hxxps://www[.]instagram[.]com/p/C0rUAU_uG5G/?utm_source=ig_web_button_share_sheet&igsh=M2M0Y2JmOTAyOA==

Analysis

max time kernel
294s
max time network
290s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.instagram.com/p/C0rUAU_uG5G/?utm_source=ig_web_button_share_sheet&igsh=M2M0Y2JmOTAyOA==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133487713099374716"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
1868	chrome.exe
1868	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe
Token: SeShutdownPrivilege	2176	chrome.exe
Token: SeCreatePagefilePrivilege	2176	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3064	2176	chrome.exe	14
PID 2176 wrote to memory of 3064	2176	chrome.exe	14
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 4128	2176	chrome.exe	27
PID 2176 wrote to memory of 3448	2176	chrome.exe	26
PID 2176 wrote to memory of 3448	2176	chrome.exe	26
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25
PID 2176 wrote to memory of 2172	2176	chrome.exe	25

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffb5a759758,0x7ffb5a759768,0x7ffb5a759778
1⤵
PID:3064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.instagram.com/p/C0rUAU_uG5G/?utm_source=ig_web_button_share_sheet&igsh=M2M0Y2JmOTAyOA==
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:2
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4576 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3988 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1912,i,16893694268794621236,293988766243749215,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
8ca10bfc5e2a05dfe63f0335c67c2ae1

SHA1
baad3d325a720b8aed72a012ce19db0ee758c100

SHA256
b9b77975febc52c61c0c1f4e25e99243d118ae13abcfffd9779cef123bcede8b

SHA512
92929256324a157aff45c527d031315a35377972c226e008a9c4e14cd2a1a91970fa782cd1ae333a419ef62595db5a136490184048f95acb022360177978394d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
707B

MD5
1e07badaba35a0aae2d89d7734424ee9

SHA1
ff3e49be7e9f25660851ead8ebd0d896b860d4ec

SHA256
6b1e1261b8ee58596d14d804a1e8c868e46bb60f02efcf90a6b7d2730f5fc4d3

SHA512
1ab505bbafa1266094c2b397a485ee94ecfb649b204fc141f6a3f90c603b6d5faa2f311986cdf806adffe17851112b6f22c3518efa4882c9b4a20bde0b729848

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
707B

MD5
9efbfd498bdb7248814e44f69a3fedd7

SHA1
7a6eadab736a821cca39f93cf71f1bf8f1aab49c

SHA256
6c781134f5bad6e1966f63fcd6100c71f1c798a82510f28c1ff46a319bfa4eac

SHA512
7fb4a27cc13aa534c2481f923ab1d2764223c106e5c759a648ba64891abc33d7e552c0bc7563d2eecf9b7f133d1bedc277f459ea568eb1c9bbac9c2c36c94870

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
70807be365f2cd511c80fbf74aa29b97

SHA1
99719afdeff763f68b40826429f3ecebe97ed58b

SHA256
40098468bccffbccdcd03e6af83d74da4d68fdc06309ba12756ea932031dd2b4

SHA512
025cedf48fa7ae20076338cc65bbc351edcee0ea01a5e30f622258d5fa06b214809385ea14520accea363ef9c54833e3b635232b39d309de11b92f4170b88f56

Download Submit