General
Target

https://patriotasoilp.com.br/wp-content/och/Wp-images/?i=i&0=patrick.pogi@gmail.com

Filesize

N/A

Completed

19-05-2022 05:30

Task

behavioral2

Score
5/10
Malware Config
Signatures 7

Filter: none

Discovery
  • Detected potential entity reuse from brand google.
  • Enumerates system info in registry
    chrome.exe

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOSchrome.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturerchrome.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductNamechrome.exe
  • Suspicious behavior: EnumeratesProcesses
    chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

    Reported IOCs

    pidprocess
    2548chrome.exe
    2548chrome.exe
    4832chrome.exe
    4832chrome.exe
    4532chrome.exe
    4532chrome.exe
    4324chrome.exe
    4324chrome.exe
    2064chrome.exe
    2064chrome.exe
    1656chrome.exe
    1656chrome.exe
    4232chrome.exe
    4232chrome.exe
    3256chrome.exe
    3256chrome.exe
    3256chrome.exe
    3256chrome.exe
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    chrome.exe

    Reported IOCs

    pidprocess
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
  • Suspicious use of FindShellTrayWindow
    chrome.exe

    Reported IOCs

    pidprocess
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
  • Suspicious use of SendNotifyMessage
    chrome.exe

    Reported IOCs

    pidprocess
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
    4832chrome.exe
  • Suspicious use of WriteProcessMemory
    chrome.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4832 wrote to memory of 33684832chrome.exechrome.exe
    PID 4832 wrote to memory of 33684832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 20084832chrome.exechrome.exe
    PID 4832 wrote to memory of 25484832chrome.exechrome.exe
    PID 4832 wrote to memory of 25484832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
    PID 4832 wrote to memory of 45204832chrome.exechrome.exe
Processes 27
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://patriotasoilp.com.br/wp-content/och/Wp-images/?i=i&0=patrick.pogi@gmail.com
    Enumerates system info in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabea04f50,0x7ffabea04f60,0x7ffabea04f70
      PID:3368
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1584 /prefetch:2
      PID:2008
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1996 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:2548
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 /prefetch:8
      PID:4520
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
      PID:1640
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
      PID:4752
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4300 /prefetch:8
      PID:4348
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:4532
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:8
      PID:1896
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:4324
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5016 /prefetch:8
      PID:4728
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4336 /prefetch:8
      PID:4848
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4340 /prefetch:8
      PID:1944
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
      PID:712
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:2064
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:1656
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
      PID:2164
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2680 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:4232
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:8
      PID:4100
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
      PID:928
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
      PID:3488
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4612 /prefetch:8
      PID:2416
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5128 /prefetch:2
      Suspicious behavior: EnumeratesProcesses
      PID:3256
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
      PID:2988
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,13311500970408352573,200458119527417334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 /prefetch:8
      PID:1008
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    PID:1488
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • \??\pipe\crashpad_4832_TEURTMEUGWIZDPJR

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e