Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 12:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe
-
Size
365KB
-
MD5
0650de5edc2b3a6df1122382d092db57
-
SHA1
d1555178026bd4fc174c8c7ec470ccc842d5edff
-
SHA256
7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c
-
SHA512
3e786019d138c302a915217e309ff1923bbb6c1e180f032624101f27f8d84031fd856b3e2d1d23b9c9bb907e3ba76c7147ec8c62d03e3a8a53a55955dfe7eb6d
-
SSDEEP
6144:nXzjEw2jicP5iOo2T8VrSd/sUAOlUl1moDD77rNfD19mJnprR9guV1Sa:nXzZqiG59ou3UXmoDD775fjmjFauV1Sa
Malware Config
Signatures
-
Detect Mystic stealer payload 6 IoCs
resource yara_rule behavioral1/memory/1932-7-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/1932-5-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/1932-4-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/1932-3-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/1932-9-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/1932-11-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2132 set thread context of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 -
Program crash 1 IoCs
pid pid_target Process procid_target 2292 1932 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 2132 wrote to memory of 1932 2132 7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe 29 PID 1932 wrote to memory of 2292 1932 AppLaunch.exe 30 PID 1932 wrote to memory of 2292 1932 AppLaunch.exe 30 PID 1932 wrote to memory of 2292 1932 AppLaunch.exe 30 PID 1932 wrote to memory of 2292 1932 AppLaunch.exe 30 PID 1932 wrote to memory of 2292 1932 AppLaunch.exe 30 PID 1932 wrote to memory of 2292 1932 AppLaunch.exe 30 PID 1932 wrote to memory of 2292 1932 AppLaunch.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe"C:\Users\Admin\AppData\Local\Temp\7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 1963⤵
- Program crash
PID:2292
-
-