Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
30bbde9df88...20.exe
windows10-2004-x64
1014381f89f8...62.exe
windows10-2004-x64
101c09c6faad...a0.exe
windows7-x64
31c09c6faad...a0.exe
windows10-2004-x64
101c8308039a...16.exe
windows7-x64
31c8308039a...16.exe
windows10-2004-x64
101fe4c883d2...6d.exe
windows10-2004-x64
10234b8aa959...d8.exe
windows10-2004-x64
10410e72302d...e8.exe
windows7-x64
3410e72302d...e8.exe
windows10-2004-x64
104431aa7413...8c.exe
windows7-x64
34431aa7413...8c.exe
windows10-2004-x64
1068f997d58c...e5.exe
windows10-2004-x64
10812ce70322...27.exe
windows10-2004-x64
1088a3f8285d...ab.exe
windows10-2004-x64
1090fdeaf3f0...a8.exe
windows7-x64
390fdeaf3f0...a8.exe
windows10-2004-x64
109d92aedf9d...9d.exe
windows7-x64
39d92aedf9d...9d.exe
windows10-2004-x64
109ff2fb6bb8...32.exe
windows10-2004-x64
10ac4e2e3d9d...dd.exe
windows7-x64
3ac4e2e3d9d...dd.exe
windows10-2004-x64
10b62483116d...b6.exe
windows10-2004-x64
10c901122f00...70.exe
windows10-2004-x64
10cfda8adb75...7f.exe
windows10-2004-x64
10dfe8591c80...49.exe
windows10-2004-x64
10f5659ff4e2...ff.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
0bbde9df8818bd31a5563ee46a1512cc0d05c5d11e8469ef5c7ec394bb8ed020.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
14381f89f8b411cd75bc72635e73d8b296854b0c9775f80c2fec874a6761d562.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
1c09c6faad1ede18216df88b9d359543df5caacf810175b5e245e3e775b6b9a0.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
1c09c6faad1ede18216df88b9d359543df5caacf810175b5e245e3e775b6b9a0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
1c8308039aad5dc9c98b1f72592672a2e272eb9b9a30430eeacea161036df416.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
1c8308039aad5dc9c98b1f72592672a2e272eb9b9a30430eeacea161036df416.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
234b8aa95903dd65d6bf32c7efe25bae41ba8582db1a5693afbd14a22bc6d4d8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
4431aa7413f5833360f953b5d26f7cceefeb1dfd20705856a7c02d106943048c.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
4431aa7413f5833360f953b5d26f7cceefeb1dfd20705856a7c02d106943048c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
68f997d58c29b69df287c5fd2f99eed5b4f71419dba25fbff2ad5132610109e5.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
812ce70322ec6814a763ebe1e04731ab416e10201580d509b133509ad1ebcb27.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
88a3f8285d7ffaf9af9229ede24a8f6e39be8a28dd9c981808b05c11aece8bab.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
90fdeaf3f05a7aeef335002874bfb485026c1a161854698d5277269287138ba8.exe
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
90fdeaf3f05a7aeef335002874bfb485026c1a161854698d5277269287138ba8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
9d92aedf9d3d83efd8e1d100f6dcbfc358fb8b26adeb6e51769c0e756d95b09d.exe
Resource
win7-20240419-en
Behavioral task
behavioral19
Sample
9d92aedf9d3d83efd8e1d100f6dcbfc358fb8b26adeb6e51769c0e756d95b09d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
9ff2fb6bb8d4c7395ec24382b3b06db1e89b1ac0e5ceaebaba03805cbaa21532.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
ac4e2e3d9de1b4a0639391f365147200e1175cbe0c399b62625a5fe2ff4acedd.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
ac4e2e3d9de1b4a0639391f365147200e1175cbe0c399b62625a5fe2ff4acedd.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
b62483116d18fcce423634c2d593e9a4337f6e491ba99627ad7d7030d97546b6.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral24
Sample
c901122f0065d9da89857ec8341cf2ffba9fd5fd9ac4717e138a6b96c776b070.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral26
Sample
dfe8591c80d0895e6a0ba6ab5324840b06b4acfdc0570bbc6eea97239314ef49.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
f5659ff4e2e2c4f553f6a9f59f406907a29545e4ca9d61810be718d9619a8dff.exe
Resource
win10v2004-20240226-en
General
-
Target
1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe
-
Size
657KB
-
MD5
e5378c7aa769f854c35881601795a469
-
SHA1
432909c18905de39981e27c964001c5b4a6cffdf
-
SHA256
1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d
-
SHA512
b7139f53ba8edd52293f4c6c0bf8920a67cbe9ab0288d7d651c44174a91d6a303966690471790e1db8a392540fa6b17a63533355ed7ebf7c48252632638d4019
-
SSDEEP
12288:JMr4y90+oZ51RZwEqDEd5lrMeAj5RWQRYJ7w6orKSKLzaRUT:Ryy5bnqYdrMH7WQj6on2aRUT
Malware Config
Signatures
-
Detect Mystic stealer payload 3 IoCs
resource yara_rule behavioral7/memory/2328-18-0x0000000000400000-0x0000000000434000-memory.dmp mystic_family behavioral7/memory/2328-19-0x0000000000400000-0x0000000000434000-memory.dmp mystic_family behavioral7/memory/2328-21-0x0000000000400000-0x0000000000434000-memory.dmp mystic_family -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 4 IoCs
pid Process 4372 ms6Zu56.exe 4944 1LJ98sP4.exe 536 2fC2723.exe 1852 3MR16TH.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ms6Zu56.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4944 set thread context of 4880 4944 1LJ98sP4.exe 85 PID 536 set thread context of 2328 536 2fC2723.exe 90 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3MR16TH.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3MR16TH.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3MR16TH.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4880 AppLaunch.exe 4880 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4880 AppLaunch.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 64 wrote to memory of 4372 64 1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe 83 PID 64 wrote to memory of 4372 64 1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe 83 PID 64 wrote to memory of 4372 64 1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe 83 PID 4372 wrote to memory of 4944 4372 ms6Zu56.exe 84 PID 4372 wrote to memory of 4944 4372 ms6Zu56.exe 84 PID 4372 wrote to memory of 4944 4372 ms6Zu56.exe 84 PID 4944 wrote to memory of 4880 4944 1LJ98sP4.exe 85 PID 4944 wrote to memory of 4880 4944 1LJ98sP4.exe 85 PID 4944 wrote to memory of 4880 4944 1LJ98sP4.exe 85 PID 4944 wrote to memory of 4880 4944 1LJ98sP4.exe 85 PID 4944 wrote to memory of 4880 4944 1LJ98sP4.exe 85 PID 4944 wrote to memory of 4880 4944 1LJ98sP4.exe 85 PID 4944 wrote to memory of 4880 4944 1LJ98sP4.exe 85 PID 4944 wrote to memory of 4880 4944 1LJ98sP4.exe 85 PID 4372 wrote to memory of 536 4372 ms6Zu56.exe 86 PID 4372 wrote to memory of 536 4372 ms6Zu56.exe 86 PID 4372 wrote to memory of 536 4372 ms6Zu56.exe 86 PID 536 wrote to memory of 2328 536 2fC2723.exe 90 PID 536 wrote to memory of 2328 536 2fC2723.exe 90 PID 536 wrote to memory of 2328 536 2fC2723.exe 90 PID 536 wrote to memory of 2328 536 2fC2723.exe 90 PID 536 wrote to memory of 2328 536 2fC2723.exe 90 PID 536 wrote to memory of 2328 536 2fC2723.exe 90 PID 536 wrote to memory of 2328 536 2fC2723.exe 90 PID 536 wrote to memory of 2328 536 2fC2723.exe 90 PID 536 wrote to memory of 2328 536 2fC2723.exe 90 PID 536 wrote to memory of 2328 536 2fC2723.exe 90 PID 64 wrote to memory of 1852 64 1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe 91 PID 64 wrote to memory of 1852 64 1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe 91 PID 64 wrote to memory of 1852 64 1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe"C:\Users\Admin\AppData\Local\Temp\1fe4c883d2d7c8f09c5eab45d00c85339660191140f68cf11bd29f978582386d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ms6Zu56.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ms6Zu56.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1LJ98sP4.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1LJ98sP4.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2fC2723.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2fC2723.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:2328
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3MR16TH.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3MR16TH.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1852
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD55ff1b48b7c4fedd441832e662b193294
SHA1cd5e5b1dea51f156a85602a285cb7b6f3e7b9a01
SHA25660bf0a75a0e646afd2c00cfddfe0669fe2abab1bce4c54f64eebf390fefee6bb
SHA51276335507cf748defdbf2cb33e10988bdb2cbb99ff37b369ac0a2670f6aeae3ac298338ced9a3fce5aec9f5634f3449e134201d5282cd6a81bd3852e0e0f475b6
-
Filesize
533KB
MD5fa6002a4f70722651e6d5efa859bebc8
SHA17c058ce7d310eed4e586096ef34bc073a5c23326
SHA2563d2e5e93724c91f2a46f9b850a2e078b1148b35c2a6197b27a2b64a7c09efc58
SHA51260e0165abe7f25d8fea036214f893fa98b018d62901b3d756b30fd6a212ab2b77b53b87418238c95d6ae37bf202155229baaf5353cbf461882abbd84ea211420
-
Filesize
886KB
MD54c17b3e7891cc0dc445b98bad579b862
SHA11de1ed5f59adc00d54f7c814c3bcd0bb261bc6a1
SHA256a01380704805f5b177b41a649ed781b170c9ce6c373bba2b15f4a19249966655
SHA512ddc9b44d0e32fd382dd3c3418a9c077b3b7ebf41502bf5e072fc4f4d5708cb098362cc8832919c07ad50c5422d78fa7917b2715a3d065c5d231683911d29be7d
-
Filesize
1.1MB
MD59166cc8f3a785f3656868acc335f08e4
SHA1b364d709678ca87e8a2073dc0e92305ce8ba7f06
SHA256ae866155e9d507d7aade0f698005dd0e9531bd650a005b6ad0d9b51889e12a2e
SHA512d73c74dc2dd6754973ab5634cdaa8094ac88a78cf74a6512a6fb77ef97bc07e790cd83fea113f53acf7288409f297042e649ce5758b5bce2aeba2bbf65ae567e