Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    77s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/11/2023, 13:30

General

  • Target

    https://indd.adobe.com/view/2aec0a1a-b314-4b56-b6d9-6c8d20ed3a31

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://indd.adobe.com/view/2aec0a1a-b314-4b56-b6d9-6c8d20ed3a31
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3924
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83ff69758,0x7ff83ff69768,0x7ff83ff69778
      2⤵
        PID:4604
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:2
        2⤵
          PID:4748
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:8
          2⤵
            PID:4452
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:8
            2⤵
              PID:1984
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:1
              2⤵
                PID:1060
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:1
                2⤵
                  PID:3184
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:8
                  2⤵
                    PID:4068
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:8
                    2⤵
                      PID:3448
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4608 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:1
                      2⤵
                        PID:1252
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4756 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:1
                        2⤵
                          PID:456
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5672 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:1
                          2⤵
                            PID:2376
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5788 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:1
                            2⤵
                              PID:5048
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:8
                              2⤵
                                PID:2172
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4772 --field-trial-handle=1876,i,11965305072100023880,4229405812495208602,131072 /prefetch:1
                                2⤵
                                  PID:1172
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:2832

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  336B

                                  MD5

                                  6f040681d2a59c63d58ef5cc0706001b

                                  SHA1

                                  96ebd2544268380142195e5f6ce37aea940074dd

                                  SHA256

                                  9b406b2bb32f3963ff3a67dd8a2b3f067abddd5e964d0d90083c09a4cdba3e24

                                  SHA512

                                  c110a5051b2172b693f51bf201f82764ca908d1d9e255fb3821411cc0cc57bbdbbea81f94a8e161af5beaf284788086156311c6181ae4b8b1fe251d15c27d6de

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  192B

                                  MD5

                                  2b8fad9ac595a32050b55bc512dbcec6

                                  SHA1

                                  3d3b1a340fa62e971d58b1d608e01b05471c3c53

                                  SHA256

                                  f4846af222f4ae9f123753b936161b8e356904947a6d36da55c3026179642602

                                  SHA512

                                  bc596acee00ca76d2e9b72059205d8b3ea27e99c760243c4294c714c56a2e58a104965c0e1610595c612a0ef882532f8fb1d93f16c3d579c0f6917f3258dd562

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  51c3970383123b2e3ae592a917b32d6a

                                  SHA1

                                  0347a25b2f289d5cd5a183648e9667bf52a6b754

                                  SHA256

                                  00aebf80b05be8d6964ed23755cf3009c1f4c819bae915ba6497cd58078de35f

                                  SHA512

                                  af7b88b33b5b2b9091325abb01697e579c6eeb73da6874451a3da3d60079790551bd6afceefdf8869c0394437a5f65bfe6436ccc06f370fb4ac27b38db59171e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  68be2b36ccec42c94b6c4e7d9ed05854

                                  SHA1

                                  724854ccf15a05b5c694935931e13e4ad7c52c1d

                                  SHA256

                                  85407a6628a08b69c316aca766aad2f41b7a919f55e1929bd74232dded8551fc

                                  SHA512

                                  016d97c01f517330336d0c59facc44c4d9878a1f49da58ec6acb1f9c19d0ba43b4bf846202a561f4d0445a4bafd4fbe3fb2c1611cb1e1e620786abbe8b8e055e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  db6d92d12a8be730cc59b76282b4d8b0

                                  SHA1

                                  6597b88510ad9b079c6ba487ee5ddab2ff7c057c

                                  SHA256

                                  8ef65d6b62abade54da35785611efc8956f225040ecadd81d916441faabeca71

                                  SHA512

                                  49fe00d07a332b7ddc498b6618f69259c9392bcba8f33469e48087087df3f4abab6420a5533ed711a4b1fd4a7c63a670461dc1150c2826ea83be215c454473db

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  f916e0a97c8c2cc1bb5944cdbbfedcac

                                  SHA1

                                  8a55de6ee8f13b11ad2268faf27afa88b280d47e

                                  SHA256

                                  0000bc979fc045de4695ae8983b8353ea779f25c499e73d7dff8c0c1bed062f3

                                  SHA512

                                  142b336390f7c221167db50f53c33e0603515f963a744eb012a61344a955a7bfb86f0d72b7d84228c23b53d94269767bf3f22ec0ed77481d66ef06db32d06fed

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  109KB

                                  MD5

                                  a3a84e22dc6543c652c4b2ef1470015f

                                  SHA1

                                  8c0e92370d199d5a7bfbd2f1fbfa2a20d8bdf20b

                                  SHA256

                                  6f6863eebe641417565962225c00b2cdd750ef47fe22474278c5c6ec42ecd1f1

                                  SHA512

                                  5007a4f031477d09601c67f082b9b8286a35d9cae7aa9c1af189d404ea81407dc7bc58a0c4979fc09f78a303f6be501a2c9a09f0888b00c2f23cf51175904150

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  109KB

                                  MD5

                                  caac8e07c1b0af2ee6e241b6b64d5321

                                  SHA1

                                  fb6240a0f0dccca116b145ac92915ca074dff310

                                  SHA256

                                  c510ee12532d184350578530eb185b3f0acccc5201b36b0a2142c6b7aa65ef2d

                                  SHA512

                                  2eed3e7479c104baff8038c00cb0db6aae9e43b1ef2eaff724bff38f3b9c0faee44bb33a50208ab7568b795f29c9ec29236e2194b33c90b2b913ee5b4068325f

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                  Filesize

                                  104KB

                                  MD5

                                  5ea5559d420340367f791f5e767254ab

                                  SHA1

                                  ab23b652b5f1837072b2489ceb7e7518b3ec593a

                                  SHA256

                                  a733f5f378900e7a8583335cdef2ed319f30ed1bc30278ab3d0c778714186596

                                  SHA512

                                  5a61d71f67be59eb02f4884416d139ff6d6b2ebc9db6f7e4e02ef9fb11253a5402ec30d77b18aae9d54d3ebe1e8d247819b96f03621bbff77900e446351b025c

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe588150.TMP

                                  Filesize

                                  101KB

                                  MD5

                                  77b59c04fe169914cc0b4f675d8eaacc

                                  SHA1

                                  d78ba4e02410ad2deea042dfb92b092081b6c75e

                                  SHA256

                                  e53f8edf8dd23004ebc11be81826fd003961a0130d335a998564807912835a0c

                                  SHA512

                                  e9e19cf7313e18ca6862127f98f0233efeb5d023a0987eb9f4351afc7c3cdbb127cd8897b5ac91ba3c889af68d43a0a4b96fe95e3f15112335d5140a893b23de

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd