Resubmissions
22-01-2023 19:41
230122-yeeybshe98 1022-01-2023 19:30
230122-x716lahe43 822-01-2023 19:26
230122-x5qxvabd3t 6Analysis
-
max time kernel
400s -
max time network
409s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2023 19:41
Static task
static1
General
-
Target
email-html-1.html
-
Size
3KB
-
MD5
f0fe336642eeaa0c37b7094fd1494905
-
SHA1
69e61a0c83aa7603e4b09e3070da6f17548402d6
-
SHA256
47c1a0979af792d31e74f1159ca97836d3bf8f3ac37e2bec940aa93aa1eda6a1
-
SHA512
b187364e4150b18ac90d306d4ba04eecdb24f16f0c06e4e42c1c36f50ecacbcc6ac10440d6575e78bdb75e92b1f5cc6a5c53a6ab5a5b24411029c011092d4886
Malware Config
Extracted
bandook
bomes.ru
Signatures
-
Bandook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/3992-146-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/3992-147-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/3052-155-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/3052-156-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Executes dropped EXE 5 IoCs
Processes:
ChromeRecovery.exeFACTURA_SOLICITADA1.exeFACTURA_SOLICITADA1.exeFACTURA_SOLICITADA1.exeFACTURA_SOLICITADA1.exepid process 4100 ChromeRecovery.exe 1692 FACTURA_SOLICITADA1.exe 3588 FACTURA_SOLICITADA1.exe 3460 FACTURA_SOLICITADA1.exe 368 FACTURA_SOLICITADA1.exe -
Processes:
resource yara_rule behavioral1/memory/3992-144-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/3992-145-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/3992-146-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/3992-147-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/3052-155-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/3052-156-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FACTURA_SOLICITADA1.exedescription pid process target process PID 3588 set thread context of 3052 3588 FACTURA_SOLICITADA1.exe msinfo32.exe -
Drops file in Program Files directory 7 IoCs
Processes:
elevation_service.exedescription ioc process File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_211445565\ChromeRecoveryCRX.crx elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_211445565\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_211445565\ChromeRecovery.exe elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_211445565\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_211445565\manifest.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_211445565\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_211445565\_metadata\verified_contents.json elevation_service.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exemsinfo32.exepid process 4504 chrome.exe 4504 chrome.exe 3376 chrome.exe 3376 chrome.exe 5068 chrome.exe 5068 chrome.exe 4112 chrome.exe 4112 chrome.exe 812 chrome.exe 812 chrome.exe 1816 chrome.exe 1816 chrome.exe 4988 chrome.exe 4988 chrome.exe 3304 chrome.exe 3304 chrome.exe 4920 chrome.exe 4920 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4008 chrome.exe 4008 chrome.exe 3992 msinfo32.exe 3992 msinfo32.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
chrome.exepid process 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
7zG.exedescription pid process Token: SeRestorePrivilege 2564 7zG.exe Token: 35 2564 7zG.exe Token: SeSecurityPrivilege 2564 7zG.exe Token: SeSecurityPrivilege 2564 7zG.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
Processes:
chrome.exe7zG.exepid process 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 2564 7zG.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3376 wrote to memory of 640 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 640 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4580 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4504 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4504 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe PID 3376 wrote to memory of 4444 3376 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcac2f4f50,0x7ffcac2f4f60,0x7ffcac2f4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1676 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2036 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4348 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4800 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4764 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5108 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1624 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3844 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5752 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5168 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5728 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1428 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=988 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4984 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1432 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9945052118865209796,7420360719873311934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4936 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap3908:100:7zEvent191021⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_211445565\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_211445565\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={ca24ecd7-5f2a-488a-a922-527309a2f9e4} --system2⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe"C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe"1⤵
- Executes dropped EXE
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exeC:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe ooooooooooooooo2⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe"C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
-
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exeC:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe ooooooooooooooo2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4508_211445565\ChromeRecovery.exeFilesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exeFilesize
2.6MB
MD56570630f7d586a4e603f2080fa66025c
SHA1bd9820d4c0d6b4abcbcaf9e11440d856b7752764
SHA25619a125871b86cb2b1cdafc7bbc93715c574edefd8ea8676022e81205dc311166
SHA51236187161ce0a77a71f91f672eb2b6cd8ff5f38bfd6408889883b86f82c5861e9fefe5eb9bbf2b7a51b66b7ee6cc58e854e166fdcc95fbf355d6fd8aaf8649d6f
-
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exeFilesize
2.6MB
MD56570630f7d586a4e603f2080fa66025c
SHA1bd9820d4c0d6b4abcbcaf9e11440d856b7752764
SHA25619a125871b86cb2b1cdafc7bbc93715c574edefd8ea8676022e81205dc311166
SHA51236187161ce0a77a71f91f672eb2b6cd8ff5f38bfd6408889883b86f82c5861e9fefe5eb9bbf2b7a51b66b7ee6cc58e854e166fdcc95fbf355d6fd8aaf8649d6f
-
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exeFilesize
2.6MB
MD56570630f7d586a4e603f2080fa66025c
SHA1bd9820d4c0d6b4abcbcaf9e11440d856b7752764
SHA25619a125871b86cb2b1cdafc7bbc93715c574edefd8ea8676022e81205dc311166
SHA51236187161ce0a77a71f91f672eb2b6cd8ff5f38bfd6408889883b86f82c5861e9fefe5eb9bbf2b7a51b66b7ee6cc58e854e166fdcc95fbf355d6fd8aaf8649d6f
-
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exeFilesize
2.6MB
MD56570630f7d586a4e603f2080fa66025c
SHA1bd9820d4c0d6b4abcbcaf9e11440d856b7752764
SHA25619a125871b86cb2b1cdafc7bbc93715c574edefd8ea8676022e81205dc311166
SHA51236187161ce0a77a71f91f672eb2b6cd8ff5f38bfd6408889883b86f82c5861e9fefe5eb9bbf2b7a51b66b7ee6cc58e854e166fdcc95fbf355d6fd8aaf8649d6f
-
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exeFilesize
2.6MB
MD56570630f7d586a4e603f2080fa66025c
SHA1bd9820d4c0d6b4abcbcaf9e11440d856b7752764
SHA25619a125871b86cb2b1cdafc7bbc93715c574edefd8ea8676022e81205dc311166
SHA51236187161ce0a77a71f91f672eb2b6cd8ff5f38bfd6408889883b86f82c5861e9fefe5eb9bbf2b7a51b66b7ee6cc58e854e166fdcc95fbf355d6fd8aaf8649d6f
-
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.rarFilesize
1.9MB
MD5d7b1f46591973af7b434d5d9a27472f4
SHA13883bcd250e1fe5f2270afe6534eb3502e34b176
SHA256a69178f4f570bf140a5def281b614c6dd52f3f748e22c152c9b040ef10d0ef5e
SHA5126a139ee07f667633035a2bec2fd14e1d7add6a7bc4aa06de89fdd03af51aa03036321432fa9a2b598cf3079398775c40df6839e846134e43fcfaacd7ab07aa14
-
\??\pipe\crashpad_3376_JXROCFWRBFCQWREMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/368-148-0x0000000000000000-mapping.dmp
-
memory/3052-156-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3052-155-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3052-150-0x0000000000000000-mapping.dmp
-
memory/3460-141-0x0000000000000000-mapping.dmp
-
memory/3992-147-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3992-146-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3992-145-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3992-144-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3992-143-0x0000000000000000-mapping.dmp
-
memory/4100-137-0x0000000000000000-mapping.dmp