hxxps://app[.]embluemail[.]com/Confirm/PedidoDesuscripcion_ES[.]html?data=QURj1%2BqWbk%2Bcv6EfXfD5VK1TKs%2BfvdoOqpi6czSft8w17jtAu2ccoPRzFlRe8YjWCph%2BXrJlQZKAl%2BCX5uRXUA%3D%3D!-!FMcDQnRF44ZlEnLKSTo5JiOWduHVB0OWskpEMlbbe7Tlq1BE41NpJtVdX3b9dLb/

Analysis

max time kernel
300s
max time network
288s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2023, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://app.embluemail.com/Confirm/PedidoDesuscripcion_ES.html?data=QURj1%2BqWbk%2Bcv6EfXfD5VK1TKs%2BfvdoOqpi6czSft8w17jtAu2ccoPRzFlRe8YjWCph%2BXrJlQZKAl%2BCX5uRXUA%3D%3D!-!FMcDQnRF44ZlEnLKSTo5JiOWduHVB0OWskpEMlbbe7Tlq1BE41NpJtVdX3b9dLb/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133336486505918412"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
60	chrome.exe
60	chrome.exe
1016	chrome.exe
1016	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
60	chrome.exe
60	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe
Token: SeShutdownPrivilege	60	chrome.exe
Token: SeCreatePagefilePrivilege	60	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe
60	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 2552	60	chrome.exe	84
PID 60 wrote to memory of 2552	60	chrome.exe	84
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 4224	60	chrome.exe	88
PID 60 wrote to memory of 1284	60	chrome.exe	89
PID 60 wrote to memory of 1284	60	chrome.exe	89
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90
PID 60 wrote to memory of 2492	60	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://app.embluemail.com/Confirm/PedidoDesuscripcion_ES.html?data=QURj1%2BqWbk%2Bcv6EfXfD5VK1TKs%2BfvdoOqpi6czSft8w17jtAu2ccoPRzFlRe8YjWCph%2BXrJlQZKAl%2BCX5uRXUA%3D%3D!-!FMcDQnRF44ZlEnLKSTo5JiOWduHVB0OWskpEMlbbe7Tlq1BE41NpJtVdX3b9dLb/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff03b69758,0x7fff03b69768,0x7fff03b69778
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1840,i,4694524671994550749,5898731752872411748,131072 /prefetch:2
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1840,i,4694524671994550749,5898731752872411748,131072 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1840,i,4694524671994550749,5898731752872411748,131072 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1840,i,4694524671994550749,5898731752872411748,131072 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1840,i,4694524671994550749,5898731752872411748,131072 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1840,i,4694524671994550749,5898731752872411748,131072 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1840,i,4694524671994550749,5898731752872411748,131072 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2772 --field-trial-handle=1840,i,4694524671994550749,5898731752872411748,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
fed70fc2c168e29fc01c268d292bdcba

SHA1
6035e35e69e8c700d1b35a64d93c1b46f98824c6

SHA256
0f9eef692cebcb3bd55a272ade63a0534bba685c2b30a88b94695c09674440f8

SHA512
57356410be535d3d22d943107ef0f8e2695bc6d8568e8afc7f0ef3244112b2e49ade301fffb4de149056384fa649329c6f20462e202f5765b54ddad547471883

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
2d15d2296d01cd61bfbc12e2f8e139b0

SHA1
e9f237bf3c0c0acee493a4d639aa16a0c8b75f99

SHA256
0284e2c625a8023772fc412055dfc68ee53df62b01038eb6e638a5611163e09f

SHA512
20c55c1c9a3e2331dde3ffa8e49766fccb2485e656b9bf2f5ceacf91a450403b545e3a0e0d2e553b739161750ec241cfdb8f9f7b297864481ee7052d292f5be2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
bfc8bc2e89859363a06d634ca150019e

SHA1
e49340e095ea2b2a47eef5a7726fb5061f155825

SHA256
91f68c5b6609d35ce82d7bd26468c91fd7ec5f0dd49dab8965fe7c6441b1de01

SHA512
da8cdb211b3460d0fddf72e0589ec496d063d3a3cf797d8863c33a40299fbe10e9559f905480d3fb80f77bc4798d164162b279c199bf11753c37ec1a8dda838a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6b7bfe0d9b28208ede8fd262c7149a23

SHA1
03419c53d3935cba29ffd4f0ea3bdadf6a76ddfc

SHA256
781404f60a78ceb8f160fc7ca5fc95f88cc016cbe1d1d0b229693db97908aa04

SHA512
917d736479491e490cb06fd3e71347a0baa1e593d5186dcb535ac8b15de7d5b30300b8394a91d88ddeb82d278e33de5f8b5425793e3fb2e9e56aa0d20534e452

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fe556091-04c3-4b8f-bfb3-f52093d55f8a.tmp

Filesize
5KB

MD5
11dc7dbabdd7df84660e362a9081e55e

SHA1
cad1e878abb3df3a808840f1a063d9af76eabf1e

SHA256
78d143fcae7b2ee298507306df1fb961bca47c8a0c019ac562a5c1e81bf2415b

SHA512
74a69bc889aff6d9ae2c330ffb5528028b45bccef7f3a9742d412effad73a0e9e09d99862db8205c1d757000730a54523aeb64119e166bd612d1e69d3b2eb399

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
21eff43d3f633487e20afefb05a3f23c

SHA1
7fbbb0258223a89e45a98a5618e971a68fa86f9d

SHA256
62c8ce1db73bc116cc0366c0c115722d6677af7555f98625c91a93f122a1bbcc

SHA512
e956b543593623a641237b7760ef673c8c5df9310ccdf79bba7f68554473c361522e61853939dca3cbe760a1075df7debd2c494d780ed3eb285d4c7dd3afc6d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit