Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2023, 20:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://energyplugcorp.com/
Resource
win10v2004-20231020-en
General
-
Target
https://energyplugcorp.com/
Malware Config
Signatures
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 31 ipinfo.io 32 api.ipify.org 28 api.ipify.org 30 ipinfo.io -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2948 msedge.exe 2948 msedge.exe 4548 msedge.exe 4548 msedge.exe 1608 identity_helper.exe 1608 identity_helper.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4548 wrote to memory of 1396 4548 msedge.exe 85 PID 4548 wrote to memory of 1396 4548 msedge.exe 85 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 3680 4548 msedge.exe 86 PID 4548 wrote to memory of 2948 4548 msedge.exe 87 PID 4548 wrote to memory of 2948 4548 msedge.exe 87 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88 PID 4548 wrote to memory of 2120 4548 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://energyplugcorp.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9461a46f8,0x7ff9461a4708,0x7ff9461a47182⤵PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:2900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:12⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:12⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,5249808709325739809,14436148232121996747,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5504 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2804
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2780
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56dded92ec95cf9f22410bdeac841a00d
SHA183c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA2561840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD595c54b181c98b6e1fe0164172b0f7eaf
SHA1cafd5bfc050868fb3c6eedfc55d8e3657a3d39fd
SHA256f8d8da3740d9046480ae89bb7b371e79bbf48be0df85509fdf66248b6337807d
SHA5128dc6ae7dacb7f02bb622f0da014e3f75e1241cb44dc40fee35dcfb6c575f3f015da185e82f0ebc0ca51e03f953cc465309b13e6cb0713f57630f571053185da0
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
936B
MD56a9ca971916f06579f06ca600ca71ea3
SHA15bfeb74254467b36ed3e0f85ec494cb15d08cf22
SHA256cea1f7d59d90b562a1bfa5c80cdec9b67eeecccd3a63ac2116cbb60449d41b76
SHA5120aecba44586d3c5f3fcfea21a9ce6fdaade7be25529c6943eef4efd58721bf9ee6fdbef0bc4889ae3368ac5c7216430101adf51c54f1907e933ebbd23545cc42
-
Filesize
5KB
MD51986d873834cf096436f988f1d1f8f9d
SHA158d2a592a12dc5300b0ed7afd3446ff4c1a67d45
SHA256828a5c5532c199b9e77499e24b5be5b02d0853e6c8b16ace7d5315185f9b63ce
SHA51231439acd61d3296fd9d50b23b00f7eab7c14a85cbe5a8096164dd4f8b342925c1244526f14ce64ebf14721a2c7bb530dd3d2dabeb655ab16a52fcc1dc7487957
-
Filesize
5KB
MD5a9aeac4d4fc1ebfe171e3963d7397df4
SHA191aa1f7e93e4f6c6d92ced474bb49251350a0664
SHA25608c067f1f1c657669920c2e9260eeb0cb239d56cbcc9e153809a6db53ae17e65
SHA51269c158829d1715297e42b157b40d73038145c48fb383d7eccf87d2e100eaca077434d24326ad84f95ab2177cc3dac8ae46ba7c31f3df89dd46531598391abeb8
-
Filesize
24KB
MD5e05436aebb117e9919978ca32bbcefd9
SHA197b2af055317952ce42308ea69b82301320eb962
SHA256cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f
SHA51211328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD503cf9276560d00ba73d9a8d11716284a
SHA1067a07ddb10100a1c875303f3dd6b0138e65bb3f
SHA2567b9756fa4039b1089c7ba4987cd6ed0f44a925632aaa99c7df4a7c51e49dbe77
SHA512eefa29ebad11fa3f8b44e671c07b8b151c3b5be1b0bbaa928eec1f9cac585086df0ed3d8caa392ff29aa4a05cc4f7f11dfb58a3116ea6805c299f4d07a9ad695
-
Filesize
10KB
MD5b344bb819f3ba7dcaf49d43c6a848dcd
SHA1f4b2891cf4c2ba1cb64f00610277c0ba319ddf5d
SHA2569749624fb705e5647c8b395b547ec6795e001fb506ec1a8db86af984ccbb2e32
SHA51215f05a9d3b32be0f05435924724b0e347071972710c66b6c8557c5aab960d713c5e701cb994b07e85e015750987f9c7c2882278e97071e979f41fb22278ad456