Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2023, 17:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.vibeaccount.com/profile/confirmEmailAddress.do?code=ECpmanBLXqVw6FZjLa08tE1bD268496945
Resource
win10v2004-20230703-en
General
-
Target
https://www.vibeaccount.com/profile/confirmEmailAddress.do?code=ECpmanBLXqVw6FZjLa08tE1bD268496945
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1408 msedge.exe 1408 msedge.exe 1584 msedge.exe 1584 msedge.exe 4516 identity_helper.exe 4516 identity_helper.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 3660 1584 msedge.exe 80 PID 1584 wrote to memory of 3660 1584 msedge.exe 80 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1956 1584 msedge.exe 82 PID 1584 wrote to memory of 1408 1584 msedge.exe 81 PID 1584 wrote to memory of 1408 1584 msedge.exe 81 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83 PID 1584 wrote to memory of 4868 1584 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.vibeaccount.com/profile/confirmEmailAddress.do?code=ECpmanBLXqVw6FZjLa08tE1bD2684969451⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff03df46f8,0x7fff03df4708,0x7fff03df47182⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:82⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:3700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:12⤵PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1860
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2148
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4028
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b950ebe404eda736e529f1b0a975e8db
SHA14d2c020f1aa70e2bcb666a2dd144d1f3588430b8
SHA256bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4
SHA5126ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize528B
MD5b7ff0dde3da79ffbe0104b38c030a29d
SHA1dd1c692d9d2f4404250552c27d4806e460742108
SHA25647295f41dd863d7e1a935b15f1bb22903625677b13b73600a99bcc75fe56a8b2
SHA512ad2809e310dca882ed9829e73e4cf192f3ffd977914384ee8f1a1de8fe95d0deeed27f31e85b9eeb0d2bd2788d563740bb6cd302775bf8ee67ded737aa8c553c
-
Filesize
1KB
MD5fb01562907849fd8abcdde9484b8fea4
SHA13077f8fa00c415990481c7e4863d22e5b6463ef7
SHA2563354399b103b3c63d9d1a7a1f81f964d12e1f09cb3c9c554731ea718e452a815
SHA5120df7c20ec01576fe7c78abad07fec0bb6f19fdaeae3a11ab6f1f7e682110e7d23f24bc4f9c87bb554df84a0785cfb9500c306905c6cae83f35513ad640bee422
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5583652e9b772d23789fb48d56c27c1e5
SHA1aa6086340f4853b7841687f86745468ddb3bb85f
SHA256fc6c1910f891d0ebf1555dc551b95ec9bea6c44c7d3152820c42657269bdfb36
SHA51247897e679dfcd5de9dfb53b5f14c2335a3bf01f7559236646a81ea1be6ebd7ed64277690ab22e18f92f96af4725b10926664a86810f01856458ac2528e17b4f6
-
Filesize
6KB
MD5f9a3f75be3278f6b3a8ef707584a7d76
SHA1a25b4dcf59c1bbf15dd6403a7e851316c37f6882
SHA2568526ecc3a2057e93b69ec28218e455ac4f2493b212dc79c85fe71dd4e3e56289
SHA51263a85fd21644bb94a11a49f3880d75eef00d463e78cab89230350d0db1321e1f8805416d641d9764b23568b0970e11baa6ba3f5e30d8057ba7e51d29027d533a
-
Filesize
24KB
MD5ca36933e6dea7aa507a272121b34fdbb
SHA13b4741ca0308b345de5ecf6c3565b1dbacb0fb86
SHA256fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d
SHA5125a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e
-
Filesize
1KB
MD5d24b1264549ae1286561bb15a8eb3bf7
SHA18917f299c419516aed986e1479901560213548a6
SHA25686274dc9718531d5c8d9b8442e1ce57342cc9e7360365028cac140418aae2446
SHA512635874ed1e5c6967c61d32d62053ae99f59fe6f75ff2487ac50b39a47a50a159014bf1442f1fdf270cd99b068fdd33b92eceea3375c40b41dbe397148af5101a
-
Filesize
1KB
MD5a1632682410691531ede8dd2eec4d83f
SHA1549e34912272ffcea4044ed427536f93e48d7e76
SHA256129ee0eaccfe01ab88f79730d4d6dba130b9e93b79668a6ab47dbdd8f7a1b75d
SHA5126211c65e91fc812f2cecd1c4a4654730a0d509892d032034a85fa82e826c2fd3e71d13a28322d544719eca5581ecf1200083e9ac5583ede0b286c5f994c1ff70
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD5b5442028a4ea011b306fc7dde3786141
SHA17fcecbe790af06504c11e858b4e9edc1b081066d
SHA256916c9595c8713173af6d26925acc02a73f9d72df4aee0f8ea5f13fb540a57e45
SHA512f399c1bd54e4c1130d7ed44bd5b8fd9d1ffe457c389a3858a4307aa8b0c4e34858ce6b0be0f58414ba0f4453dc36a5e49c0715d7c4a668448d79d614deef3e5c