Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3parsec-windows.exe
windows7-x64
8parsec-windows.exe
windows10-2004-x64
3$PLUGINSDI...ID.dll
windows7-x64
3$PLUGINSDI...ID.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3parsecd.exe
windows7-x64
1parsecd.exe
windows10-2004-x64
1pservice.exe
windows7-x64
1pservice.exe
windows10-2004-x64
1skel/parse...3b.dll
windows7-x64
1skel/parse...3b.dll
windows10-2004-x64
1teams.exe
windows7-x64
1teams.exe
windows10-2004-x64
1vusb/parsec-vud.exe
windows7-x64
3vusb/parsec-vud.exe
windows10-2004-x64
3wscripts/f...dd.vbs
windows7-x64
1wscripts/f...dd.vbs
windows10-2004-x64
1wscripts/f...ve.vbs
windows7-x64
8wscripts/f...ve.vbs
windows10-2004-x64
8wscripts/l...up.vbs
windows7-x64
3wscripts/l...up.vbs
windows10-2004-x64
7wscripts/s...ll.vbs
windows7-x64
8wscripts/s...ll.vbs
windows10-2004-x64
8wscripts/s...ec.vbs
windows7-x64
4wscripts/s...ec.vbs
windows10-2004-x64
7wscripts/s...ve.vbs
windows7-x64
8wscripts/s...ve.vbs
windows10-2004-x64
8Analysis
-
max time kernel
126s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 04:39
Static task
static1
Behavioral task
behavioral1
Sample
parsec-windows.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
parsec-windows.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
parsecd.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
parsecd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
pservice.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
pservice.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
skel/parsecd-150-93b.dll
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
skel/parsecd-150-93b.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
teams.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
teams.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
vusb/parsec-vud.exe
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
vusb/parsec-vud.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
wscripts/firewall-add.vbs
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
wscripts/firewall-add.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
wscripts/firewall-remove.vbs
Resource
win7-20240419-en
Behavioral task
behavioral24
Sample
wscripts/firewall-remove.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
wscripts/legacy-cleanup.vbs
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
wscripts/legacy-cleanup.vbs
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
wscripts/service-install.vbs
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
wscripts/service-install.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
wscripts/service-kill-parsec.vbs
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
wscripts/service-kill-parsec.vbs
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
wscripts/service-remove.vbs
Resource
win7-20240221-en
General
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
6c3f8c94d0727894d706940a8a980543
-
SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd
-
SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
-
SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
-
SSDEEP
96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2500 1816 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2456 wrote to memory of 1816 2456 rundll32.exe 89 PID 2456 wrote to memory of 1816 2456 rundll32.exe 89 PID 2456 wrote to memory of 1816 2456 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#12⤵PID:1816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 6363⤵
- Program crash
PID:2500
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1816 -ip 18161⤵PID:3204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1392,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:81⤵PID:3980