Analysis
-
max time kernel
108s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2024 20:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ebrou-cancelar-compra.webnode.es/
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
https://ebrou-cancelar-compra.webnode.es/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133528471184153438" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4200 chrome.exe 4200 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4200 chrome.exe 4200 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4200 wrote to memory of 4432 4200 chrome.exe 64 PID 4200 wrote to memory of 4432 4200 chrome.exe 64 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1312 4200 chrome.exe 87 PID 4200 wrote to memory of 1392 4200 chrome.exe 88 PID 4200 wrote to memory of 1392 4200 chrome.exe 88 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89 PID 4200 wrote to memory of 1356 4200 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ebrou-cancelar-compra.webnode.es/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9714a9758,0x7ff9714a9768,0x7ff9714a97782⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1872,i,126178374523994844,17791445667897764620,131072 /prefetch:22⤵PID:1312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1872,i,126178374523994844,17791445667897764620,131072 /prefetch:82⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1872,i,126178374523994844,17791445667897764620,131072 /prefetch:82⤵PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1872,i,126178374523994844,17791445667897764620,131072 /prefetch:12⤵PID:936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1872,i,126178374523994844,17791445667897764620,131072 /prefetch:12⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1872,i,126178374523994844,17791445667897764620,131072 /prefetch:82⤵PID:672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1872,i,126178374523994844,17791445667897764620,131072 /prefetch:82⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5292f195fdaa5853d10aeadaf3830dd8e
SHA10032eeca3b6a5f10833017e891aa6eabd3664d10
SHA256e3af12a5b4311342435b07590f9cca0e08b9e35bc137aaf833003e617d004e8a
SHA512cf2fda732b93a7a99065c54de5470e49eabc20106b2bad5805487cd288a079798746b40206fb510fb1e27f8d6a6cb2bb222f460ec0456e62d661227365dc3c83
-
Filesize
539B
MD5595379bb793dc6b1d6a0f4d0dc82a810
SHA13eb02c05f529c68520aa5fd2ec582e243f21240a
SHA256a980124dbda98ce860632b5c08d78bffc1f2b2c6cc379c3cbcd257c52f8fe015
SHA51265451cb28cd7b5839e89c563fa3aa63ad5fe50eba6f74ed100c912bc1cd9d5c2b0090da38697fdc6f2105254e3b810f6590b5de10bcedaad67bc559d5afd8177
-
Filesize
6KB
MD597fc365e14482def997f1bf811c36732
SHA1ae726c398e7d3e6dddc6d5c744a85b54a0beb816
SHA2566ca1128f3dc53dc0583158ed7776cd0fdc2e96f4efdf67c72326633d5b2f763f
SHA5124d4c6a2eec98f3acad476ddfa5bac5274b355c199da268c16f4e6f4013ae08de0b85a81bd17ebd97260d016d6ff61487ce3159645818131c19205cddd273ffb1
-
Filesize
114KB
MD554be41d02251166bdd85d0f8b747dd54
SHA118c8aeb3267f5488f94feafb06434f1f7559af47
SHA256e6330f244191198b479f28f8935df0967c5b31bc80d6e86a230f9c7070e32cd9
SHA512a14a8b8901653d786dfaccb0c5e0d08a20b8f92b54ae631de780c877885962d7689fdacf7d5ccbcc63db2facd9269cbb12c5bc48a7d930b37ff80dd4dceca537
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd