Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 22:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe
-
Size
359KB
-
MD5
20d3f8e9a5766baad9d7126a2234cecb
-
SHA1
26ad8b591b7e5c41d4e0be2a009f8079d88fe162
-
SHA256
a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53
-
SHA512
b100f23dd4409d8e6d2bc4beac39a0474a1d532c40a948e22150ac231458794c86fea7f71f6959d2969906b817c88a3187925b316ac30ee6124e023e46719a40
-
SSDEEP
6144:3PcaGEZt20ZSwbz8+Dxe8kVAOgl/bYtN9LlrK+uLxh9JHh8Ey:3PFzZtT78TuVe31uRJh8Ey
Malware Config
Signatures
-
Detect Mystic stealer payload 6 IoCs
resource yara_rule behavioral1/memory/3020-3-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/3020-4-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/3020-5-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/3020-7-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/3020-9-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/3020-11-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2216 set thread context of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 2744 3020 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2132 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 29 PID 2216 wrote to memory of 2132 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 29 PID 2216 wrote to memory of 2132 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 29 PID 2216 wrote to memory of 2132 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 29 PID 2216 wrote to memory of 2132 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 29 PID 2216 wrote to memory of 2132 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 29 PID 2216 wrote to memory of 2132 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 29 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 2216 wrote to memory of 3020 2216 a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe 30 PID 3020 wrote to memory of 2744 3020 AppLaunch.exe 31 PID 3020 wrote to memory of 2744 3020 AppLaunch.exe 31 PID 3020 wrote to memory of 2744 3020 AppLaunch.exe 31 PID 3020 wrote to memory of 2744 3020 AppLaunch.exe 31 PID 3020 wrote to memory of 2744 3020 AppLaunch.exe 31 PID 3020 wrote to memory of 2744 3020 AppLaunch.exe 31 PID 3020 wrote to memory of 2744 3020 AppLaunch.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe"C:\Users\Admin\AppData\Local\Temp\a7384823dae8a7834883d34377202525a769d86f7cd06ab289f84e8b8aebad53.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2132
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 1963⤵
- Program crash
PID:2744
-
-