Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 04:47
Static task
static1
Behavioral task
behavioral1
Sample
eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe
Resource
win7-20230831-en
4 signatures
150 seconds
General
-
Target
eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe
-
Size
700KB
-
MD5
d02b17eb49530ae5d5c0382033d4e7fc
-
SHA1
3f4e8983c9aa9b94f6cb36d2cc4ac4037a61d0eb
-
SHA256
eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3
-
SHA512
6ffdcab58dc049b20fd6949000696409cf67054baa92428ed763992b0bf64505a029fb986b96141c448cca71e3507b36f27cc8d09f31c69631c49a5946fae04a
-
SSDEEP
6144:P6vGALXgBEIy8wluzNcq/PVucQpsc5F6hFkHQQYvmhYG0FWGrKvfr:iHXgFysVucQpsmFJzYG0For
Malware Config
Extracted
Family
mystic
C2
http://5.42.92.211/loghub/master
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2252 set thread context of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 2896 2252 WerFault.exe 23 -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2648 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 28 PID 2252 wrote to memory of 2896 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 29 PID 2252 wrote to memory of 2896 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 29 PID 2252 wrote to memory of 2896 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 29 PID 2252 wrote to memory of 2896 2252 eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe"C:\Users\Admin\AppData\Local\Temp\eaf619dd91b9e35cf1c4b72e4a2e83433ca887cbe9978f5da0f0dd47cfa731c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 922⤵
- Program crash
PID:2896
-