Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 02:25
Static task
static1
Behavioral task
behavioral1
Sample
c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe
Resource
win7-20230831-en
3 signatures
150 seconds
General
-
Target
c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe
-
Size
365KB
-
MD5
f783849626623c8a44d2b978bc951bc1
-
SHA1
a5458154c2ee4bdc8664e84c61cf413c09e27363
-
SHA256
c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12
-
SHA512
726777c8637b14b128a75dac6da4ea8be2d8f243252682b15c12eac6edb4f357297484c9a5b4f6c81fed7a45f8bf59e904fb4939f52eaf08b8ea60d00bcefa9e
-
SSDEEP
6144:Je5frpxdonyq4zaG2u5AOaeK32uw+HxzBoFfNpNzVCuEFeYGIRHoenrFTvwSAdv0:JQrp0/9u5UeKTsllQOWnEXuxIquqp
Malware Config
Extracted
Family
mystic
C2
http://5.42.92.211/loghub/master
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 856 set thread context of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90 -
Program crash 1 IoCs
pid pid_target Process procid_target 4792 856 WerFault.exe 86 -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 856 wrote to memory of 2504 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 89 PID 856 wrote to memory of 2504 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 89 PID 856 wrote to memory of 2504 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 89 PID 856 wrote to memory of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90 PID 856 wrote to memory of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90 PID 856 wrote to memory of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90 PID 856 wrote to memory of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90 PID 856 wrote to memory of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90 PID 856 wrote to memory of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90 PID 856 wrote to memory of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90 PID 856 wrote to memory of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90 PID 856 wrote to memory of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90 PID 856 wrote to memory of 5060 856 c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe"C:\Users\Admin\AppData\Local\Temp\c0a8a2e0fc3b0f5932c72ace1c012931c1b410751efd782b98b2c1c6652dfd12.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2504
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 2722⤵
- Program crash
PID:4792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 856 -ip 8561⤵PID:4508