Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    20s
  • max time network
    24s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/11/2023, 09:28

General

  • Target

    https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fwww.instagram.com%2f%5fn%2femaillogin%3fuid%3d301p45%26token%3ddQssaz%26auto%5fsend%3d0&umid=1a307c54-2612-41ad-8f49-46821b1c03da&auth=663c9af02b28e622c0295e1568a206100d47dd90-b6335b68636f8eefa845af3d9fe57a019a105e7a

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fwww.instagram.com%2f%5fn%2femaillogin%3fuid%3d301p45%26token%3ddQssaz%26auto%5fsend%3d0&umid=1a307c54-2612-41ad-8f49-46821b1c03da&auth=663c9af02b28e622c0295e1568a206100d47dd90-b6335b68636f8eefa845af3d9fe57a019a105e7a
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffda0939758,0x7ffda0939768,0x7ffda0939778
      2⤵
        PID:216
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1744,i,17049498614151745415,9324778993477487804,131072 /prefetch:8
        2⤵
          PID:3972
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1744,i,17049498614151745415,9324778993477487804,131072 /prefetch:8
          2⤵
            PID:5092
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1744,i,17049498614151745415,9324778993477487804,131072 /prefetch:1
            2⤵
              PID:1120
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1744,i,17049498614151745415,9324778993477487804,131072 /prefetch:1
              2⤵
                PID:4524
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=224 --field-trial-handle=1744,i,17049498614151745415,9324778993477487804,131072 /prefetch:2
                2⤵
                  PID:204
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4496 --field-trial-handle=1744,i,17049498614151745415,9324778993477487804,131072 /prefetch:1
                  2⤵
                    PID:4796
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3032 --field-trial-handle=1744,i,17049498614151745415,9324778993477487804,131072 /prefetch:1
                    2⤵
                      PID:628
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1744,i,17049498614151745415,9324778993477487804,131072 /prefetch:8
                      2⤵
                        PID:2460
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1744,i,17049498614151745415,9324778993477487804,131072 /prefetch:8
                        2⤵
                          PID:4600
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4420

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          528B

                          MD5

                          d1f18d17b5d6cfc304fbd8f169ab64a8

                          SHA1

                          1b5872945a954053cc7331d6207d800c154931c2

                          SHA256

                          4e4134b7a98796476cba6bba6c47bc98d33abf2121d99650284da6b02b5b1842

                          SHA512

                          5c24d0ddd1a0296dffb6cb1c6daf72886b7ebf857c6b41211f226a03f224ecc569e403972ea2c9791338ed0c756a82f86f2efc9fb914ada34691b4dd568e1bf5

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                          Filesize

                          264KB

                          MD5

                          f50f89a0a91564d0b8a211f8921aa7de

                          SHA1

                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                          SHA256

                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                          SHA512

                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          a15427c4789b20a322e448c7b12250d6

                          SHA1

                          a811370b19e811c572182e85467726d4c4df952e

                          SHA256

                          a12ddcfe6924de11457f505f2b927998a6a21d8ad02dde0aeefd1d3a4200a2c2

                          SHA512

                          a741d2d63c45acc985aaad0c12c3c7f6107d0e2790812c15caabbcaf3f178a60a92268e7e2198827b4bb1998e3c1742fd9e9889069ddaa35f6676dfa3c018903

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          706B

                          MD5

                          b962ee3cfc1b4ef56ad1ca4b55444888

                          SHA1

                          7590f0852d87c0aced62500af61624fd6f795893

                          SHA256

                          8407cc54729d6f59c4819523f359bf32a3a96ad828980d0d92596da697333eb3

                          SHA512

                          d8a074b108855f283ed31d73cbe1a54d477a8b9164830e4c9be843678a78c783b3a381171efff3ed2c142ba0347566bbf28cadf3134d204d27cbe470771ca160

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          6a65cc4de656c0a880c0f4084a0d14bb

                          SHA1

                          d68354bdfc7851f77709bf2d95bf73950e34620a

                          SHA256

                          a84e01615c9fdbbe6d713be31a5552e80a4631325922f06c2f9161cb85a28b03

                          SHA512

                          b9ff83d1261ba8d7d0fe6f95870aec6a2679667325f9fb1bb0ab4276ef408e601976bf55d5648a64c0350c6ac2cc6d9d42cc6ad27cec1252dc79607ae51ec190

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          263a20b9f3707881a3544fa597525055

                          SHA1

                          0ce7634b69394f5dc00cdd10d7717b00f866592d

                          SHA256

                          f286b8551dacba0b0f4812454ca8292451c43ee11bd3f548c9a2aac34c0df5d8

                          SHA512

                          6b29f4bf30e73c9dbc023ba1ded2271e6b2316368d2ef20e0f2ef951be62a0f2ea139a968425c6b9aac4575c04acf5c9040668e1108b364105f5edeccfa07ce7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\1325b193-2089-42b7-8da9-870b74bd5f1d\index-dir\the-real-index

                          Filesize

                          72B

                          MD5

                          50d2c31d7d526dd69db6cf96e6cdc069

                          SHA1

                          f9d044ca2ad97a5f9de315d5bf6892975594b252

                          SHA256

                          6b89674a85cdf39380cd478fa445988bacd4b71e6606b0f73f6c345512bc564c

                          SHA512

                          93d940254bbd08ff89a71bc910a3874918c462411479f8b30ff394d61e769dec9c45033532d065fd92343a999b2e9efaac6756673b93a746f00bd68054104832

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\249466d1-35bb-4ac3-88fd-868d41e6f1d5\index-dir\the-real-index

                          Filesize

                          48B

                          MD5

                          6e3db3c1e9e8add5dbc5ff296cfc197a

                          SHA1

                          a6c1681cf3e499b56401eb8317df2ae45eb4cdc9

                          SHA256

                          02968c9ab39e011b4e666a9a63fca8f46c562c1677c4fb56eb3cd16416f13968

                          SHA512

                          2333ffdc666f859868e0482fcf8244f911130b65ee2d3e2e683bed87721fc66b5fbf8197f539fad6254cb5d432f1d86a12926db0b4c49644f806948a170c62d6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\249466d1-35bb-4ac3-88fd-868d41e6f1d5\index-dir\the-real-index

                          Filesize

                          72B

                          MD5

                          63560da375bb17fdd033cc751888097e

                          SHA1

                          a3a057f4545fdacf54eac363e6dedea6f87c9370

                          SHA256

                          a22845b814adfa4a33edb89c46c1e583b98e636260178d067aa6e2548aafb4eb

                          SHA512

                          48f93535d0b3c81ed405245d65b61d91d0fe19add3051f383835c7542882940b12e58c20c035325b505e75ec9899e2ff949646e5e92c613e3c18a6bdb806b66b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt

                          Filesize

                          199B

                          MD5

                          beb84d53047b295124c25d6606e6a2eb

                          SHA1

                          760877a2359e8b5902f3ac117746f8a585da58d6

                          SHA256

                          3ce1dd436d4cc68c9b7aae2a817e194938ab6fe3b3d535680e712e89fa72cc9c

                          SHA512

                          3a8d79416294c23d0b0a3daf422a390da0bdc330df173ac2090d9a56507e539c5e969562272dc7a36bba69a05c2d142f15e1879292ef2db66a6a74b5cf95d794

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt

                          Filesize

                          187B

                          MD5

                          a307ae98145ddb27053ac09f68faea61

                          SHA1

                          a9d13b4f99e116047ab3ebdaa894de8008a3d65b

                          SHA256

                          875e6e5b46586502ad0e97ea8fe8532906bc0379739561b9970e8d9d4a0cbe22

                          SHA512

                          a4f6c8cd13402bb95aa3fdcf715049144b3b67c2ae8d4cb27bafc56c3923ec9dc43a173871d6e936a5faf20a3473c7194064f74b17886a331c115de1014e8312

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt~RFe57b650.TMP

                          Filesize

                          127B

                          MD5

                          bc22690b0c978cd0b25b193d32b691c5

                          SHA1

                          163938f59b1bf97d2dceca0ec265bf751c6ed3cd

                          SHA256

                          e63c55347b4605701f97160c327af917607c7362960eee4a19d75aaaff39986b

                          SHA512

                          3a4f43397bfa20312e3085e65c1f9082d370a61fd33b89e30a5b168888c431efe0aeff73a515b4be27c15fe912c06bbf18f38cdb6c248cb79cd50cbc9c28a780

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                          Filesize

                          96B

                          MD5

                          5369c13ab3685f43b10d57a4515aa6e2

                          SHA1

                          b8d17141bf7d8e5fba492c5312197cf51c708e66

                          SHA256

                          985764dfe7e0a51f0a4c9226d44343a3993a77a61ac4c8abffcda203026685e9

                          SHA512

                          bec678926e7a2fe99b15a42c9abedc8d0724b5bfc8c13db96c6bde3d6221515acce83c990efd7d5c190cec42919193595e1425ebc946dab94a362ef697fefee9

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e54f.TMP

                          Filesize

                          48B

                          MD5

                          fa43e714f084c797d39d89d0b1f8aeb9

                          SHA1

                          e8b975e9373540b47d18dc051e0c1d37b538c09c

                          SHA256

                          af0ec8e6ad803486a67ca6132c8c37f76133aa731347b2dd78b00eb07c337209

                          SHA512

                          0f88375f4d302305f5687c46cd32738c32ff9e27b0a5de6a6bfb1c699492f2dbfc24131016e04e9c875474e406dff8ac4698e97fb5e81a19229c728192000827

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          106KB

                          MD5

                          9f947044fb4863895a6dc07a94dd28d0

                          SHA1

                          0f74285922a7de7889ed67a8a1485761d37b5e70

                          SHA256

                          d2a9a17e6dab6d6a930213fdac21fdaaec52f3ed791efd963e9299916142d726

                          SHA512

                          596ce02ad85ddf7960d63a2aee33b303de13c485fd06b2a5a7111e4da6cf81e262c65cb4f80346482e9591e2dbf70f712ef4ddd20b249552691ab87f2e81ab2c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          106KB

                          MD5

                          6e885abc0948729c9a4c664370b8fe15

                          SHA1

                          96fa47123957b7466e1152a8b34f2da19f845d95

                          SHA256

                          b730762e731a46aa45a9969b3885247dc5d9faa77f4d800a7ba03e59a6af46e3

                          SHA512

                          b431967e766c3c8eb2449166e135f77e8090597bc8acbbd40422e9182d7a88375b8efc36aa6cebb01ba52346e19816372dce8e0321bdcf4156dedfee00a3d0bc

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd