Analysis
-
max time kernel
328s -
max time network
323s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 14:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.labreferencia.com/images/firma11.png
Resource
win7-20231129-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
https://www.labreferencia.com/images/firma11.png
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
https://www.labreferencia.com/images/firma11.png
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133483337840997311" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe 2852 chrome.exe 2852 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 2540 4260 chrome.exe 88 PID 4260 wrote to memory of 2540 4260 chrome.exe 88 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 3480 4260 chrome.exe 91 PID 4260 wrote to memory of 4980 4260 chrome.exe 92 PID 4260 wrote to memory of 4980 4260 chrome.exe 92 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93 PID 4260 wrote to memory of 1384 4260 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.labreferencia.com/images/firma11.png1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff966139758,0x7ff966139768,0x7ff9661397782⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1920,i,2649781726774371007,202715966029096135,131072 /prefetch:22⤵PID:3480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1920,i,2649781726774371007,202715966029096135,131072 /prefetch:82⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1920,i,2649781726774371007,202715966029096135,131072 /prefetch:82⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3144 --field-trial-handle=1920,i,2649781726774371007,202715966029096135,131072 /prefetch:12⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1920,i,2649781726774371007,202715966029096135,131072 /prefetch:12⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1920,i,2649781726774371007,202715966029096135,131072 /prefetch:82⤵PID:336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1920,i,2649781726774371007,202715966029096135,131072 /prefetch:82⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1920,i,2649781726774371007,202715966029096135,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2852
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d5cb3ee5e166174bb8f20ef47404b5d5
SHA1047024aa95d285eb3f8a6b84ac414992e2bb46ba
SHA256fde9e02c06b60e0efec4be0167580d75fde79fc35f0cef09174b3ae08a77dca1
SHA51242127c32b4f6f70b5afb001234fc56187608d847fc8fd9c3658487a91ed3e54efe5b1c9c93a64523778d577a888d3216a2b85ccf298aa1b59891d07627018ff9
-
Filesize
1KB
MD51f998e89fbeacc6d01357392aaa89c7d
SHA1b51ae1925a4e55c9a47b486ef216c888337cc36a
SHA256b69187189f418b196f9218b6bf4e049087b87456a762415d335d6057e6fcb2c8
SHA512e4c1cb13cd1069b96e94bba5d3dcf1d28683af3619cf4f32f399e6c9d4c5c42030d2f963375d1c82c3ccaf225846872aee8d4fa07e4e16b00b7feef8d2076f61
-
Filesize
6KB
MD58469fdb7856ed5ba2a21dc215d03cdda
SHA16b8814b5fa6aab090c6a671fe52430a35125ee81
SHA256589fd0da590c1ca24892dbd89756e96007e2954894d6aab1372e3150773f5692
SHA512255eaca66bd9ff343786640749ad2535fff651e72c9cf52f5d20ab3749304907774f6c18e47365ed907b1bd7cf93105d233fb171f94f7c8f14a4f95b4358a582
-
Filesize
114KB
MD5a8a7cef7aa0e8dfe5cb25cca701b87d4
SHA11544164276c9872a7f16516f83444be98cbfb740
SHA25684a400c53fd55f19694477190bd4f9454e1e8f1736b0237963c490de441818cc
SHA512e19cba93b6de37dad8b5784e7b742c888b9738689c1864a858ad5890d3d94223967879bc8a4e45b0f69b40e8b0c3b54b43df05cd5a48957c30a3e0d590d3289e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd