Analysis
-
max time kernel
109s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2023, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
Encuesta de Satisfaccion al Cliente.eml
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
email-html-2.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
email-plain-1.txt
Resource
win10v2004-20230221-en
Behavioral task
behavioral4
Sample
survey_es_final.png
Resource
win10v2004-20230220-en
General
-
Target
email-html-2.html
-
Size
4KB
-
MD5
f3e6de185124092cb2a7336601842b6d
-
SHA1
35405ba0a6637cab4569a3e8c56292d4027b6c0e
-
SHA256
331a7d82d4234bc7501a41a94e005438d2860555a059c07d3df7ec4555e94162
-
SHA512
068b9cc2b8919a2a35de058325f34abb6260a419406c9c240ed6a18d3c8c845eed66cc715c47e8919a13019dd31d36569d651ef7d4844986ccbd526324eacb47
-
SSDEEP
96:hPGsxhxL+oASpt4zchkGol8pf54psl0fLCwmUnsDfLflpkl9lMsDfLfsOfsw:8sxhxL+oASrychkGVf54pGamSnsDlpu/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133239162502493700" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4688 chrome.exe 4688 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 1164 4688 chrome.exe 86 PID 4688 wrote to memory of 1164 4688 chrome.exe 86 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 4188 4688 chrome.exe 87 PID 4688 wrote to memory of 1108 4688 chrome.exe 88 PID 4688 wrote to memory of 1108 4688 chrome.exe 88 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89 PID 4688 wrote to memory of 3668 4688 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\email-html-2.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffff7219758,0x7ffff7219768,0x7ffff72197782⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:22⤵PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:82⤵PID:1108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:82⤵PID:3668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:12⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:12⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:82⤵PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4928 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:82⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:82⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4908 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:12⤵PID:380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3792 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:12⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2840 --field-trial-handle=1828,i,13104810488805204593,11180201285430058328,131072 /prefetch:12⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
840B
MD5f7dce1aff8e3fbad7f2ffe834ef1ab32
SHA1266483bf19f2debbe63251f564f062f5f8762414
SHA2569450e2b805aa28361903e16a836acbb4ea8b4ef950988355afa63c6af03ec336
SHA512c290628af4ad5d9342db1d92c08ccf77bb049f704e4c952f0db37320674158f8e73e07b16004fd415aefb8946aa1f210546cab5992b9c854f0e4521146e222cd
-
Filesize
3KB
MD51bbc5c47298c0394346c606a3c00ab97
SHA17a5acf23592c00d45aef267c2bde9c1d334a19e5
SHA2565a98d88f26a9d994731f17d9fb351d7c7d4749f09c498adb495aa6430da1cdd6
SHA512d42d447e24c38057b2956305dba9847870e183ac71f6a11314c6c01282602861e14df20adcb2f9daca3976ef7b18e8d7e23d6c6a46b06025e3e3055b966034aa
-
Filesize
1KB
MD5ada12985826367a79603863166f9107c
SHA1555b72cd7fa51d2ce4e7fbdc5e2ddde044feeebf
SHA2560edf2e4cc97797860fd07771bb24a03bb6f57a8da47becba0184eaa0136b3d6b
SHA5122e3a7d7c66ec09db00a0c2305f91dbb28c62bc3bca53cfcbf2e517ea716f946983d78b5deea0c662329b0a2da350744195f370f3b90746c90d24d93a2fa23186
-
Filesize
1KB
MD5e3d3169452b5744a17f3656373caa6df
SHA11875c4226b18a8995cf3687df08efe560821f4cb
SHA256d7ccd4184c6220a4254b2add5f91e6de942fef8f7e52313eda391b85f468b1cb
SHA512a676fefea10c0dab201a426b7c52c332f7e9ca42a802c59a02cc31cc3a3185c539d28ca7f2347062e7c04e5163581514f3cc94d6402ab031cae5275ee3298bbb
-
Filesize
6KB
MD579c3a42d21efabf7684ed9a0c04f599f
SHA1670c46743635180be5eee9d14b295d762a7c2285
SHA2563002f531f5fe23ddc344565b0f05fca25a61633888f8381c8be45e06a474806d
SHA5129529c1dbf28822d2f97a1c93a3da6f8146e248ed2ed7ae319f348407c42abdfead7ea7c98617c96905d663a22ad4c0fc6f91344ee6d5421676c820202d383aa5
-
Filesize
6KB
MD54026caf3b875abc6b4b3d38427f108b4
SHA1b560fe3440850cd8318f4f841db1319e4d616360
SHA2568389e902e9840e7d53756f3f1c2b9476f4ddd669eb175acbc4c9a067903dab6d
SHA5121f2eced03d9cbfd167bf0505727cac56f428d8d40b89f88ff43039868625b0bcfedc031ebe2952443fb0affc54726210127bc9fd7a8daf102e819305d82b1e9b
-
Filesize
15KB
MD59412b0d52fed597e010ec851eeee2373
SHA186adfca1ca04cc9e53c625ae618682b68a30520b
SHA2563e510c66593b1e6c8a330c60ccd6b12e109c12f8afc42566719541fbaf7fcb5a
SHA51214603ee1acd6f2aea1b71bad2a584f9c1ee2fe4ca03443e1d60c9e7e523e95754d7065c1de24e61a0d634551c7e2ab8e035a4b04375e6ce699a5354f132cb1f7
-
Filesize
144KB
MD5824b89e690a43c3da0256de88c272580
SHA1b54dc452e7727dd6f47eca5025896b6d708f948d
SHA25673f7707d5eed18634f8c096ff8323fcc7dd9acce040594b95d5259956dc2de89
SHA512d74fac3ed2a5c2c63ff2ec944277613980494c24d612bb4b4848dfc04c3145010e599a99a0f727bb030a54623499851ab7bf90255394a8180a4b07fc8e02f3e3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd