Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2023, 07:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.sat.gob.mx/TimbreFiscalDigital
Resource
win10v2004-20230831-en
General
-
Target
http://www.sat.gob.mx/TimbreFiscalDigital
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133382845845513612" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1528 chrome.exe 1528 chrome.exe 3680 chrome.exe 3680 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1528 wrote to memory of 4392 1528 chrome.exe 81 PID 1528 wrote to memory of 4392 1528 chrome.exe 81 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 4940 1528 chrome.exe 85 PID 1528 wrote to memory of 3464 1528 chrome.exe 86 PID 1528 wrote to memory of 3464 1528 chrome.exe 86 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87 PID 1528 wrote to memory of 3164 1528 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.sat.gob.mx/TimbreFiscalDigital1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c3b09758,0x7ff9c3b09768,0x7ff9c3b097782⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1884,i,12705321180522990703,3366454019561046000,131072 /prefetch:22⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1884,i,12705321180522990703,3366454019561046000,131072 /prefetch:82⤵PID:3464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1884,i,12705321180522990703,3366454019561046000,131072 /prefetch:82⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1884,i,12705321180522990703,3366454019561046000,131072 /prefetch:12⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1884,i,12705321180522990703,3366454019561046000,131072 /prefetch:12⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4564 --field-trial-handle=1884,i,12705321180522990703,3366454019561046000,131072 /prefetch:12⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1884,i,12705321180522990703,3366454019561046000,131072 /prefetch:82⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3272 --field-trial-handle=1884,i,12705321180522990703,3366454019561046000,131072 /prefetch:82⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 --field-trial-handle=1884,i,12705321180522990703,3366454019561046000,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5220afd743d9e9643852e31a135a9f3ae
SHA188523924351bac0b5d560fe0c5781e2556e7693d
SHA2560925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
SHA5126e722fce1e8553be592b1a741972c7f5b7b0cdafce230e9d2d587d20283482881c96660682e4095a5f14df45a96ec193a9b222030c53b1b7bbe8312b2eae440d
-
Filesize
240B
MD536f5a0da7f38d9d22468b7bc2092bf27
SHA1985d4a494c7389b1571a48a01dbd23fdef75a361
SHA25628e31d5c085f4c11ce537d9f9b17f20c3549e94e184dbfae27a7b5342aefc8d2
SHA5127410aaa6576fede5b0d57af649beafa5a75ecb1c84f0c8ad359acd1882723225301f8ba3e468f88e52f96acc2309caa0459a7357a0c037418ec18291a6493aa4
-
Filesize
2KB
MD588fabf0b90ca65ac03922afd1deab36d
SHA169e6751625c656bdea67c25e29d2896f941d6133
SHA25620876fa5dc59195ebea22344503dcc224c64e39d7327f140cbcf8cce75539e27
SHA512e82612880b4511d763a3cf077b6b42895534903a7459d5e69f11028f842a3f9a6c0544c499c9cafac0a81f103801f35e60979e6d3f8ba5a333e1513b901e31d0
-
Filesize
1KB
MD5b1f0213260e90060e864b989afc708c7
SHA1c37e8d1fc8379eaf0545d2839356fa9fad900b71
SHA256d144900d1928e0efa1c941b3e368b8e02f234d9f0368e9a16ebf5c8a3f2ea8ff
SHA5129f7a9d0ff60db7519cc85710f921425358617e6cad7298047ff675daf6bfbecb5aa5defb508b89b35c30758dda3c656f1c9098b36c51208964185a45124f01ee
-
Filesize
701B
MD59aaa505f1b0aeec1c650c58f23cea1ed
SHA17d84c11eef7c558342ae20190fc844c27491feba
SHA2563eb0dda9961bfe0f3576a12abf381c83f156fae97d8b67b52ee23269685dc671
SHA512c19337946384026fa6e0941b8deaa9c17c31290cc399bcecc1bf7cc39b63f9faf397ddb864da583e4f65280d1b82c65a0ee4d8a6b64434ac651f3495f604b357
-
Filesize
5KB
MD5608e5d9094b6b426e37868d42cbfebca
SHA1bb82019032f01ac30e532b7971d535dcffbab0f2
SHA256420dfe3e5f231aec4c507938eac5889e09bf297857ff0a4b33aab66d648b08b0
SHA5121da983d182e1428a661dd3a10ae9b66a7e733d6d476ffc6d099b5223e36b7a402deab93fdb3fdc4a974cfaaf55630fdfc22c4c6f93a075f0d9330185d5b09e49
-
Filesize
6KB
MD58c946ea74335473c191e5b623f779716
SHA15ef6d2508c4433b4347c0d75ec4ddf4b173f6598
SHA2561ec854e570cf77ebee6ef133258e75ebfe6b7cdaf8e1b6bded2dd042a1b71f16
SHA51275a1a5e9453ba65ee10aca71e860af30b338b99fa1595ab0849f763ecbd014ddb423fd697aba90c14ac0ced8e7107490c4abaecc07f8cb5ff67e2af1c41b8566
-
Filesize
5KB
MD550ec30fdaa535f0546200edc20aaea0d
SHA1e4e0067676e6885d686ce67434293d058d11195f
SHA256e5d44c10ecc9f850205b721bb86d831dbb4179e11f64a39542978f60b9401540
SHA512774cb11ff1f4bdd6dcbe57ac9680311ca455604a8a8a6f6ed6a74f81867656250a8a81fda934c6ed7a365c6a6f7c91401bddc6ffd5e8f70f87a7ac506fde0cfb
-
Filesize
97KB
MD5579e451a67687882b992d9e99dc89fe5
SHA1bdcb82f9383012aaeedbc3ffa21ce399cd732ad3
SHA256e88c58e6f58d3bcf6de52a8bcd1fa2e801efdac2b5fbe060938b9c3aa4d259a2
SHA512e824e9bab2ae0e41000963c7ed83eabbb95032dfd12efa53527a076f88e61d4840de3f0746b2fd9faa721ab20793834d146741e88918a5ea44917defc499642a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd