Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-es -
resource tags
arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
14-02-2024 15:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://wa.me/17863447496?text=Hola,%20por%20favor%20información
Resource
win10v2004-20231215-es
General
-
Target
https://wa.me/17863447496?text=Hola,%20por%20favor%20información
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133523985350191471" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5088 chrome.exe 5088 chrome.exe 3876 chrome.exe 3876 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe Token: SeShutdownPrivilege 5088 chrome.exe Token: SeCreatePagefilePrivilege 5088 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe 5088 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5088 wrote to memory of 4872 5088 chrome.exe 84 PID 5088 wrote to memory of 4872 5088 chrome.exe 84 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2404 5088 chrome.exe 88 PID 5088 wrote to memory of 2828 5088 chrome.exe 86 PID 5088 wrote to memory of 2828 5088 chrome.exe 86 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87 PID 5088 wrote to memory of 4024 5088 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wa.me/17863447496?text=Hola,%20por%20favor%20información1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb0fe9758,0x7ffbb0fe9768,0x7ffbb0fe97782⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1924,i,2242303141123392560,4915839775608207789,131072 /prefetch:82⤵PID:2828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1924,i,2242303141123392560,4915839775608207789,131072 /prefetch:82⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1924,i,2242303141123392560,4915839775608207789,131072 /prefetch:22⤵PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1924,i,2242303141123392560,4915839775608207789,131072 /prefetch:12⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2784 --field-trial-handle=1924,i,2242303141123392560,4915839775608207789,131072 /prefetch:12⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1924,i,2242303141123392560,4915839775608207789,131072 /prefetch:82⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4124 --field-trial-handle=1924,i,2242303141123392560,4915839775608207789,131072 /prefetch:12⤵PID:4016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3900 --field-trial-handle=1924,i,2242303141123392560,4915839775608207789,131072 /prefetch:82⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3816 --field-trial-handle=1924,i,2242303141123392560,4915839775608207789,131072 /prefetch:12⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 --field-trial-handle=1924,i,2242303141123392560,4915839775608207789,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3876
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD51e59df3b68b438824ce63294eb54a6cb
SHA1c60049aaab4c8fbd713bbae0aa7ec4db8fbae59a
SHA256325a3210620451d8ac8a650cef3f95871df0bc61ad0f8850abb0cd2281c8628e
SHA5126ca02b1a9990c5544ac28ff84d4c0e4b0c4628d1f12827f19180d26c9ee7937ba9db3a8a70fd3831501d8f1f13c2d7c6598745cfdb0e57542f8147ebd898b341
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\41f03ca8-9177-4278-aafa-59689619107a.tmp
Filesize701B
MD5a52d1387490520fc646ca9a82713d97f
SHA18e348abd90fce309434f581d36f8f9048679aa34
SHA256c18c7acfa158dd948e75b6b3bd77d53c50653ac6ed32cfe8be3953d157602381
SHA5122505151a7a3f51891687a7008be1ca813a14f5d8733cfa03eaa822d1a3bf7624cce14a78bdf62d368b432a9f7136f533abfc48c8a39d4a73abeb7ebb1d494e78
-
Filesize
1KB
MD5ea4abd05db1dba83272f5a602814e5bf
SHA194336fb53b187cd00e2db0067058358a5e126486
SHA2562570c4917aba91a92adfcceeacc31ba01b1f47548f3415392432180ba782bbe4
SHA5129ea141917d3c12f707db3f74d7bdc97ad30169f44c0abd5fd98c139468b0889a18a25c3a8c8c6bd7de8f08f9853fbf3f7dcd98b1486a936391cbb7fe5297fb71
-
Filesize
703B
MD546f9b89dfc3f4efd0ccfc509d0634472
SHA1e8a44cca716043d2667f546d1b011a8181320818
SHA256fbe7b76b77899c00e2a3286900ba611168ac46451956a13783d8941506805d90
SHA5125aa0b99e7a15c98b0b5a2783efc70059ce24958b9677c829e3c7285f943e4db1b89a28c0eb44addb9c6bd788f01f5e13a396c5cb38ea98fb43fa3ac92761d4e5
-
Filesize
701B
MD5b0cc57004213da0f581b464bbc5fd3a1
SHA1a3f43d7c6831bf7dc9f2fb29f6034c0d309914af
SHA256ab60f9ffb5618f5eea1fb30e64a2253b427ae73947d9c14d4cddf332451c6035
SHA512b4d4816f54cf64db07cd8f4803e664e295d230fb611d24a604d497050c28d70c71faa596cf33d303f1350c3f4bd53071d4ba70c64998c47bef46923ac1b31cf8
-
Filesize
6KB
MD551e03eb5cb09cf3441d45d85575a0977
SHA1366e36d36fd307725cf10308870e371911ac4dae
SHA256448876ca727eb137838287b94a70883f35c1b2a9ba7fed4bba8d9d409f0e4f99
SHA512506ee4d0bd5f45310a1e9728cf103df6e5e2096b3c1c5d809101df8acea4c9d5563cf35d29c3f9a0b2efd66c6d3919ced5e94f70dd9ff23f115d8a0028c0a139
-
Filesize
6KB
MD59f0738b582d61ea365ccf79f8c3a0199
SHA1ab299f4fd0113847d71fff0875eeab1b05e5f6b3
SHA2560c391186f4ceb6e1bb049c2066c5a4a6b058c6b68410754f68307adb83e1fbc2
SHA51238f7dc76283b742fec2ebb13124502a2f28aa36043cafffa59cd53802f0240bd5f685a2fe3bb4b41a2a3e4cc0be2f29d7cb508c16e120c1e0e37f4288bc18571
-
Filesize
114KB
MD542bad3a966cb7230c26443f24005cead
SHA1b3f0b8b3cd7821ab4f19f3e206089fb7eddac764
SHA25680cd2a319e35305b0e49f9497833590070a2319780483992e12f491c86c5dc07
SHA51260f759744fd3f3076855ba1fb51837ec3f3f747e274aee5f4ee97d9240225d0c4c43325af972270f9fc73e7776eaadf53b3d67e1cb03af425eb064b7f96c3b26
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd