Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 20:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.reliancematrix.com/statutory-paid-leave-laws
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://www.reliancematrix.com/statutory-paid-leave-laws
Resource
win10v2004-20231215-en
General
-
Target
https://www.reliancematrix.com/statutory-paid-leave-laws
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133501701672106074" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 3688 chrome.exe 3688 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1152 chrome.exe 1152 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 1860 1152 chrome.exe 85 PID 1152 wrote to memory of 1860 1152 chrome.exe 85 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1984 1152 chrome.exe 87 PID 1152 wrote to memory of 1144 1152 chrome.exe 89 PID 1152 wrote to memory of 1144 1152 chrome.exe 89 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88 PID 1152 wrote to memory of 3984 1152 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.reliancematrix.com/statutory-paid-leave-laws1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccddb9758,0x7ffccddb9768,0x7ffccddb97782⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:22⤵PID:1984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:82⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:82⤵PID:1144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3160 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:12⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3172 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:12⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:82⤵PID:628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:82⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:82⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:82⤵PID:3276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1252,i,18098786810221760883,16204249511567631959,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3688
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5b53b5f077b0a2f53c772ea2782a019eb
SHA10000d620ecdac1d60547ba7cea242cc31c7e02de
SHA256a6dcbe2ea817d863893c4e333bee4771f2bd8749e2fc737f730e833c2ce11dfe
SHA5120a55b926f8711ba95ae2f46c5a0d4f8ee1dda4e8ab569d8a360481b14072a6345d155299fa73631cf6fa1b9937c1e30a7edb9f6173d1cf922004f9db04b0af8f
-
Filesize
1KB
MD567966995d0916c56d52af165a83152b4
SHA1769e5b7b792be9317891c5bb87d6cf1944540259
SHA256501625ba4fb64b785db5a0073c49ec66d8a5a75344941573758c18e8a9f0d300
SHA5122760e272edd9cd275bdd9eb1f58847e38b0a90f7597c4d8d77164675d9da1a6f80d2aec8b4008df0c6b4e7a02490f3106fac38eb20f0277eddc404db0b84e768
-
Filesize
1KB
MD5b04bca1ca898117943fa9d30f915d438
SHA1244313e0e408340b1d49b8073874fd7b75960b46
SHA256b3c22bb5725f230ca96b4cdac0e1d54fef1b69b39364bf16003d232e2b579613
SHA512c5b537bfccc0dd7721136a171fbba0e88e6c514b67ffa625cb711325224386767e79539f5061ea272155079c277491de765883fc99ced6a3777dd37b6fae7f92
-
Filesize
539B
MD5250195e802a018714347906836098126
SHA1aa12b5eef50acd8c03cea18676e2bd068940dae5
SHA256126f5ed22e131469c7aae15641d42c983b1880205be395bcb6f3838c9cea4b21
SHA51223ef0a756fb9396cb96cd54289f4dc676b281f986151eed1c8c5d65735d521131e8ec59edc3ba247384b34c1464d2503c529af9a1773183cdf7dc54b07553e33
-
Filesize
6KB
MD53e840bf939ca1bda2e3e26a67906cc33
SHA1ee1fa0d5cb1a967bfdb34d205b1609e7cf139a16
SHA256e323187b889e6489465fd46dec77333815a4f0ee6dd68a1b956e1beee10bfc93
SHA5128c466f20487ef9ca04a66cf141de6891fb9829dd2149a1314dfcd63c8bc0ce4a63503f0a2fcb8a26d7da86d320020173bbec0cf45e3d7d3c7f5c490cdbeeaf17
-
Filesize
115KB
MD58440434660586c4a6e12b3e5e89c3b99
SHA1f877897ad290f017067371a1ee8e30968d9c8c08
SHA2565d0ed9f1244bbe61b1646d38cdc0945b41c8e8245b28e28ac50650c3967b43f2
SHA5125000250c87571d8ee3a557b467614d0df64b0b82894d6bb4f83c154e280c1444b1c9e25be4f5c2d5dd0b54a40040bd34ab8aaaf907cd33f6ebc7795703ad3302
-
Filesize
115KB
MD57ff30e76700290d260e21fef8f260f64
SHA1f9194fb00c7919d68c899d8c1fbae1747e86d384
SHA256c2ce54a8d8b0410c90c7c475187b517be5246070d0d23f5baee9fce74ace41c4
SHA5127a12f8c23fac041e99831089ea2447d3ddb66aeabafd908d2fc25dd9a9ca8a6a90a3dc84b89586d5091ff8af189ab27634712dd07eeeacced2ba428247dd0a82
-
Filesize
116KB
MD547154f13c80610ee015211785974b7a7
SHA1327744281122882b8bd45c700a5b2159bf716668
SHA25611c5dcfa79f4c12d59cd86038a4284a1e3a37f53e4e561577f00a427ad1ddca2
SHA51273c06a8ce669c6d2f0fd2982fbfe77a31bc86ee836ed2554e2712f05f445a910027106ce796844e877f4937d0b505ed929652e75bf18bab83fe8b6fd1c57fa7d
-
Filesize
135KB
MD57114992e8c5967183afd3f6cfb2d2acf
SHA17bb031ec47452c73fd6be6b498a138d4c64acc21
SHA256d1d11a3e05d908372ba895db94d40d7082346dc1e87a5dd5bdf0cab6a06981a5
SHA512fec18348e08f5e83f36e9c5bfa00ffcfdeebd204de46516f8da33c89c7a950f8b6331a631c3353a6ac7ca2908afcea5e62d4974c03845218eee4f6246e14e6d2
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd