Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/05/2023, 05:01

230503-fnmqesfe5x 1

03/05/2023, 03:31

230503-d23mpade87 1

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2023, 05:01

General

  • Target

    https://identlityworkday.com/online/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://identlityworkday.com/online/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc29de9758,0x7ffc29de9768,0x7ffc29de9778
      2⤵
        PID:3364
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:2
        2⤵
          PID:1076
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:8
          2⤵
            PID:3720
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1304 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:8
            2⤵
              PID:3616
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:1
              2⤵
                PID:2588
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3176 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:1
                2⤵
                  PID:2624
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:8
                  2⤵
                    PID:540
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4872 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:1
                    2⤵
                      PID:5064
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4828 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:1
                      2⤵
                        PID:4812
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:8
                        2⤵
                          PID:1656
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:8
                          2⤵
                            PID:2100
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5176 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:1
                            2⤵
                              PID:4668
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5296 --field-trial-handle=1836,i,15606886010828957135,12818436148311172517,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3760
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:3968

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              264B

                              MD5

                              548c943be714dc547d0bec564ad78677

                              SHA1

                              3fde6a877b75684729042e44aa839a8773bd5728

                              SHA256

                              a716f587eba5d31670e32eb331887748b11b2c992a95fb173798aa0d902322f2

                              SHA512

                              ec4c1875325d05395f9eee6ce157de174b3778c530a17d846b10c282c83a66e0e22a726c9996ba0cfcdbe7bb791f7bcaba5d24463ec6c0f3595848dcda07962c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              336B

                              MD5

                              a1e49b8f70509c36f66aa4d6e853418d

                              SHA1

                              b487041c56b70911cecb7b5d5e1610de9f50478c

                              SHA256

                              56f411bffc5a77f8b39e3fa42cb5a6dca05e28f49722238bb1239fee1c7f3d13

                              SHA512

                              ff64228deea227c2b61f12b9dcaac8fda5135e3b18f8887cc03eef92dd8fbf5b7b349bcd9a2cafaddf5c44392e05f54d73f28c49d28e6266989540a408ad6324

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              8fe478cbfbaeb115c1fa247c754e556e

                              SHA1

                              67903389e9e61a91d8ab4c39af71f2b46a66a405

                              SHA256

                              001d077e036556219ea82662fac99a97698e324d4146e55d1b3431ac5c7585d0

                              SHA512

                              e6a8423e0b263f6b96d9c3a11cdab5eadbd371ee95631b31072446f87ceef8406e2adf0d87b20d3fcff707c8c8c0cb2d97975bb3a12f39e99abeb22226aaf78c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              91b3bb5768292ec3d9e6ca06befdd6d7

                              SHA1

                              70b12b10705bd43468cd2459225d592ebc72d339

                              SHA256

                              e8514fb6b26cabda3b6b364da72659bc308629088fa47ca2e1f2b723b7c7d7a2

                              SHA512

                              e4a74b2928eeae75b08cd9b6a10686c50fe11feb99b21d726b2431a7118176e8fc6684f68e16150ac1c13675c5d302a78e7a4b037da1eae1823db592efd44201

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              539B

                              MD5

                              8d68eb20ea7c8adddcb9e35cfeb9dc45

                              SHA1

                              fafe35024263bceedcdf3ebd86619189a6c2459a

                              SHA256

                              01cbabf82e06ec7b8849c38f3fbe2317f2d9527c4423c02cbf1a8f94dbf4fc58

                              SHA512

                              7167619822d02344ad724daae20fdfe742ef346985697da0fb2f1652a1f8fa534b031f74843ad31241a5e35fb42b63bc0d3f4490a0463763aa4b3faa7bfe97d5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              76551db5f87e28e3fce9513ace087d35

                              SHA1

                              2dd0baca070e28212a75b03fe818aad167cac5d7

                              SHA256

                              5758197ecae2dbafb404f43cb8ad28c8c26bd65d4fc35db37877e427f6957033

                              SHA512

                              2668b6b290d100967cb0ed8e5fdcfe3577e9381055b5f1e2b7d36f4512b05f531cd800b5b32db1cf3f3b64b24ad514f82573fb482095c8b417504ea2207252b1

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              e05e1f0303160ec3c4e7d59f5f5c95a0

                              SHA1

                              3908fd3cd91763c874e821b65d2978c499b6137d

                              SHA256

                              d4830eaf463984ebd3e24b7f39b2dd1a51fedee1f75f2ae9688adf4eda883052

                              SHA512

                              cd56f24dc66990538852eadc78e10967cb9c024cef7fe243521d1c26a6b8f652e204685cb11843fcaaa4e7fd95647a5d7d7f6169255993ad1cf1e2d1ba5af5d3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              92845f3d7c6ed931815977a1b0c3754b

                              SHA1

                              ce9614ce9107e0ec2b983678c0d5be1c875e24e3

                              SHA256

                              ccfc5ed33c7e3feea45c6466a709cd4521d9973cb4005b9c7a075dd04f1dc9bd

                              SHA512

                              cae31ad266651c2a9968152ec7647fdbefa60005d1ec2e93c42b83cafeda6ef0091a393c4a9cfd00af02e0088dbba911f277e1441570668e2af7805db2bf22e8

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              60b17cae9a9fb780c55da27c9d757c1e

                              SHA1

                              edbcb50fa958be99a10f6318d38566bb735a87f1

                              SHA256

                              469f912bc366402ea4e49ddbdb05ce905832931fb20093d5802dbea74a6f6be6

                              SHA512

                              7d9c2a6aaa57fccc2da6b39ca344d500e714c2d9493d305ed03ce7e3dd3d81d460b04c9c370bc6a58d2ba0eabae4a1785448a291017a070dd8fa9182cba79b5c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              e77d9c086712ea50a54fb24044ed0988

                              SHA1

                              bca8d86354088ebb19bf08223ac92a0656cc799a

                              SHA256

                              0099df53ab2b0422635997d4b0cd82d84335ce3e4c2088e350fa76b691fad92d

                              SHA512

                              d4c3b2eae146956c79cd261222a55483b3221cd5619a1ba8c0628432f0d56f1ff8399501e5ff77bfce3e86642e05c5dbd4513592896e392b871b5d1f4daf9c79

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              488af6c23971be4ebac2d2f5bffbc747

                              SHA1

                              b00410e22ad60e84b43da91e46db189c7b0168ff

                              SHA256

                              fead75cc51cf0e71ef1d35203420931aad347f0bc18bd1133b02fb625f0c4f4f

                              SHA512

                              ca52c853b4c7fb02b793a49c27f536ae00fc3a94a4480a1bda1e4dce4b6a14c10c3a822bbd9bd86db521211fcb25e834f4d3d1f2112b5f5fed6d624ad724230c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              147KB

                              MD5

                              c1bc7091c625fab092d647e8fb8b49d0

                              SHA1

                              b4408286effa62bee7a5f57982ad873661326586

                              SHA256

                              9c72968427c64df32d96b702cee58189a79c0493a0d377704f841e966a063fbb

                              SHA512

                              854b77e872af899e7a1328a1dfb5b7d60156999f207a2f8d2b3e4acab86ce025e20169f8eedce5d317b063d157550a61e66f949a99566df2811e6ae690dcb6e7

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                              Filesize

                              101KB

                              MD5

                              372edc29ab5e2d601c7798c3ba440738

                              SHA1

                              52a779da3ff9dde4cf7c4ea40f0e1d01689676f3

                              SHA256

                              12fbd37613a5aea7366727caa88dafcd93265d316e31dc7b92c7fe8a522bcdc8

                              SHA512

                              e247c773999042cc6f1a94e94853f26bf64dc7ad918af67f11acd4d40189b8ebcae0a6ae28f9f5e67b11ddce7cc884d8eb8fd37fac201212e5e29d78e15ab9d3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe576820.TMP

                              Filesize

                              98KB

                              MD5

                              1a380cae482e348bd6fbffaaecf0a2cc

                              SHA1

                              476ffa8d0e849bf3a738750f9e269334c36badba

                              SHA256

                              1342dfdae0a056afa23f07720d7568d6c6bed45f667efd13bb7fc4eaac2df2ff

                              SHA512

                              8e8a9ed7f74d515177bcc15059a89a19fee6c140793cb45b80cbc898b5213627931dea34160d8c1c719617ab850a866368978494a52dfb130e83478aace697ed

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                              Filesize

                              2B

                              MD5

                              f3b25701fe362ec84616a93a45ce9998

                              SHA1

                              d62636d8caec13f04e28442a0a6fa1afeb024bbb

                              SHA256

                              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                              SHA512

                              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84