Analysis
-
max time kernel
600s -
max time network
567s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2023, 14:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.8smb.short.gy/Validacion-De-Cuenta
Resource
win10v2004-20230220-en
General
-
Target
http://www.8smb.short.gy/Validacion-De-Cuenta
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133263091763542527" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 1584 chrome.exe 1584 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4348 chrome.exe 4348 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4348 wrote to memory of 2224 4348 chrome.exe 85 PID 4348 wrote to memory of 2224 4348 chrome.exe 85 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 4732 4348 chrome.exe 86 PID 4348 wrote to memory of 5116 4348 chrome.exe 87 PID 4348 wrote to memory of 5116 4348 chrome.exe 87 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88 PID 4348 wrote to memory of 208 4348 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://www.8smb.short.gy/Validacion-De-Cuenta1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7d6a9758,0x7ffa7d6a9768,0x7ffa7d6a97782⤵PID:2224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:22⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:82⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:82⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:12⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:12⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4924 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:82⤵PID:2660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:82⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:82⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:82⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:82⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1584
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4008
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201KB
MD5d2de44958a15b1a1f94c7b3ad3fe3a90
SHA1b9f92523db75b7b651693ee6d6e05ae8aaeb7c99
SHA256ea9a48e7e2386349df07c8b6999ac1b5a8636ddc8bc4bcb59872ddab0e4f3777
SHA5125c8073ee3317580d2b3ced36e4e2f5985183fcf72d4c5bbd1192c1f61bc93877146c5a059001c9be2bdcb14e9ab20ed0e6581638c4e153cf0183ca9c3fa5cf5e
-
Filesize
1KB
MD590074f6aba188a0d05f66b26feaf3ac0
SHA1640473ca077fb5b1bd8a085090cbecea80ec71f3
SHA256c6231d452323be79f7812d2a99d7f8d88e47f8dbd9bdb9bd525cab4d3e0e0ba7
SHA51283fe5f59c55923cd474a831c35dd242bca5e0bda88fe5a8619fae40c8674a4ef0ee576ecc1c40118ab864627b57056ce84efe993c6e9ee427f6bfb6aed3ec20a
-
Filesize
539B
MD5473abb41be73c04256f12990ea8e8d81
SHA10770fe13e511d44394a7ddc6329f1f424cdc1e7c
SHA256a277d0847f88be4245cbbb6e9c6b55c6ac55fdb634abf212b2139210dc235879
SHA51203a5636995a00c8b5d95b60f21781148921f51ee82ff2efa04b425cb31202fe3fb55451c46f28061f3f0966080c5296f083915b240595366c4386ec9dd39a01d
-
Filesize
6KB
MD5a19ac3b52cde44370f675718ce47f0f3
SHA1ac140565643ba8de9146fecf48d79fd4ab4ae37d
SHA256d8f209ebc132041437647b54c4939e642f277ea92cbc23c62fa99b1e1c097670
SHA5129ea927342cb79ebf1e83b0f09ed076925a49b9d46f2aac6f359e6aefaab03edb1110932653772afd80a95513193975a2479c263d72399e4b9ab1cde2922b30fe
-
Filesize
15KB
MD534fcacecb4cae52406889594cd1d1cb7
SHA1fe485786339ff81d1daa42c5a5eea3a1d9fe56cf
SHA2569d959694b0b2fced91fd3c9d353f91733372d9460373c4939216abbbdc9ca022
SHA5123b5bc19aee12e49613a8673dfa6bf12af4c8f97d1b4c2283c0c7e3a020dbe26133e1ad0d62aa17f2fc972bc4de0d2ac7984bc38ce68ba7f3b87064cdc00f7325
-
Filesize
201KB
MD500c9076ea396256a1e6afbb7989e264c
SHA10111588a2bb5d27ba464562db621a6776027bdf5
SHA2569dd04dd1d1497456ceee9251c08cce1fbe06f92aad968de865fde97f1cafffc2
SHA512de918652a104a74d7539f552e1675f6a6b8c30366172f8cfd563aba9946c89cc1134b37790e6ca32a859061b1af39080282f198ae141b0d9afcaa2b3555a0b07
-
Filesize
200KB
MD56ca688fd94ae4335ea6a715473090067
SHA1eda506bba389526639f9c6fdac5eaa6da1119351
SHA2563dc7a9c7a48ef4732a0afa7cd3b6fa5fab4bf0b8d1e779497f955ccf9f2f485d
SHA5122c5a4569311f162fd9767d28e051b381ff8766102e4e3d20c07ce9b8b8bc49c66cc2746b51129d0fe611ddc5cf3c5e4807702ca9ba1c62e6ec4f373118dcbed5
-
Filesize
72KB
MD56b1776e8e69a29287c1306ae506d046c
SHA1054d24573f84a8e40e3f7631610f91927b1fcb0d
SHA256194a65dcab9fd9a2607c1bc91a85e127e6604a59ab1ed45e25ce5ca2a280e122
SHA51284361592fc3d221cc176d0233f3270b30d6e152636962e6240e6744a96402b607342ea729166d9eb976e43a757218b0b95465012980d8480b244d07116d1190c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd