Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe
Resource
win7-20230831-en
3 signatures
150 seconds
General
-
Target
c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe
-
Size
365KB
-
MD5
6a4be4984268b8a62d6c96fc5cf05069
-
SHA1
d3ee4ba3257107b81c2f2016020acf2008be2c34
-
SHA256
c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5
-
SHA512
2f692913d946b7f2dce0d0cda556b1832ffdda018b74fdd440e1c74df67f67080ad88904a0226f6cbd7c3c4cccf068ca89767120e14271e04c51f17feffff7ac
-
SSDEEP
6144:sD5frpxdonyq4zaG2u5AONeKfdTTmBiT1K+3FLrgquqp:sdrp0/9u5TeAHmsvgquqp
Malware Config
Extracted
Family
mystic
C2
http://5.42.92.211/loghub/master
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4396 set thread context of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88 -
Program crash 1 IoCs
pid pid_target Process procid_target 4256 4396 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4396 wrote to memory of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88 PID 4396 wrote to memory of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88 PID 4396 wrote to memory of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88 PID 4396 wrote to memory of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88 PID 4396 wrote to memory of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88 PID 4396 wrote to memory of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88 PID 4396 wrote to memory of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88 PID 4396 wrote to memory of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88 PID 4396 wrote to memory of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88 PID 4396 wrote to memory of 2036 4396 c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe"C:\Users\Admin\AppData\Local\Temp\c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 2762⤵
- Program crash
PID:4256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4396 -ip 43961⤵PID:4588