hxxps://www[.]reliancematrix[.]com/

Analysis

max time kernel
33s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.reliancematrix.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 852	2224	chrome.exe	28
PID 2224 wrote to memory of 852	2224	chrome.exe	28
PID 2224 wrote to memory of 852	2224	chrome.exe	28
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2620	2224	chrome.exe	30
PID 2224 wrote to memory of 2344	2224	chrome.exe	31
PID 2224 wrote to memory of 2344	2224	chrome.exe	31
PID 2224 wrote to memory of 2344	2224	chrome.exe	31
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32
PID 2224 wrote to memory of 1132	2224	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.reliancematrix.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d19758,0x7fef6d19768,0x7fef6d19778
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=972,i,8050981030479172644,212654217074530468,131072 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1476 --field-trial-handle=972,i,8050981030479172644,212654217074530468,131072 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=972,i,8050981030479172644,212654217074530468,131072 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2268 --field-trial-handle=972,i,8050981030479172644,212654217074530468,131072 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2296 --field-trial-handle=972,i,8050981030479172644,212654217074530468,131072 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1372 --field-trial-handle=972,i,8050981030479172644,212654217074530468,131072 /prefetch:2
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1436 --field-trial-handle=972,i,8050981030479172644,212654217074530468,131072 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3988 --field-trial-handle=972,i,8050981030479172644,212654217074530468,131072 /prefetch:8
  2⤵
  PID:2356

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1cb6f2e96dc4d6c13c40d63d401bf53

SHA1
7d92ae2cb61eda7a486501276bf7bd7ba47c6899

SHA256
c60c5e22f30a51ad7a4c99d0a0208c4f3e3450a22636e6f596e52dddb88b6323

SHA512
dc1b4079974369da63a6da0aebfad61cb29dd3e8df6345c6a5ffe8c2ac843c645cd28affbe592165881bd99f88460de387e30a1dfc4419b117a162ffb5284570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d248d8c01da17de5d14518f365df6c80

SHA1
a614f050a93c221ebbe396f35581c8ab8e3c9bac

SHA256
d6ac9eb896610f115233e489476c87020562c01cb5c3a2fe91e59f6dc804178a

SHA512
d2f3e995eb39c511baace21e4d48c48621ce3817a04a5b7f90fd3061fe8640d50fe0cfd4fe1ca3b0ec3386c55df34d7dc61ae969f58dc6954c18c6bb49e54edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fdb87d9c7c086f671a0b1b3f820027d

SHA1
0062d39362e66a8e06f1c192aebebd9dbd0875bd

SHA256
456fa3c51bff47935ba45ce2f4c0b9b2015e6d923f46df592c9ecbda80793a24

SHA512
41e693a8b6695b25e5be01c62222de47fa39cb4fd9dfd01a228ce405302babf85caf7e72c414c15af14a5d7a670a769032ea35ac756f20539dca2d5569f163e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
70c19f3ff3f0a6de8c7087a55d7cc0a5

SHA1
6c90ab6b468d653a8879ab16d34f78908705f9a0

SHA256
b9c1c63ff0d1184f73aac0a7139c1ed5b1ce217aa8577ea2f48d1d3015ece341

SHA512
2851f6ed5a2111d5d515194d7ade36303cfc663fe9a083e637e66369023e867e187be436ded21348a0fe8e4676656139e9e2092fb7682b81d12b76f23a226b13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
4b3860e9c1e10f9681da756588cc1a79

SHA1
7b17bc24aa2248c885e680773506da57ae5f02f5

SHA256
5aabf1421f9adca8ef342edf46b83adb0fc0a395dac375bdfb0d62a243e2e716

SHA512
11a4d5f236f777146f27c73e6ce7e68b4f0e0d95ce067f8f83e3002b05d03accde1187aa4e7b457977340f087292e627364077c42f9a7569210171a7e1aa8f91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
57b801484290eba7780d645b8a97dd1d

SHA1
b3d2778ccc5e37288f7cf9d7a88b91c0ece9ceca

SHA256
ac22762152744e74a1e7c4c2d2ae2fafc2abef12f09b409b8fff0ffd7a3551eb

SHA512
9ef19fa0f1856bcc26c8db7498a9b5aebaab36b9c58be2133de7887899095ebaf7383a0f2753507e67a2948273ba89f679bb44db5e0f8485ab7c8c96fe0c8495

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
383a4a19753dcd2868668e4e608d3847

SHA1
17a7fd573944c4da129207c1c5a712b8581d18b4

SHA256
26620d7fb1fe4f324bfda9da377ed208e87f27231904d192da74af5fd6d1abc3

SHA512
a9651487a0a54d03d94d9a85322a920988c41b254bab3af60d4d19fb595f41e746f6f7f1b7673680fead91715356e0d19c1193d3985de3a99d0fdf7392da5444

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab562D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar569D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit