Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    160s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 23:33

General

  • Target

    https://analyticsinhr.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3d3cuYWloci5jb20lMkZibG9nJTJGaHJtLWJvb2tzJTJGJTNGdXRtX3NvdXJjZSUzRGFjdGl2ZWNhbXBhaWduJTI2dXRtX21lZGl1bSUzRGVtYWlsJTI2dXRtX2NhbXBhaWduJTNEd2Vla2x5LW5ld3NsZXR0ZXIlMjZ1dG1fY29udGVudCUzRG5ld3NsZXR0ZXJfd2Vla18zXzIwMjQlMjZ1dG1fc291cmNlJTNEQWN0aXZlQ2FtcGFpZ24lMjZ1dG1fbWVkaXVtJTNEZW1haWwlMjZ1dG1fY29udGVudCUzRCUyNUYwJTI1OUYlMjU5MyUyNTlBJTJCMTclMkJNdXN0LVJlYWQlMkJIUiUyQkJvb2tzJTJCJTI1MkIlMkJQZW9wbGUlMkJBbmFseXRpY3MlMkJSZXNvdXJjZSUyQkxpYnJhcnklMjZ1dG1fY2FtcGFpZ24lM0ROZXclMkJXZWVrbHklMkJVcGRhdGUlMkIlMjU3QyUyQjIwMjMlMkIlMjU3QyUyQldlZWslMkIzNA==&sig=3KRew3feAbsCnWknkAFcUTgfkWmTe2D4QWDUWY4can9U&iat=1706111962&a=%7C%7C223476493%7C%7C&account=analyticsinhr.activehosted.com&email=XZsagAvnb7p%2BJsdif4qbWWqNNCcnsjrSew%2F%2FIiBRy6skSC5sdxPNeUVFjVI%3D%3A%2BRikO4kTfNckr7DSDolWfofC4Sr7UH%2Fs&s=caa78d711163a13a389de1c073586609&i=1939A5776A84A32216

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://analyticsinhr.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3d3cuYWloci5jb20lMkZibG9nJTJGaHJtLWJvb2tzJTJGJTNGdXRtX3NvdXJjZSUzRGFjdGl2ZWNhbXBhaWduJTI2dXRtX21lZGl1bSUzRGVtYWlsJTI2dXRtX2NhbXBhaWduJTNEd2Vla2x5LW5ld3NsZXR0ZXIlMjZ1dG1fY29udGVudCUzRG5ld3NsZXR0ZXJfd2Vla18zXzIwMjQlMjZ1dG1fc291cmNlJTNEQWN0aXZlQ2FtcGFpZ24lMjZ1dG1fbWVkaXVtJTNEZW1haWwlMjZ1dG1fY29udGVudCUzRCUyNUYwJTI1OUYlMjU5MyUyNTlBJTJCMTclMkJNdXN0LVJlYWQlMkJIUiUyQkJvb2tzJTJCJTI1MkIlMkJQZW9wbGUlMkJBbmFseXRpY3MlMkJSZXNvdXJjZSUyQkxpYnJhcnklMjZ1dG1fY2FtcGFpZ24lM0ROZXclMkJXZWVrbHklMkJVcGRhdGUlMkIlMjU3QyUyQjIwMjMlMkIlMjU3QyUyQldlZWslMkIzNA==&sig=3KRew3feAbsCnWknkAFcUTgfkWmTe2D4QWDUWY4can9U&iat=1706111962&a=%7C%7C223476493%7C%7C&account=analyticsinhr.activehosted.com&email=XZsagAvnb7p%2BJsdif4qbWWqNNCcnsjrSew%2F%2FIiBRy6skSC5sdxPNeUVFjVI%3D%3A%2BRikO4kTfNckr7DSDolWfofC4Sr7UH%2Fs&s=caa78d711163a13a389de1c073586609&i=1939A5776A84A32216
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe34879758,0x7ffe34879768,0x7ffe34879778
      2⤵
        PID:5048
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:2
        2⤵
          PID:1644
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:8
          2⤵
            PID:4672
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:8
            2⤵
              PID:4064
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2800 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:1
              2⤵
                PID:3888
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2792 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:1
                2⤵
                  PID:1208
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:8
                  2⤵
                    PID:4836
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:8
                    2⤵
                      PID:4816
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5296 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:1
                      2⤵
                        PID:4204
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3824 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:1
                        2⤵
                          PID:3152
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4312
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4044

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020

                          Filesize

                          201KB

                          MD5

                          c445ab4315d0633d446998c80764cc36

                          SHA1

                          47d3dee9845cc6e29b6771dd6560793b8b93000e

                          SHA256

                          5635695eeb70b51c449aea7a5bd3c9699c3c28c64498fb7fcb8173aad45d7242

                          SHA512

                          83a32ffdddf3ee56e89f232c8d05a4b00265895b0e41d13700f90fa389f0bf3f112c291c24c3819751803322b11e2ff866971d835d601672b36818c4e099bff1

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          1KB

                          MD5

                          044d363c4c56e4b863c9f44001b98cd6

                          SHA1

                          bff097972db7071b938707688e4a3537637ce7d7

                          SHA256

                          50989fe0a41a3a4ad2473ad210cdbdd7a9430b6468848afee407b199ad9ee940

                          SHA512

                          93f566f81809a82c71e4b5943b4587ebcc5f0ac6154817625173135b3713e5de5b5979202cdaaa55f863a70415101323bba0e9ef8d2f9f0e06ae1341826765cf

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\248ef447-8fbd-4fd1-8235-7ed8d18ec224.tmp

                          Filesize

                          2KB

                          MD5

                          658c617aebd225da02543a5d1c7a3a05

                          SHA1

                          20e597234e9d64cd3535cedd33d822c8a96086f5

                          SHA256

                          80234354ea82218bf5059c5d78632d10d0496b6b72e343899544098628ca44d3

                          SHA512

                          b8d49db206191dfcaf06e7c3206bde44826b926dd5869d43006e98c5de9589cc499ec909485d17351724e7dee0b63c391c3c209e43ece42dcaecf491f0fae54a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          5KB

                          MD5

                          9327add07b1a6c497735de290dffdde1

                          SHA1

                          2f787d7463a9a394dcd7f755c51bfd559376875c

                          SHA256

                          d46f909350e8bb59b862c5f5d668c14325e75fa2c9af82f5dc85c4af839f9ed9

                          SHA512

                          2bddb2cc6b3b33a469c06e92b50497ddaeefca0d10d5da565e1538de86f600b7cd9edb318c7ace59f92c53e00ff1376309a34148a848fe5c335d430a6dc00966

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          5KB

                          MD5

                          15c05d87880bef7e2b4b5d5f3a8939c2

                          SHA1

                          c734cd05f65aad04e67983c81dda5310cae07167

                          SHA256

                          a68b1de6f799879b6babefc20787c4a98bf4c447dfa53a74690900123e8338ed

                          SHA512

                          efb658a69518fc52ffad10e90337cadc0d3ef02b3204d819c63ae2c51293bc85784024d6d03ca12756745012c33ab743070d16c943b6413e6a03b3cf413fa167

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          2KB

                          MD5

                          c0a9f6a6e5d5e9a631567c507772407d

                          SHA1

                          aeeb92adfa9baa616a0ba3e7200557827b3279cd

                          SHA256

                          8b2f4fb7fc3386ac6c439af90ea139c40f334add0d35aa0928d7b602fd356613

                          SHA512

                          c04d21efe6b0da1aca9c9276fd6f55b917703d6225d9dec97920f2b6103627fc994055b891d744a580df372b511e225de226bafec8e0fd72d38acf559ed51ebf

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          b9a97f60ccc1d9d60ecc4c3c3ebc8819

                          SHA1

                          24bdce47b3b13f62800ac656a0738b5f7c43738a

                          SHA256

                          ee8fd68b5d36fceb4db019f2c2707e2c0833931157de7555520e902b653550dc

                          SHA512

                          73f9feb2265eb08d51fa53ebc013f59a8a0f50449758876acf41bb3137f89d1c3e92d5a6648b853122ec9a0d79a3345db7e85cdd718e30b7f743665ac29fcf6a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          2KB

                          MD5

                          4b87c83a366fb936ec2ddd261b617942

                          SHA1

                          cf54bbeee06ad9d747e08a243565500287d7c4ae

                          SHA256

                          8ad48868ca919b8b21cc9f8e7efd9f623e2a537e64260c0a6e4aed683fa10d85

                          SHA512

                          9c340b90691d96c8c3aaa9036f70ea09d85df78fdf619b61aff115e8bac05e184af26f8fad9a37b51abca267f0e00cfb81e7156f8e9fb8d2fa57eb25fee42468

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          2631489a38c63289367b60f85d89209a

                          SHA1

                          0b33fa2c52f9229244b86c9d8a0c316406cb89d0

                          SHA256

                          a65ad7184ea94979554f7395e13ced872e482f03c63596ba6fffb5bfa59a15c1

                          SHA512

                          b4f39b1ccd1b0f53b3af8232752bf43a730a3f08f0f9daa87813c4349cbcd73c21758765214590b93460d1b54bd66248dc4c351080da2e7841385234297a2b35

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                          Filesize

                          96B

                          MD5

                          96079a41ee72f8156b4495754f4e1c76

                          SHA1

                          bdbe136419b6be463ea9318e8e028eaf559da8a1

                          SHA256

                          3dd76a3a5ec669f8dc1aadf4c3d50f8fb83fdc24d25fcbb1ca4f1ff64ace8756

                          SHA512

                          1c4000a5be059a6f53fbc9b441b6a8c5b6ea5ad38341496583c2d2a08bb2eeb5da9c01c2d2dac06507b6d5450c1cfbe38ee3f9ef413011b4c2af03468d810c95

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583795.TMP

                          Filesize

                          48B

                          MD5

                          75164042787f9b1ea6bdd0de3610ce19

                          SHA1

                          aaf3f87f9d855992dc946b3ae847a5a63a6aa091

                          SHA256

                          0b23d54dcae8167d3531238097784ae576584513d2e7a9e0653b1d22ec597f8a

                          SHA512

                          f863750e47623634864174299488686efbd9bc29b8fab39a5a004b81575f3e7901eea3c3ae59fc6ade305dfa9b45267efe5365f25db11f45f9d5e43df04674b9

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          114KB

                          MD5

                          30e3b779358ea82de0ef6f61c7d6a496

                          SHA1

                          c7902e1d10528384cbff533f795fe2ce48922d6e

                          SHA256

                          115fbbf10b19156e656509ce9e1903a62473842f4dc31cd91d0cf4a7e6efc67e

                          SHA512

                          21528f89c2bdbaa8cc7395d952d5e16eb9ff8345c1cc3b4a9511e2d57fc9500b637e9f83ca21706bd45ad6bcf562ce8b0b8c869a82fe3261201f4790cf795c56

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd