Analysis

  • max time kernel
    600s
  • max time network
    567s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2023, 14:32

General

  • Target

    http://www.8smb.short.gy/Validacion-De-Cuenta

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://www.8smb.short.gy/Validacion-De-Cuenta
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4348
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7d6a9758,0x7ffa7d6a9768,0x7ffa7d6a9778
      2⤵
        PID:2224
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:2
        2⤵
          PID:4732
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:8
          2⤵
            PID:5116
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:8
            2⤵
              PID:208
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:1
              2⤵
                PID:1820
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:1
                2⤵
                  PID:4912
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4924 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:8
                  2⤵
                    PID:2660
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:8
                    2⤵
                      PID:4068
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:8
                      2⤵
                        PID:4832
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:8
                        2⤵
                          PID:3916
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:8
                          2⤵
                            PID:2744
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1844,i,2603838528114033703,9454842966743626681,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1584
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:4008

                          Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\398a1a6e-9ba2-4f0a-adee-7f56409df2e3.tmp

                                  Filesize

                                  201KB

                                  MD5

                                  d2de44958a15b1a1f94c7b3ad3fe3a90

                                  SHA1

                                  b9f92523db75b7b651693ee6d6e05ae8aaeb7c99

                                  SHA256

                                  ea9a48e7e2386349df07c8b6999ac1b5a8636ddc8bc4bcb59872ddab0e4f3777

                                  SHA512

                                  5c8073ee3317580d2b3ced36e4e2f5985183fcf72d4c5bbd1192c1f61bc93877146c5a059001c9be2bdcb14e9ab20ed0e6581638c4e153cf0183ca9c3fa5cf5e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  90074f6aba188a0d05f66b26feaf3ac0

                                  SHA1

                                  640473ca077fb5b1bd8a085090cbecea80ec71f3

                                  SHA256

                                  c6231d452323be79f7812d2a99d7f8d88e47f8dbd9bdb9bd525cab4d3e0e0ba7

                                  SHA512

                                  83fe5f59c55923cd474a831c35dd242bca5e0bda88fe5a8619fae40c8674a4ef0ee576ecc1c40118ab864627b57056ce84efe993c6e9ee427f6bfb6aed3ec20a

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  539B

                                  MD5

                                  473abb41be73c04256f12990ea8e8d81

                                  SHA1

                                  0770fe13e511d44394a7ddc6329f1f424cdc1e7c

                                  SHA256

                                  a277d0847f88be4245cbbb6e9c6b55c6ac55fdb634abf212b2139210dc235879

                                  SHA512

                                  03a5636995a00c8b5d95b60f21781148921f51ee82ff2efa04b425cb31202fe3fb55451c46f28061f3f0966080c5296f083915b240595366c4386ec9dd39a01d

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  a19ac3b52cde44370f675718ce47f0f3

                                  SHA1

                                  ac140565643ba8de9146fecf48d79fd4ab4ae37d

                                  SHA256

                                  d8f209ebc132041437647b54c4939e642f277ea92cbc23c62fa99b1e1c097670

                                  SHA512

                                  9ea927342cb79ebf1e83b0f09ed076925a49b9d46f2aac6f359e6aefaab03edb1110932653772afd80a95513193975a2479c263d72399e4b9ab1cde2922b30fe

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                  Filesize

                                  15KB

                                  MD5

                                  34fcacecb4cae52406889594cd1d1cb7

                                  SHA1

                                  fe485786339ff81d1daa42c5a5eea3a1d9fe56cf

                                  SHA256

                                  9d959694b0b2fced91fd3c9d353f91733372d9460373c4939216abbbdc9ca022

                                  SHA512

                                  3b5bc19aee12e49613a8673dfa6bf12af4c8f97d1b4c2283c0c7e3a020dbe26133e1ad0d62aa17f2fc972bc4de0d2ac7984bc38ce68ba7f3b87064cdc00f7325

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  201KB

                                  MD5

                                  00c9076ea396256a1e6afbb7989e264c

                                  SHA1

                                  0111588a2bb5d27ba464562db621a6776027bdf5

                                  SHA256

                                  9dd04dd1d1497456ceee9251c08cce1fbe06f92aad968de865fde97f1cafffc2

                                  SHA512

                                  de918652a104a74d7539f552e1675f6a6b8c30366172f8cfd563aba9946c89cc1134b37790e6ca32a859061b1af39080282f198ae141b0d9afcaa2b3555a0b07

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  200KB

                                  MD5

                                  6ca688fd94ae4335ea6a715473090067

                                  SHA1

                                  eda506bba389526639f9c6fdac5eaa6da1119351

                                  SHA256

                                  3dc7a9c7a48ef4732a0afa7cd3b6fa5fab4bf0b8d1e779497f955ccf9f2f485d

                                  SHA512

                                  2c5a4569311f162fd9767d28e051b381ff8766102e4e3d20c07ce9b8b8bc49c66cc2746b51129d0fe611ddc5cf3c5e4807702ca9ba1c62e6ec4f373118dcbed5

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  72KB

                                  MD5

                                  6b1776e8e69a29287c1306ae506d046c

                                  SHA1

                                  054d24573f84a8e40e3f7631610f91927b1fcb0d

                                  SHA256

                                  194a65dcab9fd9a2607c1bc91a85e127e6604a59ab1ed45e25ce5ca2a280e122

                                  SHA512

                                  84361592fc3d221cc176d0233f3270b30d6e152636962e6240e6744a96402b607342ea729166d9eb976e43a757218b0b95465012980d8480b244d07116d1190c

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd