Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 20:16
Static task
static1
Behavioral task
behavioral1
Sample
b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe
Resource
win7-20230831-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe
-
Size
380KB
-
MD5
831f8e3ec36a98cef6c4115c66649628
-
SHA1
e72c14e8a0fa67ee435378d5b45e6923d4445e0e
-
SHA256
b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5
-
SHA512
6df068ed44e0d63bee309f456b4658b76a2c866a5cdc9f1e0e57f569441a7c5014495547798c7ef277b41012be2ca23b6ddec4d7bb244ed5faf0bde641b3417e
-
SSDEEP
6144:qlPVhHX110KwTVSf3pOCq5b6uAOSTMiI/bedZ8dHzrd4BypS4cQqwm:qlPL3110dVaUcuMThI/ydWF4BonYwm
Malware Config
Signatures
-
Detect Mystic stealer payload 6 IoCs
resource yara_rule behavioral1/memory/2952-3-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2952-4-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2952-5-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2952-7-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2952-9-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2952-11-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2072 set thread context of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 -
Program crash 2 IoCs
pid pid_target Process procid_target 2308 2072 WerFault.exe 27 2672 2952 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2948 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 28 PID 2072 wrote to memory of 2948 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 28 PID 2072 wrote to memory of 2948 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 28 PID 2072 wrote to memory of 2948 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 28 PID 2072 wrote to memory of 2948 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 28 PID 2072 wrote to memory of 2948 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 28 PID 2072 wrote to memory of 2948 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 28 PID 2072 wrote to memory of 1932 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 29 PID 2072 wrote to memory of 1932 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 29 PID 2072 wrote to memory of 1932 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 29 PID 2072 wrote to memory of 1932 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 29 PID 2072 wrote to memory of 1932 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 29 PID 2072 wrote to memory of 1932 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 29 PID 2072 wrote to memory of 1932 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 29 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2952 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 30 PID 2072 wrote to memory of 2308 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 31 PID 2072 wrote to memory of 2308 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 31 PID 2072 wrote to memory of 2308 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 31 PID 2072 wrote to memory of 2308 2072 b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe 31 PID 2952 wrote to memory of 2672 2952 AppLaunch.exe 32 PID 2952 wrote to memory of 2672 2952 AppLaunch.exe 32 PID 2952 wrote to memory of 2672 2952 AppLaunch.exe 32 PID 2952 wrote to memory of 2672 2952 AppLaunch.exe 32 PID 2952 wrote to memory of 2672 2952 AppLaunch.exe 32 PID 2952 wrote to memory of 2672 2952 AppLaunch.exe 32 PID 2952 wrote to memory of 2672 2952 AppLaunch.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe"C:\Users\Admin\AppData\Local\Temp\b98bb205b66ffbf22f2ef766e0235f7253b5f23bfac9e5241efb87d966f534f5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2948
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1932
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 1963⤵
- Program crash
PID:2672
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 722⤵
- Program crash
PID:2308
-