Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 18:48

General

  • Target

    file.exe

  • Size

    371KB

  • MD5

    6dd0cddbeeb79ae27641ef92e05fee83

  • SHA1

    76e4f4fdd1cb1e1849f7c2cb28cdc6c7d2494ccb

  • SHA256

    242d7eb297977345bf579aa734947f851e21a7c4547f078e81c0606a297df502

  • SHA512

    db90bfd2a2c8488e9a9ab9272260f994fd21f818a985dfc744aea9be2eb6f8c412fbfbe5b7500b20d92629b8232e927181f272506b4367298d35e2b0194d3191

  • SSDEEP

    6144:lRvJm09zORs+z/TMify9DAO3gQJ/dBM5qqdKvMgAT7tn165R8/:lxw09CK5Nu0BMnAMtTp1QR8/

Score
10/10

Malware Config

Signatures

  • Detect Mystic stealer payload 5 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:4468

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4468-0-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4468-1-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4468-2-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4468-3-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4468-4-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB