Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
13/11/2023, 09:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11zL5692.exe
Resource
win7-20231025-en
5 signatures
300 seconds
General
-
Target
11zL5692.exe
-
Size
276KB
-
MD5
6388d171313b848164f405dc3f7f79cd
-
SHA1
27eaddb12dea3065f72c2e6f146b24550cb3d986
-
SHA256
627bdf7a9650d45175723c9dd313ce63df6be286018d4e3f746c6ee42bad7e45
-
SHA512
6961e784720875763ec57c8d75cf57f9cc35a6f2a7ce64873c2546ea63a9197f4c1aac4e7cf68af5b0e4e2193c27a56109885741cba60a90b1c2b1aef8c92375
-
SSDEEP
6144:2KWeIhzyZNGuHPqKLQGD5N15kBL28+5lJSenN+UKH:2KWewyh7LFpkxNGvK
Malware Config
Signatures
-
Detect Mystic stealer payload 6 IoCs
resource yara_rule behavioral1/memory/1016-7-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/1016-11-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/1016-9-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/1016-5-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/1016-4-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/1016-3-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1976 set thread context of 1016 1976 11zL5692.exe 21 -
Program crash 1 IoCs
pid pid_target Process procid_target 1700 1016 WerFault.exe 21 -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1976 wrote to memory of 1016 1976 11zL5692.exe 21 PID 1016 wrote to memory of 1700 1016 AppLaunch.exe 30 PID 1016 wrote to memory of 1700 1016 AppLaunch.exe 30 PID 1016 wrote to memory of 1700 1016 AppLaunch.exe 30 PID 1016 wrote to memory of 1700 1016 AppLaunch.exe 30 PID 1016 wrote to memory of 1700 1016 AppLaunch.exe 30 PID 1016 wrote to memory of 1700 1016 AppLaunch.exe 30 PID 1016 wrote to memory of 1700 1016 AppLaunch.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\11zL5692.exe"C:\Users\Admin\AppData\Local\Temp\11zL5692.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 1963⤵
- Program crash
PID:1700
-
-