Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe
Resource
win10v2004-20230915-en
General
-
Target
65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe
-
Size
943KB
-
MD5
6adc6ada2339ac051903999bc36faf3b
-
SHA1
d03e60cb7c43b8af22028b9acb3bf6ef9c69d3c1
-
SHA256
65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e
-
SHA512
c73faa5d52818fd0ffab0ff273b96e3745f22e3b90321ef099617b895b1187245f16d7bb820ea415b1fbe62d4dc34b2c3ffa7786bf7d69abcf8933c4b3d00187
-
SSDEEP
12288:ZMrMy90mejTjWI3jJlZ6Ra6wKX+6FTiVvGe3TBErdyqDXOF5rpFSwxKqzAh2Jpvb:dyWjNMRa6wJUm5BdSyRrpFflNsItt
Malware Config
Signatures
-
Detect Mystic stealer payload 6 IoCs
resource yara_rule behavioral1/memory/2488-46-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2488-47-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2488-48-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2488-50-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2488-52-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2488-54-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Executes dropped EXE 4 IoCs
pid Process 2292 x8014184.exe 2760 x0507411.exe 2780 x5379935.exe 2652 g3149978.exe -
Loads dropped DLL 13 IoCs
pid Process 2236 65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe 2292 x8014184.exe 2292 x8014184.exe 2760 x0507411.exe 2760 x0507411.exe 2780 x5379935.exe 2780 x5379935.exe 2780 x5379935.exe 2652 g3149978.exe 2556 WerFault.exe 2556 WerFault.exe 2556 WerFault.exe 2556 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x8014184.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x0507411.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x5379935.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2652 set thread context of 2488 2652 g3149978.exe 34 -
Program crash 2 IoCs
pid pid_target Process procid_target 2556 2652 WerFault.exe 32 2988 2488 WerFault.exe 34 -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2292 2236 65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe 29 PID 2236 wrote to memory of 2292 2236 65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe 29 PID 2236 wrote to memory of 2292 2236 65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe 29 PID 2236 wrote to memory of 2292 2236 65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe 29 PID 2236 wrote to memory of 2292 2236 65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe 29 PID 2236 wrote to memory of 2292 2236 65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe 29 PID 2236 wrote to memory of 2292 2236 65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe 29 PID 2292 wrote to memory of 2760 2292 x8014184.exe 30 PID 2292 wrote to memory of 2760 2292 x8014184.exe 30 PID 2292 wrote to memory of 2760 2292 x8014184.exe 30 PID 2292 wrote to memory of 2760 2292 x8014184.exe 30 PID 2292 wrote to memory of 2760 2292 x8014184.exe 30 PID 2292 wrote to memory of 2760 2292 x8014184.exe 30 PID 2292 wrote to memory of 2760 2292 x8014184.exe 30 PID 2760 wrote to memory of 2780 2760 x0507411.exe 31 PID 2760 wrote to memory of 2780 2760 x0507411.exe 31 PID 2760 wrote to memory of 2780 2760 x0507411.exe 31 PID 2760 wrote to memory of 2780 2760 x0507411.exe 31 PID 2760 wrote to memory of 2780 2760 x0507411.exe 31 PID 2760 wrote to memory of 2780 2760 x0507411.exe 31 PID 2760 wrote to memory of 2780 2760 x0507411.exe 31 PID 2780 wrote to memory of 2652 2780 x5379935.exe 32 PID 2780 wrote to memory of 2652 2780 x5379935.exe 32 PID 2780 wrote to memory of 2652 2780 x5379935.exe 32 PID 2780 wrote to memory of 2652 2780 x5379935.exe 32 PID 2780 wrote to memory of 2652 2780 x5379935.exe 32 PID 2780 wrote to memory of 2652 2780 x5379935.exe 32 PID 2780 wrote to memory of 2652 2780 x5379935.exe 32 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2488 2652 g3149978.exe 34 PID 2652 wrote to memory of 2556 2652 g3149978.exe 35 PID 2488 wrote to memory of 2988 2488 AppLaunch.exe 36 PID 2652 wrote to memory of 2556 2652 g3149978.exe 35 PID 2652 wrote to memory of 2556 2652 g3149978.exe 35 PID 2488 wrote to memory of 2988 2488 AppLaunch.exe 36 PID 2488 wrote to memory of 2988 2488 AppLaunch.exe 36 PID 2488 wrote to memory of 2988 2488 AppLaunch.exe 36 PID 2488 wrote to memory of 2988 2488 AppLaunch.exe 36 PID 2488 wrote to memory of 2988 2488 AppLaunch.exe 36 PID 2652 wrote to memory of 2556 2652 g3149978.exe 35 PID 2488 wrote to memory of 2988 2488 AppLaunch.exe 36 PID 2652 wrote to memory of 2556 2652 g3149978.exe 35 PID 2652 wrote to memory of 2556 2652 g3149978.exe 35 PID 2652 wrote to memory of 2556 2652 g3149978.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe"C:\Users\Admin\AppData\Local\Temp\65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8014184.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8014184.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0507411.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0507411.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5379935.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5379935.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3149978.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 2687⤵
- Program crash
PID:2988
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 2726⤵
- Loads dropped DLL
- Program crash
PID:2556
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
840KB
MD56b6b3f8c9d927f682bcfe61d691975ad
SHA13372eff8f464750c93d9760728cdac0bff3667f0
SHA256c37ad17236cb25a065ac7cdbef925d8019c0dab9c9de0f25c337f46331eb8113
SHA5120badf2cba3c7991f8e18bf361bce4ac4ea616619fee21ce5e8465207af82bba05948577e9a78126e6da1366f75477439fe04a4a8036f14c676299207a4b880c4
-
Filesize
840KB
MD56b6b3f8c9d927f682bcfe61d691975ad
SHA13372eff8f464750c93d9760728cdac0bff3667f0
SHA256c37ad17236cb25a065ac7cdbef925d8019c0dab9c9de0f25c337f46331eb8113
SHA5120badf2cba3c7991f8e18bf361bce4ac4ea616619fee21ce5e8465207af82bba05948577e9a78126e6da1366f75477439fe04a4a8036f14c676299207a4b880c4
-
Filesize
563KB
MD5928d21209f6f55e643983d0a6f67a6ef
SHA177ad9e90256cca3d295297b3eb11fd731f00f89a
SHA2563aa14dcb8162faf16c0766546c4adf1796ae60272c43d4e4ff8e1598aaeb2a9c
SHA512035393d743df98f16d594283dc8cc72fce8bdd9dcd9dd175e79675a1637252324147903269e9f18cf402f6fb4f917f20bf6ea3cff27527329c1c8ad5561bc781
-
Filesize
563KB
MD5928d21209f6f55e643983d0a6f67a6ef
SHA177ad9e90256cca3d295297b3eb11fd731f00f89a
SHA2563aa14dcb8162faf16c0766546c4adf1796ae60272c43d4e4ff8e1598aaeb2a9c
SHA512035393d743df98f16d594283dc8cc72fce8bdd9dcd9dd175e79675a1637252324147903269e9f18cf402f6fb4f917f20bf6ea3cff27527329c1c8ad5561bc781
-
Filesize
397KB
MD528cb9be91ce739456924b29576ed6c1f
SHA17a1da9c629e658e80ff86f677a0c8ac95f08fd93
SHA256bf72065e27e4c425f64c84b029d15fef07105565faf31cc947c03f6d0c043572
SHA5124b8281c0ddaf457b4cff82f80cea1cc23ae2f01ecf90e21ab8c2580ae33dc54bb3c2a01c032e84b9e1aa05a1e89fadc1239eb19a419a1910ecc3e20bf482de33
-
Filesize
397KB
MD528cb9be91ce739456924b29576ed6c1f
SHA17a1da9c629e658e80ff86f677a0c8ac95f08fd93
SHA256bf72065e27e4c425f64c84b029d15fef07105565faf31cc947c03f6d0c043572
SHA5124b8281c0ddaf457b4cff82f80cea1cc23ae2f01ecf90e21ab8c2580ae33dc54bb3c2a01c032e84b9e1aa05a1e89fadc1239eb19a419a1910ecc3e20bf482de33
-
Filesize
379KB
MD5f09f02eea4e05534b673ea1eb54999f1
SHA1dfe9ebbe4a3a2da11236ade6c1da153130446e2f
SHA256a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2
SHA5124c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed
-
Filesize
379KB
MD5f09f02eea4e05534b673ea1eb54999f1
SHA1dfe9ebbe4a3a2da11236ade6c1da153130446e2f
SHA256a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2
SHA5124c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed
-
Filesize
379KB
MD5f09f02eea4e05534b673ea1eb54999f1
SHA1dfe9ebbe4a3a2da11236ade6c1da153130446e2f
SHA256a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2
SHA5124c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed
-
Filesize
840KB
MD56b6b3f8c9d927f682bcfe61d691975ad
SHA13372eff8f464750c93d9760728cdac0bff3667f0
SHA256c37ad17236cb25a065ac7cdbef925d8019c0dab9c9de0f25c337f46331eb8113
SHA5120badf2cba3c7991f8e18bf361bce4ac4ea616619fee21ce5e8465207af82bba05948577e9a78126e6da1366f75477439fe04a4a8036f14c676299207a4b880c4
-
Filesize
840KB
MD56b6b3f8c9d927f682bcfe61d691975ad
SHA13372eff8f464750c93d9760728cdac0bff3667f0
SHA256c37ad17236cb25a065ac7cdbef925d8019c0dab9c9de0f25c337f46331eb8113
SHA5120badf2cba3c7991f8e18bf361bce4ac4ea616619fee21ce5e8465207af82bba05948577e9a78126e6da1366f75477439fe04a4a8036f14c676299207a4b880c4
-
Filesize
563KB
MD5928d21209f6f55e643983d0a6f67a6ef
SHA177ad9e90256cca3d295297b3eb11fd731f00f89a
SHA2563aa14dcb8162faf16c0766546c4adf1796ae60272c43d4e4ff8e1598aaeb2a9c
SHA512035393d743df98f16d594283dc8cc72fce8bdd9dcd9dd175e79675a1637252324147903269e9f18cf402f6fb4f917f20bf6ea3cff27527329c1c8ad5561bc781
-
Filesize
563KB
MD5928d21209f6f55e643983d0a6f67a6ef
SHA177ad9e90256cca3d295297b3eb11fd731f00f89a
SHA2563aa14dcb8162faf16c0766546c4adf1796ae60272c43d4e4ff8e1598aaeb2a9c
SHA512035393d743df98f16d594283dc8cc72fce8bdd9dcd9dd175e79675a1637252324147903269e9f18cf402f6fb4f917f20bf6ea3cff27527329c1c8ad5561bc781
-
Filesize
397KB
MD528cb9be91ce739456924b29576ed6c1f
SHA17a1da9c629e658e80ff86f677a0c8ac95f08fd93
SHA256bf72065e27e4c425f64c84b029d15fef07105565faf31cc947c03f6d0c043572
SHA5124b8281c0ddaf457b4cff82f80cea1cc23ae2f01ecf90e21ab8c2580ae33dc54bb3c2a01c032e84b9e1aa05a1e89fadc1239eb19a419a1910ecc3e20bf482de33
-
Filesize
397KB
MD528cb9be91ce739456924b29576ed6c1f
SHA17a1da9c629e658e80ff86f677a0c8ac95f08fd93
SHA256bf72065e27e4c425f64c84b029d15fef07105565faf31cc947c03f6d0c043572
SHA5124b8281c0ddaf457b4cff82f80cea1cc23ae2f01ecf90e21ab8c2580ae33dc54bb3c2a01c032e84b9e1aa05a1e89fadc1239eb19a419a1910ecc3e20bf482de33
-
Filesize
379KB
MD5f09f02eea4e05534b673ea1eb54999f1
SHA1dfe9ebbe4a3a2da11236ade6c1da153130446e2f
SHA256a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2
SHA5124c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed
-
Filesize
379KB
MD5f09f02eea4e05534b673ea1eb54999f1
SHA1dfe9ebbe4a3a2da11236ade6c1da153130446e2f
SHA256a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2
SHA5124c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed
-
Filesize
379KB
MD5f09f02eea4e05534b673ea1eb54999f1
SHA1dfe9ebbe4a3a2da11236ade6c1da153130446e2f
SHA256a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2
SHA5124c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed
-
Filesize
379KB
MD5f09f02eea4e05534b673ea1eb54999f1
SHA1dfe9ebbe4a3a2da11236ade6c1da153130446e2f
SHA256a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2
SHA5124c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed
-
Filesize
379KB
MD5f09f02eea4e05534b673ea1eb54999f1
SHA1dfe9ebbe4a3a2da11236ade6c1da153130446e2f
SHA256a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2
SHA5124c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed
-
Filesize
379KB
MD5f09f02eea4e05534b673ea1eb54999f1
SHA1dfe9ebbe4a3a2da11236ade6c1da153130446e2f
SHA256a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2
SHA5124c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed
-
Filesize
379KB
MD5f09f02eea4e05534b673ea1eb54999f1
SHA1dfe9ebbe4a3a2da11236ade6c1da153130446e2f
SHA256a52570ed3932795ef2b4d9af2e1d3b232135ae6a49a55cd0c1789a77ce9c39d2
SHA5124c1b638c846e3a6322d672be79b08473e54da2e1d05e0ecc14163b1b09148f72869b38c059c881a6021a866139a5d9955561786420ad4d27c1baa6d4c48da5ed