hxxp://click[.]grupoficohsa[.]com[.]gt/t/gfH1AAibWbMIJ~QGY0uSRrCOH~aF3jGNEKlaaaaBhBSMLXGqaaCOH~F3j?l=OLU~25zKs8s8sCu9s8xAsE091Dy~25As~25F4~25AsIAL2~25AsVAVFMLb6~25A4~25AsUGZ2T6a~25u8JW5ZAOMMR~25As~25F4~25AsAuDwCtHx8s9s9~25u8~25zK~25u84ikpTiUs~25u88ikwdqfi~25u84tS0akS~25Asda0S~25As~25F4~25As9y~25As~25F4~25As8z~25As~25F4~25AsAsAv~25As~25F4~25As8s8s8wAt8sDu8yGtHxE_L~25As~25F4~25AsOMILMEIDI~amp;V=ifugzStW~25Cs0S1[.]YwT[.]ol~amp;n=Svewjidm~25w8kil[.]ogj[.]Y1~amp;d=JvF~amp;p=~amp;z=~23

Analysis

max time kernel
12s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02-08-2023 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://click.grupoficohsa.com.gt/t/gfH1AAibWbMIJ~QGY0uSRrCOH~aF3jGNEKlaaaaBhBSMLXGqaaCOH~F3j?l=OLU~25zKs8s8sCu9s8xAsE091Dy~25As~25F4~25AsIAL2~25AsVAVFMLb6~25A4~25AsUGZ2T6a~25u8JW5ZAOMMR~25As~25F4~25AsAuDwCtHx8s9s9~25u8~25zK~25u84ikpTiUs~25u88ikwdqfi~25u84tS0akS~25Asda0S~25As~25F4~25As9y~25As~25F4~25As8z~25As~25F4~25AsAsAv~25As~25F4~25As8s8s8wAt8sDu8yGtHxE_L~25As~25F4~25AsOMILMEIDI~amp;V=ifugzStW~25Cs0S1.YwT.ol~amp;n=Svewjidm~25w8kil.ogj.Y1~amp;d=JvF~amp;p=~amp;z=~23

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133354728252650560"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4380	4716	chrome.exe	20
PID 4716 wrote to memory of 4380	4716	chrome.exe	20
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 1048	4716	chrome.exe	87
PID 4716 wrote to memory of 4580	4716	chrome.exe	85
PID 4716 wrote to memory of 4580	4716	chrome.exe	85
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86
PID 4716 wrote to memory of 1636	4716	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://click.grupoficohsa.com.gt/t/gfH1AAibWbMIJ~QGY0uSRrCOH~aF3jGNEKlaaaaBhBSMLXGqaaCOH~F3j?l=OLU~25zKs8s8sCu9s8xAsE091Dy~25As~25F4~25AsIAL2~25AsVAVFMLb6~25A4~25AsUGZ2T6a~25u8JW5ZAOMMR~25As~25F4~25AsAuDwCtHx8s9s9~25u8~25zK~25u84ikpTiUs~25u88ikwdqfi~25u84tS0akS~25Asda0S~25As~25F4~25As9y~25As~25F4~25As8z~25As~25F4~25AsAsAv~25As~25F4~25As8s8s8wAt8sDu8yGtHxE_L~25As~25F4~25AsOMILMEIDI~amp;V=ifugzStW~25Cs0S1.YwT.ol~amp;n=Svewjidm~25w8kil.ogj.Y1~amp;d=JvF~amp;p=~amp;z=~23
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb27a29758,0x7ffb27a29768,0x7ffb27a29778
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1864,i,16227447938895514124,15909810558398035601,131072 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1864,i,16227447938895514124,15909810558398035601,131072 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1864,i,16227447938895514124,15909810558398035601,131072 /prefetch:2
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1864,i,16227447938895514124,15909810558398035601,131072 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1864,i,16227447938895514124,15909810558398035601,131072 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4288 --field-trial-handle=1864,i,16227447938895514124,15909810558398035601,131072 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=1864,i,16227447938895514124,15909810558398035601,131072 /prefetch:8
  2⤵
  PID:2516

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2a0799ce8cbc0e1d46d19975e3af4254

SHA1
80370ec13a0ec6c7cf0d060179ad801318baa967

SHA256
d72fb1cd2f0591af9f018f039c14abea0bde2b1fb47c7b271e32025f4e5fd67f

SHA512
a14e8d043be6127c9d207bfb7f19cac91dbd6f8fd972e24b5f227621b60d79b0081283b4414fea816336b1a74c467042f3981c77a64c048b46f8941293b11238

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
c32a970f0ad26cb2fd306d60d3b01542

SHA1
86f3ff1a8a818feb593de3b3d95be88f853b4518

SHA256
5539c08d9cb0d46d941e8d93137ae8bcb43624fc9c29d4de7779dfa7df8101b4

SHA512
2c2ae105cb8b85e4d5755e1dc98965cd8cd72912beee0d5fd367d1060e084f5bd402728882345b23e67bcf61b7fb73788a7d1c5646fcbafa0c721f9bba1b31e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit