Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 20:35

General

  • Target

    https://www.reliancematrix.com/statutory-paid-leave-laws

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.reliancematrix.com/statutory-paid-leave-laws
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccddb9758,0x7ffccddb9768,0x7ffccddb9778
      2⤵
        PID:1860
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:2
        2⤵
          PID:1984
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:8
          2⤵
            PID:3984
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:8
            2⤵
              PID:1144
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3160 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:1
              2⤵
                PID:4904
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3172 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:1
                2⤵
                  PID:4360
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:8
                  2⤵
                    PID:628
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:8
                    2⤵
                      PID:4624
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:8
                      2⤵
                        PID:3028
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:8
                        2⤵
                          PID:3276
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3688
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:2916

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          168B

                          MD5

                          b53b5f077b0a2f53c772ea2782a019eb

                          SHA1

                          0000d620ecdac1d60547ba7cea242cc31c7e02de

                          SHA256

                          a6dcbe2ea817d863893c4e333bee4771f2bd8749e2fc737f730e833c2ce11dfe

                          SHA512

                          0a55b926f8711ba95ae2f46c5a0d4f8ee1dda4e8ab569d8a360481b14072a6345d155299fa73631cf6fa1b9937c1e30a7edb9f6173d1cf922004f9db04b0af8f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          67966995d0916c56d52af165a83152b4

                          SHA1

                          769e5b7b792be9317891c5bb87d6cf1944540259

                          SHA256

                          501625ba4fb64b785db5a0073c49ec66d8a5a75344941573758c18e8a9f0d300

                          SHA512

                          2760e272edd9cd275bdd9eb1f58847e38b0a90f7597c4d8d77164675d9da1a6f80d2aec8b4008df0c6b4e7a02490f3106fac38eb20f0277eddc404db0b84e768

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          b04bca1ca898117943fa9d30f915d438

                          SHA1

                          244313e0e408340b1d49b8073874fd7b75960b46

                          SHA256

                          b3c22bb5725f230ca96b4cdac0e1d54fef1b69b39364bf16003d232e2b579613

                          SHA512

                          c5b537bfccc0dd7721136a171fbba0e88e6c514b67ffa625cb711325224386767e79539f5061ea272155079c277491de765883fc99ced6a3777dd37b6fae7f92

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          539B

                          MD5

                          250195e802a018714347906836098126

                          SHA1

                          aa12b5eef50acd8c03cea18676e2bd068940dae5

                          SHA256

                          126f5ed22e131469c7aae15641d42c983b1880205be395bcb6f3838c9cea4b21

                          SHA512

                          23ef0a756fb9396cb96cd54289f4dc676b281f986151eed1c8c5d65735d521131e8ec59edc3ba247384b34c1464d2503c529af9a1773183cdf7dc54b07553e33

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          3e840bf939ca1bda2e3e26a67906cc33

                          SHA1

                          ee1fa0d5cb1a967bfdb34d205b1609e7cf139a16

                          SHA256

                          e323187b889e6489465fd46dec77333815a4f0ee6dd68a1b956e1beee10bfc93

                          SHA512

                          8c466f20487ef9ca04a66cf141de6891fb9829dd2149a1314dfcd63c8bc0ce4a63503f0a2fcb8a26d7da86d320020173bbec0cf45e3d7d3c7f5c490cdbeeaf17

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          115KB

                          MD5

                          8440434660586c4a6e12b3e5e89c3b99

                          SHA1

                          f877897ad290f017067371a1ee8e30968d9c8c08

                          SHA256

                          5d0ed9f1244bbe61b1646d38cdc0945b41c8e8245b28e28ac50650c3967b43f2

                          SHA512

                          5000250c87571d8ee3a557b467614d0df64b0b82894d6bb4f83c154e280c1444b1c9e25be4f5c2d5dd0b54a40040bd34ab8aaaf907cd33f6ebc7795703ad3302

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          115KB

                          MD5

                          7ff30e76700290d260e21fef8f260f64

                          SHA1

                          f9194fb00c7919d68c899d8c1fbae1747e86d384

                          SHA256

                          c2ce54a8d8b0410c90c7c475187b517be5246070d0d23f5baee9fce74ace41c4

                          SHA512

                          7a12f8c23fac041e99831089ea2447d3ddb66aeabafd908d2fc25dd9a9ca8a6a90a3dc84b89586d5091ff8af189ab27634712dd07eeeacced2ba428247dd0a82

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          116KB

                          MD5

                          47154f13c80610ee015211785974b7a7

                          SHA1

                          327744281122882b8bd45c700a5b2159bf716668

                          SHA256

                          11c5dcfa79f4c12d59cd86038a4284a1e3a37f53e4e561577f00a427ad1ddca2

                          SHA512

                          73c06a8ce669c6d2f0fd2982fbfe77a31bc86ee836ed2554e2712f05f445a910027106ce796844e877f4937d0b505ed929652e75bf18bab83fe8b6fd1c57fa7d

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          135KB

                          MD5

                          7114992e8c5967183afd3f6cfb2d2acf

                          SHA1

                          7bb031ec47452c73fd6be6b498a138d4c64acc21

                          SHA256

                          d1d11a3e05d908372ba895db94d40d7082346dc1e87a5dd5bdf0cab6a06981a5

                          SHA512

                          fec18348e08f5e83f36e9c5bfa00ffcfdeebd204de46516f8da33c89c7a950f8b6331a631c3353a6ac7ca2908afcea5e62d4974c03845218eee4f6246e14e6d2

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd