Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
26s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 14:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://instagram.com
Resource
win10v2004-20240802-en
General
-
Target
http://instagram.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4016 msedge.exe 4016 msedge.exe 3316 msedge.exe 3316 msedge.exe 4536 identity_helper.exe 4536 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3316 wrote to memory of 4120 3316 msedge.exe 87 PID 3316 wrote to memory of 4120 3316 msedge.exe 87 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 1220 3316 msedge.exe 88 PID 3316 wrote to memory of 4016 3316 msedge.exe 89 PID 3316 wrote to memory of 4016 3316 msedge.exe 89 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90 PID 3316 wrote to memory of 4264 3316 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://instagram.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe5ba46f8,0x7ffbe5ba4708,0x7ffbe5ba47182⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:12⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:12⤵PID:1284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9467251446659712106,8300370895072506666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:12⤵PID:1204
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1840
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5709c6f4a32b317f6487b598788b6353d
SHA150f44d43be9630018f0bd2acb1528df07cd05b7f
SHA256353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b
SHA5124f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3
-
Filesize
152B
MD59ebc024cdb324eb41f33c6ec63d1458d
SHA1f623e96981ee63c1b6879f682c4364fd5c2265e5
SHA25623b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f
SHA5126971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5a85c9f79f9ed20b7737b11c0a3474a29
SHA144a5f6e78ac435092b29bbfe6b1fd8cbc5d187de
SHA25688a4bcb0e437dd127b72e4801d72d9538a5cd088af3b608db6ff246754cd2fef
SHA5128e775158e560801da10ada16d809ab1bb19b52aaf2ee909887c154bfefcafcc6bcb2f8b2f61068a50aca9366f374fbb8ed918202aa5371a91642c934fb02bba3
-
Filesize
6KB
MD50e7ca66f1d877f666f2ccda8aa1069be
SHA1215c8ea4f2c6313e623d9f331934a3b49b1fea71
SHA2564f7a9fa400fa8b570f5b161dd20ec8c91ce5a35fc76a5bf8566d7ffb29b40ba4
SHA51270163ea35799b5af75a42fe57a50f04b3d8c5619c3504117630ab9923418b5ecff9b1416f753bc8f9102985f9c556c786dd96c44de8a305de6185fe2d1c06b52
-
Filesize
24KB
MD5494a861dfe3fb61b7f6e9a8e1f92d179
SHA1903db9c91a888cdd2a359e921ea2c1a958228aa9
SHA25646ffd9cec0b1524402f64218ea9584cb751cd61e56eae54ac0ad61c55273c690
SHA512f97bfb87546ee38f100ef52f6ee6d102d05feb378a940954a1953f5dc301e6ae7a91de2b2176dcac165a61abf867e06e3e31572a378b1abd9ea2768de76e7175
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5dd93c9346f285bf62dac51b5c78938ed
SHA13064f46c3d9df0fd7322b96b2cd2058e5d6e2a3f
SHA256149a68c1f4688c797fd3e48bed5b54427da7f53cc8dc911a776354bf016fb8d4
SHA512c7b5409b271f9ead2c19d8bbce025b3f3e0a7fe36404d70ba9162c1675870573d119bf84cc32d8bd7704c8d02d15cafa09eec69da3d4d4b28d5dc4bc1f2e9a1e