Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
245s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2023, 00:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://new.express.adobe.com/webpage/i5Fh8VsNoPqaH
Resource
win7-20231023-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
https://new.express.adobe.com/webpage/i5Fh8VsNoPqaH
Resource
win10v2004-20231130-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
https://new.express.adobe.com/webpage/i5Fh8VsNoPqaH
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133468163877490266" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1352 chrome.exe 1352 chrome.exe 4536 chrome.exe 4536 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1352 wrote to memory of 3432 1352 chrome.exe 32 PID 1352 wrote to memory of 3432 1352 chrome.exe 32 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4884 1352 chrome.exe 93 PID 1352 wrote to memory of 4412 1352 chrome.exe 92 PID 1352 wrote to memory of 4412 1352 chrome.exe 92 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91 PID 1352 wrote to memory of 1824 1352 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://new.express.adobe.com/webpage/i5Fh8VsNoPqaH1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff8468f9758,0x7ff8468f9768,0x7ff8468f97782⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:12⤵PID:936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2172 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:12⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:82⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:82⤵PID:4412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:22⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:82⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:82⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5112 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:12⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3212 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:12⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3868 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:12⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2360 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:12⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3792 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2924 --field-trial-handle=1888,i,12553725595794937764,13413766736461121400,131072 /prefetch:12⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD53e0dea696cc1ab211df6106a1fcc65da
SHA1d2e09e968de673f00a4d36b29933581856f083ac
SHA2560326d088d1f75fc71d95f86e5cf79e39ad2f8de808e4eb1e88100732539a7253
SHA51217b80cc4fcec367bd446df3d2322effab15dd832d05cf9e7cea6336b181d2270b53a8d89a7b7d8b3738f94cd07827e4e20e3d8b8b9f0113d8eb95d10d0869a2b
-
Filesize
6KB
MD5796c33b3dd40ced43d31864ce27100d9
SHA1e2e87ab03d48ae9e4606c42ea1a02759a6b23895
SHA2560bb471b5f543d0c71ae3b02e3df45e571a7abe47a6b9078eb3444cf75307f993
SHA512223306ea9576e7c68ce3ba36016be4c940962a5302f5ed75fe24bb3a4f1a708aa6fb8951d13f6e68241728eb44f1ea286ff29af8f916a63efc573c4e47650b8d
-
Filesize
115KB
MD59b2c97f5e061c8e1bdd14589af67cabb
SHA15fa9bbb11bd872951b1701ffd365ecb6260527a4
SHA256453e2861b6c242586d507982a7a103fd5bd3fbf4c04dd5813ee13eae6ce3eab9
SHA5129b1f2953dca69f39a4b054f27ad0dfba6525e3cf0f11dc005c43ecd2f6847f9a1c343fa6f9fb571cb15dbb49f0d60f4c7fabc998340902782b80bcba78320495
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd