Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    128s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2023, 21:14

General

  • Target

    http://www.instagram.com/ajax/bz?__a=1&__ccg=UNKNOWN&__comet_req=7&__d=www&__hs=19677.HYP%3Ainstagram_web_pkg.2.1..0.1&__hsi=7302166803930401388&__req=hc&__rev=1009950565&__s=%3An9fzju%3A99r6qz&__spin_b=trunk&__spin_r=1009950565&__spin_t=1700168197&__user=0&dpr=1&fb_dtsg=NAcP80hg-wK3aHstgHJ8rfbRNEIrpU4wtt3UI5Pn-vESt0NT_7VzllQ%3A17864789131057511%3A1670267261&jazoest=26230&lsd=aVPWk9CRgfwK2r-Etc-66-&ph=C3

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.instagram.com/ajax/bz?__a=1&__ccg=UNKNOWN&__comet_req=7&__d=www&__hs=19677.HYP%3Ainstagram_web_pkg.2.1..0.1&__hsi=7302166803930401388&__req=hc&__rev=1009950565&__s=%3An9fzju%3A99r6qz&__spin_b=trunk&__spin_r=1009950565&__spin_t=1700168197&__user=0&dpr=1&fb_dtsg=NAcP80hg-wK3aHstgHJ8rfbRNEIrpU4wtt3UI5Pn-vESt0NT_7VzllQ%3A17864789131057511%3A1670267261&jazoest=26230&lsd=aVPWk9CRgfwK2r-Etc-66-&ph=C3
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3780
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd00d046f8,0x7ffd00d04708,0x7ffd00d04718
      2⤵
        PID:3480
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        2⤵
          PID:1568
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4752
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
          2⤵
            PID:4132
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
            2⤵
              PID:4456
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
              2⤵
                PID:1484
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
                2⤵
                  PID:3724
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                  2⤵
                    PID:4648
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
                    2⤵
                      PID:4416
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
                      2⤵
                        PID:2644
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
                        2⤵
                          PID:2664
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
                          2⤵
                            PID:3492
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4396
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,1835275549685890075,4223076795995173099,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:876
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1280
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4316

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              f4787679d96bf7263d9a34ce31dea7e4

                              SHA1

                              ebbade52b0a07d888ae0221ad89081902e6e7f1b

                              SHA256

                              bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

                              SHA512

                              de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              111B

                              MD5

                              285252a2f6327d41eab203dc2f402c67

                              SHA1

                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                              SHA256

                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                              SHA512

                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              185B

                              MD5

                              203d1c13ff76c08804f4a026fe6f5d0f

                              SHA1

                              0cf3850ea2c18eb712fcafbdc755e49b7f2f0003

                              SHA256

                              f241dc01d6ca5c5f8106c6dc8842dfa7595ae44aa399767eadc6608e3db8de3c

                              SHA512

                              f1c61bc8a56edec9cc214d9ef2e99a7852c7177252a1213327b4ca3a512afac6320093d370352fcf600acc3d74a3025e6189f582b84eafe0b184b694e7ca047f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              9501bce7cff973a633f66314a6cbca88

                              SHA1

                              e0355c421981f154ad70205b8141a176130e6488

                              SHA256

                              b2aad30701b597a2547ffb0886bc88368dfceb521289e519c465e9f62ca41d7e

                              SHA512

                              27fe91f978f425f73ab3955a407efd59a9b03227dadd06755b8f04c23bda0fae98a4ce5249c7bdfb64144bdfb06af395e45190c812b195f7f8790776f8cfd75f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              b71387ce74e96a967f472267af653050

                              SHA1

                              b585953fbfb9d03237dab230973ddfbfa23fbf4a

                              SHA256

                              fad416fae35f0b1e32d2b556ffde83f7fb2292cd7bdcc227ff443bda9e0f85b3

                              SHA512

                              8b5ada5dca574b76952bad7ec1cb5bd9b1e39e7f2bfdb6a084afbd2a26342c791478e116039bc43e839a1e31fb6079809c7a152d3b84c514908595f260e43594

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              a2633f4d35b0be1ea07deb4350d70afe

                              SHA1

                              b3f294fd24c0881da8441e541e58da1ece03b331

                              SHA256

                              0c8e62bf0354d772407d6aae6459eb691abc01fb7b4bd90a04999e7534514efd

                              SHA512

                              85f8471b74b24dfd2f05e7e17dd79fce1049441204bf90e6da5a272dbde8b2dbc1e74c5c737eb83f913e7227969b3cd219b5176a598fd5f8c45421473f47b34a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              7501f6b6404854e399eb4651ce5f5065

                              SHA1

                              9b1ed013f0e86ed5a608a10aadd841c5fa314793

                              SHA256

                              afd8d9502f2351045e21e947d6a973dc304cc76d611cb656b9edba0772cffa30

                              SHA512

                              f94f1af1d6f221da27f30f78cd6d7e911eb69084bd76ba2569d36fca9dad1c179d38c9ebec90de5a4d4360ebaaec5bec6e419a495a14186d6743991a916579c7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                              Filesize

                              24KB

                              MD5

                              3a748249c8b0e04e77ad0d6723e564ff

                              SHA1

                              5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

                              SHA256

                              f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

                              SHA512

                              53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              204B

                              MD5

                              41dcd55f95c8a770c893905775f82459

                              SHA1

                              5adc038243c0bee98f1ee102e0f499e7480102b9

                              SHA256

                              468c160d45e49f338f9c60b6f6f00c34774fbf91b8927271599b1966a3cbfe77

                              SHA512

                              f612f27d25a0a242554083b931090527c615f08e32be4f224cbafa41df49008c8533b86a0d6ddbbdaf073a462bde88221ef5ed3342e36ba99cc3257ea78f1342

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              204B

                              MD5

                              1697d24576820f1b1341e30e3a40adfa

                              SHA1

                              33d720c5e04f63b35923176f0b1e351b2d5c1936

                              SHA256

                              271beb3390e8b4b50d9eec361f68388459e6958ef58d0f636ef7dfd8d10bdaae

                              SHA512

                              ab5fcb1da8f4218032a62e92cc4dfdd13f6ec32e351c776bfebf85bc566cc99c1823547103f223d78fdc4f0d57a53892aa5f882bd6abcbc6d16a13f7895075ae

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              204B

                              MD5

                              7aea1307a1f57ab6f46907884a0c826d

                              SHA1

                              87136ff5a66eaf8273db3a118d319d813c71a87f

                              SHA256

                              793aa028afe1a155f5254abc5b4f741a274a017aedc1ec5261b750e33225398f

                              SHA512

                              b2f9237589d37d7e02aaf7f97749cb9b99f15e3eada354bd67acf88dfadc545defcd735802139c2dca9a4a4c0860b6efae49112dde2f91496d26426df78dcecc

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              204B

                              MD5

                              14fec127f5d829c9cd7443645d631008

                              SHA1

                              4aba5a198a787e46a742339e7b1320bfe1a84974

                              SHA256

                              1ec78599dc3c23deab3b9d7b73c0c5692b5d8d68b9fb278b4fd909f332d030ba

                              SHA512

                              d49f4386d54c820e46cfdee0680b229c7474daf51633d4df5d36d56e4086528f9ae50bf28091a5afcbb21284837d89c3d431c6dd3bccaf3c0bcd88a8974fffe6

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a812.TMP

                              Filesize

                              204B

                              MD5

                              b6926932b01692fe13c252aebaecef89

                              SHA1

                              285ff2aafaf48bf8cfc56b800b38d2fe964febb8

                              SHA256

                              18fbce110ab562a9aa2fd18bf44770a80bad1e80bf3b14c1dcf79cab973e1777

                              SHA512

                              0997f0f3587a53e63a3397a94cc22a5267a36500d107fb55b6728e80326185ce70895217debd5018b7ead580896532876e27e4944d3f75df3d397b416274e693

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              cc73dfd49fa4c42637e8ad2db4239e78

                              SHA1

                              f07a5bfd091942f39ca0048c3dfc40ac08ead85f

                              SHA256

                              a16172f35ffe0f79815d0904b43b89f097c28dbaf3b6805e1bddc3a1be2f30b5

                              SHA512

                              61fedd7fbca4ee6ba6ee3d80aae88fe45ce66e4835185da25d7868bdc86e5b76a55d24f5f852562d7a97927adb957278ada5b6fe145dc98f979c12c381b71c02

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              5e599c74b1ab0ede52ab68120c9390ed

                              SHA1

                              8f133b5d808c3da4521842605ce3635fa58a6727

                              SHA256

                              12481e61644cda742e5062a7a53d7970aab71c433b2d16d7718fc662234dc80a

                              SHA512

                              899a8106cec4de1089f7e70ba22b1019380d37f3b0a7883b98246b2d73ee7e2695fc1a3cb075c2989842069c0673fd549538ebdf8c9c03b75e4b54c1a55eee37