Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 05:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://lx-pluto-mail.qiye.163.com/api/pub/edm/read?sign=HgNhSTnsKUUaE3r%2Fkc9gbNPIQ2LyIsIyAomW43qATWKvFxkKN%2BgL7lg0i84jv1auv5tQQK1V23zD%0AZ4skpYr5gwGuVM04C%2FYY5AyxFpmN7tQ%3D
Resource
win10v2004-20240704-en
General
-
Target
https://lx-pluto-mail.qiye.163.com/api/pub/edm/read?sign=HgNhSTnsKUUaE3r%2Fkc9gbNPIQ2LyIsIyAomW43qATWKvFxkKN%2BgL7lg0i84jv1auv5tQQK1V23zD%0AZ4skpYr5gwGuVM04C%2FYY5AyxFpmN7tQ%3D
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3916 msedge.exe 3916 msedge.exe 4488 msedge.exe 4488 msedge.exe 4912 identity_helper.exe 4912 identity_helper.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4488 wrote to memory of 3808 4488 msedge.exe 84 PID 4488 wrote to memory of 3808 4488 msedge.exe 84 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 2272 4488 msedge.exe 85 PID 4488 wrote to memory of 3916 4488 msedge.exe 86 PID 4488 wrote to memory of 3916 4488 msedge.exe 86 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87 PID 4488 wrote to memory of 1928 4488 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lx-pluto-mail.qiye.163.com/api/pub/edm/read?sign=HgNhSTnsKUUaE3r%2Fkc9gbNPIQ2LyIsIyAomW43qATWKvFxkKN%2BgL7lg0i84jv1auv5tQQK1V23zD%0AZ4skpYr5gwGuVM04C%2FYY5AyxFpmN7tQ%3D1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa903346f8,0x7ffa90334708,0x7ffa903347182⤵PID:3808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:2272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:82⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15586241835421192954,4137145721695569575,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5236 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4460
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3636
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e81c757cdb64c4fd5c91e6ade1a16308
SHA119dc7ff5e8551a2b08874131d962b697bb84ad9b
SHA25682141d451d07bdb68991f33c59129214dd6d3d10158aeb7a1dc81efbc5fb12b3
SHA512ba8de0b3b04fec5a96d361459dde0941b1b70f5be231fdec94806efa3ecf1e8faf8e27b1800fa606dc4a82e29d4cf5109b94109e5ad242ddf9f4671e2acbcfbd
-
Filesize
152B
MD52e57ec8bd99545e47a55d581964d0549
SHA1bd7055ea7df7696298a94dedfc91136e3b530db8
SHA256a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c
SHA5126b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5cf6a056865bbbd332d927f664623e59e
SHA1db45fbf61411fcbefa2de8298329d87add549b51
SHA2565ea4f8b31adfa6671d44d4ed6f0475129e71e922f3d2f0ed707322a74ffdf295
SHA512dad44e42cb41ba67c0c8d1a0cf586e309c94bb04681e9a2e3f4073af139c3475f16bde76e9529251e00aa8e7d301727cbe94aa9b4657c708d248adc60a0b2fc5
-
Filesize
6KB
MD50dc870fad1fee01d14fb420cc4d2a278
SHA1541e66675283c588654410f93c9601023854ea5f
SHA256bc4de4456a9e9e2d3dfd203c054c3e8adba3f7f5f8c1f7e02aec6d108ba7d2cb
SHA512dcab7ddcf2923c6465751366e3eaa4a7d0faf525e4076f500af30b529dc08b03af1a76b648cec3ae690647d282528a3d3c8743a98d198af923868bfe9c5667d3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD58354cfe47971b3a573599bcf98eb4d07
SHA16a3ceb088f1730a45f80f5ab21ffd951834f37cf
SHA256e57597172ef2d01defd3ece315be328dcd3dfa2de426c1ff6a62504da5fa5457
SHA51202dbe1c6ec889e37a7c177bf8eae90514ea867845f43a3ec9a172f162ab7a247236a2fe1b710c07511d70500b0a168f748f5b37b328beff9e51cadf35cd651cd