Analysis
-
max time kernel
19s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
27-06-2023 23:16
Static task
static1
Behavioral task
behavioral1
Sample
Catalogo.pdf.html
Resource
win7-20230621-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Catalogo.pdf.html
Resource
win10v2004-20230621-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Catalogo.pdf.html
-
Size
2KB
-
MD5
24c3acfe035a0322b96c3157f3bdff5c
-
SHA1
a8942661e762ee136b9e6e27aa6300bf1123783c
-
SHA256
ee1e980d7c55cae79f725bff6a0946c69f910f6a54d448d7b8867bcb7eea0ca4
-
SHA512
a1caa8b256af3d99abe972c5dd461a3711977a495b4e0ef4fdbf35b230c8fc8c7f41dc2262b445255b4e4747bdabd1e5340df43bbd30b5cc69e227d93d8a465d
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1628 chrome.exe 1628 chrome.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe Token: SeShutdownPrivilege 1628 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe 1628 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1408 1628 chrome.exe 27 PID 1628 wrote to memory of 1408 1628 chrome.exe 27 PID 1628 wrote to memory of 1408 1628 chrome.exe 27 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1376 1628 chrome.exe 29 PID 1628 wrote to memory of 1596 1628 chrome.exe 30 PID 1628 wrote to memory of 1596 1628 chrome.exe 30 PID 1628 wrote to memory of 1596 1628 chrome.exe 30 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31 PID 1628 wrote to memory of 1588 1628 chrome.exe 31
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\Catalogo.pdf.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef72c9758,0x7fef72c9768,0x7fef72c97782⤵PID:1408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1184,i,6209569334517535244,589024429451740693,131072 /prefetch:22⤵PID:1376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1184,i,6209569334517535244,589024429451740693,131072 /prefetch:82⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1184,i,6209569334517535244,589024429451740693,131072 /prefetch:82⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2320 --field-trial-handle=1184,i,6209569334517535244,589024429451740693,131072 /prefetch:12⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2328 --field-trial-handle=1184,i,6209569334517535244,589024429451740693,131072 /prefetch:12⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1388 --field-trial-handle=1184,i,6209569334517535244,589024429451740693,131072 /prefetch:22⤵PID:1048
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1716
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD51990c87925ff2c4210a8c38f9d09c95e
SHA1304f71d16cc10a39c415c9cf3cb4073baf12f884
SHA2565bb46f71a31b56a481d88d57404c4bb2c599beeaf9db1cf3fae1a0d921b77d54
SHA51286ac4a9cb686db5e41cd9279774dcabbf1d2fc9ba57707d30e1190511dae6dcabe4f490d98b02b85676dd43de7bb56b8a5f6e85b12517d3b2d1deb84710a3425
-
Filesize
4KB
MD55bb79f9de71578f73d1b81c8774201cd
SHA1dee59cbb56dabcf9410e6cba2ff63111b586a0eb
SHA2563522f7f141966a4d39b563601b26cf2b855391932732e7b4ae27b368cd0dd5cd
SHA5128a35556fc663a26f69a4a64bc67f936734c7b6aaf964eb8e1ebc196014b289eb7d459d8ae2e75bc325f87cbb9a0c7cbaaa8531b6ba30c1d8b8d8ec4123c40b62
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp
Filesize16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389