Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25-05-2023 12:21

General

  • Target

    Visualizar_Certidao_de_Protesto71260251494.html

  • Size

    640B

  • MD5

    b41664793d748ccae5995aadb6a7151b

  • SHA1

    c1144867d4a2995e7f69c02f788a7ec2d9fd1405

  • SHA256

    5b56329c1446d0ea7a6b706f6b5e8aea6a06ab934b66eeb365227655540ca2b9

  • SHA512

    142dddebe9f294e96ce2d1dbc5770e2fb46fb55b317175dd4c0c9d3afcdf1abf8c143c31fff5012f6797319d1cee0c86a2dddf4abe12dd5e2a196f4a15a6c77f

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\Visualizar_Certidao_de_Protesto71260251494.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:708
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9b7ac9758,0x7ff9b7ac9768,0x7ff9b7ac9778
      2⤵
        PID:1068
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1856 --field-trial-handle=1804,i,577169388765365745,646702896757733592,131072 /prefetch:8
        2⤵
          PID:4184
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1804,i,577169388765365745,646702896757733592,131072 /prefetch:2
          2⤵
            PID:4204
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1804,i,577169388765365745,646702896757733592,131072 /prefetch:8
            2⤵
              PID:4208
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1804,i,577169388765365745,646702896757733592,131072 /prefetch:1
              2⤵
                PID:3712
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1804,i,577169388765365745,646702896757733592,131072 /prefetch:1
                2⤵
                  PID:3004
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=852 --field-trial-handle=1804,i,577169388765365745,646702896757733592,131072 /prefetch:1
                  2⤵
                    PID:704
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1804,i,577169388765365745,646702896757733592,131072 /prefetch:8
                    2⤵
                      PID:4800
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1804,i,577169388765365745,646702896757733592,131072 /prefetch:8
                      2⤵
                        PID:5044
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4660 --field-trial-handle=1804,i,577169388765365745,646702896757733592,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1692
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:4156

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        47a71fdecfea448261504afe6a1e7646

                        SHA1

                        ec366733c5acead0dc7925cdf624a3f8649b4c5b

                        SHA256

                        6a566099266df5af24e549933ede0b82e2e8e0d2fe5477501ac2551acd7d5dda

                        SHA512

                        43b066a6ac6727e71b85af47e459655dc6daa6b4c356eee3c0ab0d4c2773696266c55c04813c2eaefd8662c56da288a2241fc3b06c6cfc3cf404ecea59328c79

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        6163a7376a17a8a1322bc70a1065e258

                        SHA1

                        52b51578cfbc50b98e4a513db0d322766c478811

                        SHA256

                        1f7e5dbe3f8a188c1fddd992884191f858fa03821b9801443ac2dfaae051e976

                        SHA512

                        03e3f8cca7814cb088012a7f0439fb5a650e2db350ebea1a8bf29704c8ed3857984bbf8db1ec99904668c53ae760145f4430c7a97aa5a788569887afba3157cd

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        24239587cf9f7aa7866895f05ba084ad

                        SHA1

                        87a491faa91091a805d32c83eb47800c6c410f77

                        SHA256

                        f5cf8ae8f173fcc95ab829ec4a5563688f6035f04fb1e240fa7b28afcfb8b9ae

                        SHA512

                        f793d06c1c3fb4fe07e211c1effb69d06538f5375a11abb59c29e615a960a74123b8d18ce5c15c456433cf938d9dd50d39c2a192e47e4ed4d1b5659072516200

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        bd13ed5cbf059ecdba38b9a83c8b1a27

                        SHA1

                        e8a2985d3a54bfa2f9e8330001dad81684a1e4e1

                        SHA256

                        698ecf44b249f816a1c76ac74c88dc1bf6239be168c05be8205f67bd6568c7ac

                        SHA512

                        68ac57dd788ce859e91e8c52fb85e2b0963487b328be248e2c4788fcf9deaf39c0e053be3d244dbdbb0b0546cad37625039c84b944f3f8e3c4469259d06f6cae

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        c5ffe346911d28507c79b0715575cf1c

                        SHA1

                        2992bcbac14b835369c14090fee4f2f9b3d0ce07

                        SHA256

                        94b62f82c63634813261a78fdec86f3a3a16ef4c17fa73b547cd66d7de180002

                        SHA512

                        fcbf4550a659d4503c01b46535847d3a032c0894c845a57d2d5d164a51671bc997ed9310b2335ce7f73958daa1c6cbc5ebdc93130495498dd5fcaa9a2290daea

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        076ada32a551f8e9bacfa4d45767900c

                        SHA1

                        6c37a0b07e0de9e5fa8df6de6b176da6977035e1

                        SHA256

                        7dedd3d3116068b58405eb3fc11000cc08dfc4b6494a6c771428bdc60647e4a5

                        SHA512

                        d6c43ec2aaf0b88f1c5d8eece9693dce5a03a0ab750e79f51de96402da17f4c206a0a049c409d58f5fca4381549f1f72bb5269acafb2f55527cdf20d499d89bf

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        153KB

                        MD5

                        bf3ef9556b3784587cc5f3b3b64b0823

                        SHA1

                        dbdb375756178c0653286056aa7d1fa8bae2bbf3

                        SHA256

                        ccd65db745493a4191c3cdad4e510422dbfa48206bf982bc352f54fb7ecfb811

                        SHA512

                        a0ce3a78df65fa47c25a181d4d14d2eeab2e895dea6a9f8fae08a7b19f447beca1a3b425d1641692867aad21ccbecc88dada6d20da0678084ca844d9deab724d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        153KB

                        MD5

                        355cb56d986f7afddcbd7293afdd5b22

                        SHA1

                        bd643792001d78bddc5c2c5fbba0cd847779caec

                        SHA256

                        6428f68853af54d626c2b51699aa41ae6d8a60c63eb95c7c3a765b74e7961ddf

                        SHA512

                        8383767e07d5962f1f0ccbbbbf07d274a1e1fa83cca5ae48f25f5180447b9a7f1c0111e954004d94e85b9eaeed1b99af6ec1936b60fd278c9109c1da615d9ed9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        153KB

                        MD5

                        79d4489d3fab015d72275aa521930939

                        SHA1

                        09bacfb07f9a705adb7271ad11a355f90b2ebc2f

                        SHA256

                        fd7caa2010b8f30f71bfc3f7d6251d29a0809e09c91211e9faa12eb54fb6f215

                        SHA512

                        7d88337609fd1754210152291628e09ea42773c92fa67a2cde84720348c68f930897c1acb3cf30d463bc91dde831a4818c34a2f3e979f2ccc2acc63eb81d7034

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd