Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2023, 12:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.comrhsolucionesintegrales.com/
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://www.comrhsolucionesintegrales.com/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133298373075439371" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2372 chrome.exe 2372 chrome.exe 1672 chrome.exe 1672 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2372 chrome.exe 2372 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2756 2372 chrome.exe 82 PID 2372 wrote to memory of 2756 2372 chrome.exe 82 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 2960 2372 chrome.exe 85 PID 2372 wrote to memory of 3828 2372 chrome.exe 86 PID 2372 wrote to memory of 3828 2372 chrome.exe 86 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87 PID 2372 wrote to memory of 100 2372 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://www.comrhsolucionesintegrales.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb396a9758,0x7ffb396a9768,0x7ffb396a97782⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1792,i,15756365850540113751,4659501618513379883,131072 /prefetch:22⤵PID:2960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1792,i,15756365850540113751,4659501618513379883,131072 /prefetch:82⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1792,i,15756365850540113751,4659501618513379883,131072 /prefetch:82⤵PID:100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1792,i,15756365850540113751,4659501618513379883,131072 /prefetch:12⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1792,i,15756365850540113751,4659501618513379883,131072 /prefetch:12⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 --field-trial-handle=1792,i,15756365850540113751,4659501618513379883,131072 /prefetch:82⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3036 --field-trial-handle=1792,i,15756365850540113751,4659501618513379883,131072 /prefetch:82⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4004 --field-trial-handle=1792,i,15756365850540113751,4659501618513379883,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3896
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD524c2ecdd7350ce7d08a932ce2f008f07
SHA16a2b6e45ad1f56bbe53cd6a080b5e8266f2cffb2
SHA256748c084dad2d30d8704ce77da65889ea36af1587be01baee787867ce0ceec3e0
SHA512ff3d2d1e50f4266b7a2fa21d477ff87418036d58f7b16096a5b28bcb7eafb81450281bfd5707a9d2a4c2c84ab5e0757623e8709255170a427178bb393642d35a
-
Filesize
6KB
MD5361a0718d55c7ea2542e7e8a1538cbe9
SHA1c09479bd2103e19e51eda5c9ad7a296fa7a8474b
SHA256f64fc27709898e0a7d9b2e802d8a54a4895ecbb249ca9c9cf2061d00e6c964cc
SHA512484cfe47294458e0d22b05ec475a6a2b812b4f865005fae5137d055dae56f9659f831b198478ad1f132d510199bb365d3a61bf0d0a767768b91b91ec353fd64b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d442c572-8d45-46d7-8cb7-c6c663407e2e.tmp
Filesize6KB
MD5643a9b136a3eac4f466ba1b1829466ca
SHA1921223bfbe3d2bc53548b6a519142b241787742e
SHA2566acf56357a5a4d8db6c5e52490227c9044705485561d6fc0c6686d0f5dfc3682
SHA512d4569ffd954831deea011caf1fe702fa60eec2de3f8029e9865e0d7a5cfc42ea4ff75a5a2c377417ed6550ccf8ebaf28badddf0b03b34ef5c4600ab093175618
-
Filesize
154KB
MD52424bedf66a88753d551afa3411caa46
SHA1b23d1a54f84c0e1bf1c3456debd6b0fbea922664
SHA2564e2a5bd177da201d21e804a6972bd886e6d7528e90515b819e2465519443d206
SHA512e33e6309a09b55815b955f0ffaf950d6fbde980a50372a699c58fd146d4fff334c906e9e6247dd04280d3ecf3f1ecf60df7c2dc7b38a15ed0ebedc4c7c3ceb36
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd