464750c93d9760728cdac0bff3667f0

    SHA256

    c37ad17236cb25a065ac7cdbef925d8019c0dab9c9de0f25c337f46331eb8113

    SHA512

    0badf2cba3c7991f8e18bf361bce4ac4ea616619fee21ce5e8465207af82bba05948577e9a78126e6da1366f75477439fe04a4a8036f14c676299207a4b880c4

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x8014184.exe

    Filesize

    840KB

    MD5

    6b6b3f8c9d927f682bcfe61d691975ad

    SHA1

    3372eff8f464750c93d9760728cdac0bff3667f0

    SHA256

    c37ad17236cb25a065ac7cdbef925d8019c0dab9c9de0f25c337f46331eb8113

    SHA512

    0badf2cba3c7991f8e18bf361bce4ac4ea616619fee21ce5e8465207af82bba05948577e9a78126e6da1366f75477439fe04a4a8036f14c676299207a4b880c4

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x0507411.exe

    Filesize

    563KB

    MD5

    928d21209f6f55e643983d0a6f67a6ef

    SHA1

    77ad9e90256cca3d295297b3eb11fd731f00f89a

    SHA256

    3aa14dcb8162faf16c0766546c4adf1796ae60272c43d4e4ff8e1598aaeb2a9c

    SHA512

    035393d743df98f16d594283dc8cc72fce8bdd9dcd9dd175e79675a1637252324147903269e9f18cf402f6fb4f917f20bf6ea3cff27527329c1c8ad5561bc781

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x0507411.exe

    Filesize

    563KB

    MD5

    928d21209f6f55e643983d0a6f67a6ef

    SHA1

    77ad9e90256cca3d295297b3eb11fd731f00f89a

    SHA256

    3aa14dcb8162faf16c0766546c4adf1796ae60272c43d4e4ff8e1598aaeb2a9c

    SHA512

    035393d743df98f16d594283dc8cc72fce8bdd9dcd9dd175e79675a1637252324147903269e9f18cf402f6fb4f917f20bf6ea3cff27527329c1c8ad5561bc781

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x5379935.exe

    Filesize

    397KB

    MD5

    28cb9be91ce739456924b29576ed6c1f

    SHA1

    7a1da9c629e658e80ff86f677a0c8ac95f08fd93

    SHA256

    bf72065e27e4c425f64c84b029d15fef07105565faf31cc947c03f6d0c043572

    SHA512

    4b8281c0ddaf457b4cff82f80cea1cc23ae2f01ecf90e21ab8c2580ae33dc54bb3c2a01c032e84b9e1aa05a1e89fadc1239eb19a419a1910ecc3e20bf482de33

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x5379935.exe

    Filesize

    397KB

    MD5

    28cb9be91ce739456924b29576ed6c1f

    SHA1

    7a1da9c629e658e80ff86f677a0c8ac95f08fd93

    SHA256

    bf72065e27e4c425f64c84b029d15fef07105565faf31cc947c03f6d0c043572

    SHA512

    4b8281c0ddaf457b4cff82f80cea1cc23ae2f01ecf90e21ab8c2580ae33dc54bb3c2a01c032e84b9e1aa05a1e89fadc1239eb19a419a1910ecc3e20bf482de33

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe

    Filesize

    379KB

    MD5

    f09f02eea4e05534b673ea1eb54999f1

    SHA1

    dfe9ebbe4a3a2da11236ade6c1da153130446e2f

    SHA256

    a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2

    SHA512

    4c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe

    Filesize

    379KB

    MD5

    f09f02eea4e05534b673ea1eb54999f1

    SHA1

    dfe9ebbe4a3a2da11236ade6c1da153130446e2f

    SHA256

    a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2

    SHA512

    4c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe

    Filesize

    379KB

    MD5

    f09f02eea4e05534b673ea1eb54999f1

    SHA1

    dfe9ebbe4a3a2da11236ade6c1da153130446e2f

    SHA256

    a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2

    SHA512

    4c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe

    Filesize

    379KB

    MD5

    f09f02eea4e05534b673ea1eb54999f1

    SHA1

    dfe9ebbe4a3a2da11236ade6c1da153130446e2f

    SHA256

    a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2

    SHA512

    4c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe

    Filesize

    379KB

    MD5

    f09f02eea4e05534b673ea1eb54999f1

    SHA1

    dfe9ebbe4a3a2da11236ade6c1da153130446e2f

    SHA256

    a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2

    SHA512

    4c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe

    Filesize

    379KB

    MD5

    f09f02eea4e05534b673ea1eb54999f1

    SHA1

    dfe9ebbe4a3a2da11236ade6c1da153130446e2f

    SHA256

    a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2

    SHA512

    4c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe

    Filesize

    379KB

    MD5

    f09f02eea4e05534b673ea1eb54999f1

    SHA1

    dfe9ebbe4a3a2da11236ade6c1da153130446e2f

    SHA256

    a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2

    SHA512

    4c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed

  • memory/2488-49-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2488-48-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2488-43-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2488-50-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2488-52-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2488-54-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2488-47-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2488-46-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2488-45-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2488-44-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB