Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 04:53

General

  • Target

    f827393af55ca6cd1cd4749e5fd60222c792a2dc1854c6b495db4ac8f717708e.exe

  • Size

    358KB

  • MD5

    23ad65ffc82537118f17ecc75614911f

  • SHA1

    be946ba258ebf4f55eef2445d1d0b4960ceb3f07

  • SHA256

    f827393af55ca6cd1cd4749e5fd60222c792a2dc1854c6b495db4ac8f717708e

  • SHA512

    b29d54d7dbb76c1e21a1d0d4db26bfbc500a2acced604a418ba85b3f1028e78af1892649f4dd8e8d4e8678eb6f2bb0facada7b6cda9c8d2ae31ed659f31f9aa2

  • SSDEEP

    6144:B/kXR/bOEHHkwxOSeyCKrJz4AO6gnTf87x8W2+pm68fi:VkX1aEHEw94Ar7x6S8fi

Score
10/10

Malware Config

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f827393af55ca6cd1cd4749e5fd60222c792a2dc1854c6b495db4ac8f717708e.exe
    "C:\Users\Admin\AppData\Local\Temp\f827393af55ca6cd1cd4749e5fd60222c792a2dc1854c6b495db4ac8f717708e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:3728
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        2⤵
          PID:4216
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          2⤵
            PID:112

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/112-0-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/112-1-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/112-2-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/112-3-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/112-4-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB