Edit tour

Windows Analysis Report
https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR

Overview

General Information

Sample URL:	https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8
Analysis ID:	1504854
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,694644445453319614,14567216347516798064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Foundserver: istio-envoydate: Thu, 05 Sep 2024 12:27:58 GMTcontent-type: application/jsoncontent-length: 22x-envoy-upstream-service-time: 0lingxi-traceid: 8f1fef1fc7794ab38dd83ff4^1697545526079^629492628connection: close

Source: chromecache_134.1.dr	String found in binary or memory: https://qiye.163.com/sirius/agreement_waimao/index.html
Source: chromecache_134.1.dr	String found in binary or memory: https://qiye.163.com/sirius/privacy_waimao/index.html
Source: chromecache_143.1.dr	String found in binary or memory: https://tailwindcss.com
Source: chromecache_134.1.dr	String found in binary or memory: https://waimao.office.163.com/site/favicon.png

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49754 version: TLS 1.2

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67

Source: global traffic	HTTP traffic detected: GET /product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /umi.7010d9a0.css HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F60f22baa467f46929f01a3235a483b39.jpg?Signature=DQFmgKkLa1tIDDS2JUuSjBamnHwWkrfKw9fDJYpgITQ%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F73ef338c52cb486198499dba9d6e03d5.jpg?Signature=cTMknHUTPYq9OkzjDJhilr26eAlUe%2F2VuEWyRFGKw1w%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/hot.643d43d1.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/alibaba.84fa3c8d.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/contact_bg.2c30255a.png HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/umi.7010d9a0.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F60f22baa467f46929f01a3235a483b39.jpg?Signature=DQFmgKkLa1tIDDS2JUuSjBamnHwWkrfKw9fDJYpgITQ%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F73ef338c52cb486198499dba9d6e03d5.jpg?Signature=cTMknHUTPYq9OkzjDJhilr26eAlUe%2F2VuEWyRFGKw1w%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/contact_bg.2c30255a.png HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/hot.643d43d1.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/alibaba.84fa3c8d.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /umi.1961b306.js HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /umi.1961b306.js HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/favicon.png HTTP/1.1Host: waimao.office.163.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mMYM3mwhbd+3lHM&MD=SKzWEg2y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /site/favicon.png HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=first HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=OPEN_PRODUCT_DETAILS&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/16/envelope/?sentry_key=c1c4787cd71a4b3eb8c70bc6f2e1b2e0&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.69.0 HTTP/1.1Host: sentry2.lx.netease.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mMYM3mwhbd+3lHM&MD=SKzWEg2y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: site.ntesmail.com
Source: global traffic	DNS traffic detected: DNS query: cowork-storage.nosdn.127.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: waimao.office.163.com
Source: global traffic	DNS traffic detected: DNS query: sentry2.lx.netease.com

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Windows Analysis Report
https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR