Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    26s
  • max time network
    29s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 20:20

General

  • Target

    a417ed0ab5fb6857593f4311da5fdb85ab10f94132f44c6cde60a70077c5a1fc.exe

  • Size

    935KB

  • MD5

    393529959f49656c9a795558ed054a56

  • SHA1

    10cf407d485a22b9f61d1351a96c7886f2705d0c

  • SHA256

    a417ed0ab5fb6857593f4311da5fdb85ab10f94132f44c6cde60a70077c5a1fc

  • SHA512

    4ac6953de2a0d4160f7c599fb1eb2b2c786bf5c1160557d741d7097a3d5c81b72382c9da33149cfbccfe7f19467f0a348e5b4f92f400aada64957efac5555070

  • SSDEEP

    12288:1MrKy90jEUQB+ahcWxI4kO0QCkbHNzlRvrpLB6YpG3mYFA72sZyy0nAXH0d7ilgP:PyAEdkahR9BCMrFLYrn+H0ygK3G

Malware Config

Signatures

  • Detect Mystic stealer payload 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a417ed0ab5fb6857593f4311da5fdb85ab10f94132f44c6cde60a70077c5a1fc.exe
    "C:\Users\Admin\AppData\Local\Temp\a417ed0ab5fb6857593f4311da5fdb85ab10f94132f44c6cde60a70077c5a1fc.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5156724.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5156724.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4130575.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4130575.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4640084.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4640084.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2596
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2680
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2668
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 268
                7⤵
                • Program crash
                PID:2492
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 272
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5156724.exe

    Filesize

    833KB

    MD5

    0bf7f136829434a3c375b04afe87a4f1

    SHA1

    5c6feaad5dd3aa0dec8392b400ee9cccf23dad10

    SHA256

    e32358f37ff29bbfbe36d91575b955a5bfb574d97f081c8cfb4ab0f4384b4b94

    SHA512

    fb882ec6a8f52971146aac238f77d7af749791dd6e803f82577d57a9ff9bf313f148d22212e5849c741047b2af13acc0418f2ed891f49d3b7be85787543b19dd

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5156724.exe

    Filesize

    833KB

    MD5

    0bf7f136829434a3c375b04afe87a4f1

    SHA1

    5c6feaad5dd3aa0dec8392b400ee9cccf23dad10

    SHA256

    e32358f37ff29bbfbe36d91575b955a5bfb574d97f081c8cfb4ab0f4384b4b94

    SHA512

    fb882ec6a8f52971146aac238f77d7af749791dd6e803f82577d57a9ff9bf313f148d22212e5849c741047b2af13acc0418f2ed891f49d3b7be85787543b19dd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4130575.exe

    Filesize

    559KB

    MD5

    ca0f3114e295830673920a666d86b12b

    SHA1

    843a86f9e50efed658d570dde5958eaa2db5cdad

    SHA256

    b5e278860f1ac67f8655b656d4e397521813d89258b653fbca8f8b926bb50d7c

    SHA512

    81fdd2c32b2510e6135baef824d749ea2175c5e341aa73ff081c0093ad9927745c046b1811aaf3dc9df085c7036310dcfce1ad7f8b9fdd31f528f3ed47483cb4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4130575.exe

    Filesize

    559KB

    MD5

    ca0f3114e295830673920a666d86b12b

    SHA1

    843a86f9e50efed658d570dde5958eaa2db5cdad

    SHA256

    b5e278860f1ac67f8655b656d4e397521813d89258b653fbca8f8b926bb50d7c

    SHA512

    81fdd2c32b2510e6135baef824d749ea2175c5e341aa73ff081c0093ad9927745c046b1811aaf3dc9df085c7036310dcfce1ad7f8b9fdd31f528f3ed47483cb4

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4640084.exe

    Filesize

    393KB

    MD5

    d16a35d49a18fa6aa0ea71858385a0e8

    SHA1

    e616e31653af9292a61d5f29fedc20ab533d9119

    SHA256

    ab906839b241662329e5fc01c04818ab455705370aee3412fc2cfff0a8e7f2b7

    SHA512

    8b50d98f3aa5ba347d54188d5028b8f99658277e7cbfa09891404cb6ac253e88ba98b27c77cfee40f6c6f0d3a9b0512afc0edb5e3c1fcb851a29c096ab924ba0

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4640084.exe

    Filesize

    393KB

    MD5

    d16a35d49a18fa6aa0ea71858385a0e8

    SHA1

    e616e31653af9292a61d5f29fedc20ab533d9119

    SHA256

    ab906839b241662329e5fc01c04818ab455705370aee3412fc2cfff0a8e7f2b7

    SHA512

    8b50d98f3aa5ba347d54188d5028b8f99658277e7cbfa09891404cb6ac253e88ba98b27c77cfee40f6c6f0d3a9b0512afc0edb5e3c1fcb851a29c096ab924ba0

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe

    Filesize

    380KB

    MD5

    929437a5c5a9a45ea960b7037e32b71d

    SHA1

    b6e577052e0190b65209a744de9faf361faa3633

    SHA256

    0da42dfcb536b9121da124409c9b72423f9fa52eb2f3f6df93e0f4884f70086f

    SHA512

    b34dc95cc33d90ad33072fe1fb76c25b91982f7296b866c584940b53996b68c87e376fd91cb5f1f548745c86d9bc2fca84fcee7d67c3bc8eddc75db97af39b89

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe

    Filesize

    380KB

    MD5

    929437a5c5a9a45ea960b7037e32b71d

    SHA1

    b6e577052e0190b65209a744de9faf361faa3633

    SHA256

    0da42dfcb536b9121da124409c9b72423f9fa52eb2f3f6df93e0f4884f70086f

    SHA512

    b34dc95cc33d90ad33072fe1fb76c25b91982f7296b866c584940b53996b68c87e376fd91cb5f1f548745c86d9bc2fca84fcee7d67c3bc8eddc75db97af39b89

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe

    Filesize

    380KB

    MD5

    929437a5c5a9a45ea960b7037e32b71d

    SHA1

    b6e577052e0190b65209a744de9faf361faa3633

    SHA256

    0da42dfcb536b9121da124409c9b72423f9fa52eb2f3f6df93e0f4884f70086f

    SHA512

    b34dc95cc33d90ad33072fe1fb76c25b91982f7296b866c584940b53996b68c87e376fd91cb5f1f548745c86d9bc2fca84fcee7d67c3bc8eddc75db97af39b89

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x5156724.exe

    Filesize

    833KB

    MD5

    0bf7f136829434a3c375b04afe87a4f1

    SHA1

    5c6feaad5dd3aa0dec8392b400ee9cccf23dad10

    SHA256

    e32358f37ff29bbfbe36d91575b955a5bfb574d97f081c8cfb4ab0f4384b4b94

    SHA512

    fb882ec6a8f52971146aac238f77d7af749791dd6e803f82577d57a9ff9bf313f148d22212e5849c741047b2af13acc0418f2ed891f49d3b7be85787543b19dd

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x5156724.exe

    Filesize

    833KB

    MD5

    0bf7f136829434a3c375b04afe87a4f1

    SHA1

    5c6feaad5dd3aa0dec8392b400ee9cccf23dad10

    SHA256

    e32358f37ff29bbfbe36d91575b955a5bfb574d97f081c8cfb4ab0f4384b4b94

    SHA512

    fb882ec6a8f52971146aac238f77d7af749791dd6e803f82577d57a9ff9bf313f148d22212e5849c741047b2af13acc0418f2ed891f49d3b7be85787543b19dd

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x4130575.exe

    Filesize

    559KB

    MD5

    ca0f3114e295830673920a666d86b12b

    SHA1

    843a86f9e50efed658d570dde5958eaa2db5cdad

    SHA256

    b5e278860f1ac67f8655b656d4e397521813d89258b653fbca8f8b926bb50d7c

    SHA512

    81fdd2c32b2510e6135baef824d749ea2175c5e341aa73ff081c0093ad9927745c046b1811aaf3dc9df085c7036310dcfce1ad7f8b9fdd31f528f3ed47483cb4

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x4130575.exe

    Filesize

    559KB

    MD5

    ca0f3114e295830673920a666d86b12b

    SHA1

    843a86f9e50efed658d570dde5958eaa2db5cdad

    SHA256

    b5e278860f1ac67f8655b656d4e397521813d89258b653fbca8f8b926bb50d7c

    SHA512

    81fdd2c32b2510e6135baef824d749ea2175c5e341aa73ff081c0093ad9927745c046b1811aaf3dc9df085c7036310dcfce1ad7f8b9fdd31f528f3ed47483cb4

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x4640084.exe

    Filesize

    393KB

    MD5

    d16a35d49a18fa6aa0ea71858385a0e8

    SHA1

    e616e31653af9292a61d5f29fedc20ab533d9119

    SHA256

    ab906839b241662329e5fc01c04818ab455705370aee3412fc2cfff0a8e7f2b7

    SHA512

    8b50d98f3aa5ba347d54188d5028b8f99658277e7cbfa09891404cb6ac253e88ba98b27c77cfee40f6c6f0d3a9b0512afc0edb5e3c1fcb851a29c096ab924ba0

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x4640084.exe

    Filesize

    393KB

    MD5

    d16a35d49a18fa6aa0ea71858385a0e8

    SHA1

    e616e31653af9292a61d5f29fedc20ab533d9119

    SHA256

    ab906839b241662329e5fc01c04818ab455705370aee3412fc2cfff0a8e7f2b7

    SHA512

    8b50d98f3aa5ba347d54188d5028b8f99658277e7cbfa09891404cb6ac253e88ba98b27c77cfee40f6c6f0d3a9b0512afc0edb5e3c1fcb851a29c096ab924ba0

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe

    Filesize

    380KB

    MD5

    929437a5c5a9a45ea960b7037e32b71d

    SHA1

    b6e577052e0190b65209a744de9faf361faa3633

    SHA256

    0da42dfcb536b9121da124409c9b72423f9fa52eb2f3f6df93e0f4884f70086f

    SHA512

    b34dc95cc33d90ad33072fe1fb76c25b91982f7296b866c584940b53996b68c87e376fd91cb5f1f548745c86d9bc2fca84fcee7d67c3bc8eddc75db97af39b89

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe

    Filesize

    380KB

    MD5

    929437a5c5a9a45ea960b7037e32b71d

    SHA1

    b6e577052e0190b65209a744de9faf361faa3633

    SHA256

    0da42dfcb536b9121da124409c9b72423f9fa52eb2f3f6df93e0f4884f70086f

    SHA512

    b34dc95cc33d90ad33072fe1fb76c25b91982f7296b866c584940b53996b68c87e376fd91cb5f1f548745c86d9bc2fca84fcee7d67c3bc8eddc75db97af39b89

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe

    Filesize

    380KB

    MD5

    929437a5c5a9a45ea960b7037e32b71d

    SHA1

    b6e577052e0190b65209a744de9faf361faa3633

    SHA256

    0da42dfcb536b9121da124409c9b72423f9fa52eb2f3f6df93e0f4884f70086f

    SHA512

    b34dc95cc33d90ad33072fe1fb76c25b91982f7296b866c584940b53996b68c87e376fd91cb5f1f548745c86d9bc2fca84fcee7d67c3bc8eddc75db97af39b89

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe

    Filesize

    380KB

    MD5

    929437a5c5a9a45ea960b7037e32b71d

    SHA1

    b6e577052e0190b65209a744de9faf361faa3633

    SHA256

    0da42dfcb536b9121da124409c9b72423f9fa52eb2f3f6df93e0f4884f70086f

    SHA512

    b34dc95cc33d90ad33072fe1fb76c25b91982f7296b866c584940b53996b68c87e376fd91cb5f1f548745c86d9bc2fca84fcee7d67c3bc8eddc75db97af39b89

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe

    Filesize

    380KB

    MD5

    929437a5c5a9a45ea960b7037e32b71d

    SHA1

    b6e577052e0190b65209a744de9faf361faa3633

    SHA256

    0da42dfcb536b9121da124409c9b72423f9fa52eb2f3f6df93e0f4884f70086f

    SHA512

    b34dc95cc33d90ad33072fe1fb76c25b91982f7296b866c584940b53996b68c87e376fd91cb5f1f548745c86d9bc2fca84fcee7d67c3bc8eddc75db97af39b89

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe

    Filesize

    380KB

    MD5

    929437a5c5a9a45ea960b7037e32b71d

    SHA1

    b6e577052e0190b65209a744de9faf361faa3633

    SHA256

    0da42dfcb536b9121da124409c9b72423f9fa52eb2f3f6df93e0f4884f70086f

    SHA512

    b34dc95cc33d90ad33072fe1fb76c25b91982f7296b866c584940b53996b68c87e376fd91cb5f1f548745c86d9bc2fca84fcee7d67c3bc8eddc75db97af39b89

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g0654549.exe

    Filesize

    380KB

    MD5

    929437a5c5a9a45ea960b7037e32b71d

    SHA1

    b6e577052e0190b65209a744de9faf361faa3633

    SHA256

    0da42dfcb536b9121da124409c9b72423f9fa52eb2f3f6df93e0f4884f70086f

    SHA512

    b34dc95cc33d90ad33072fe1fb76c25b91982f7296b866c584940b53996b68c87e376fd91cb5f1f548745c86d9bc2fca84fcee7d67c3bc8eddc75db97af39b89

  • memory/2668-49-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2668-48-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2668-43-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2668-50-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2668-52-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2668-54-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2668-47-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2668-46-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2668-45-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2668-44-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB