hxxps://www[.]google[.]com/url?rct=j&sa=t&url=hxxps://santaportal[.]com[.]br/porto-e-negocios/juiz-autoriza-operacao-de-navio-bomba-no-porto-de-santos-e-mp-recorre&ct=ga&cd=CAEYByoUMTE5MDQxNjI5MTM4MDAwNDk2MTEyHTI2NmY2ZTYyMzA1MGIwNWY6Y29tLmJyOnB0OkJS&usg=AOvVaw1rUnk7OQUkyC0JwACGxYfz

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/url?rct=j&sa=t&url=https://santaportal.com.br/porto-e-negocios/juiz-autoriza-operacao-de-navio-bomba-no-porto-de-santos-e-mp-recorre&ct=ga&cd=CAEYByoUMTE5MDQxNjI5MTM4MDAwNDk2MTEyHTI2NmY2ZTYyMzA1MGIwNWY6Y29tLmJyOnB0OkJS&usg=AOvVaw1rUnk7OQUkyC0JwACGxYfz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4988	chrome.exe
4988	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 1796	4988	chrome.exe	38
PID 4988 wrote to memory of 1796	4988	chrome.exe	38
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 2016	4988	chrome.exe	88
PID 4988 wrote to memory of 1016	4988	chrome.exe	90
PID 4988 wrote to memory of 1016	4988	chrome.exe	90
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89
PID 4988 wrote to memory of 1376	4988	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/url?rct=j&sa=t&url=https://santaportal.com.br/porto-e-negocios/juiz-autoriza-operacao-de-navio-bomba-no-porto-de-santos-e-mp-recorre&ct=ga&cd=CAEYByoUMTE5MDQxNjI5MTM4MDAwNDk2MTEyHTI2NmY2ZTYyMzA1MGIwNWY6Y29tLmJyOnB0OkJS&usg=AOvVaw1rUnk7OQUkyC0JwACGxYfz
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7c719758,0x7ffb7c719768,0x7ffb7c719778
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1896,i,9782180453520534826,2692000788677776594,131072 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2052 --field-trial-handle=1896,i,9782180453520534826,2692000788677776594,131072 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1896,i,9782180453520534826,2692000788677776594,131072 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1896,i,9782180453520534826,2692000788677776594,131072 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2168 --field-trial-handle=1896,i,9782180453520534826,2692000788677776594,131072 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=1896,i,9782180453520534826,2692000788677776594,131072 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4840 --field-trial-handle=1896,i,9782180453520534826,2692000788677776594,131072 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 --field-trial-handle=1896,i,9782180453520534826,2692000788677776594,131072 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1896,i,9782180453520534826,2692000788677776594,131072 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1896,i,9782180453520534826,2692000788677776594,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x514
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
57810e02dfb51ac2165ee13fee95cfc6

SHA1
691eed2917b9f3f0947031feed0e4fdeae8ea153

SHA256
3671d369b84feebf6b48a8333a4c53a30fb8614d9a6264ca981d377e954de69e

SHA512
faf2f155b9e826e4a7d28b752bd385c8777330b63d107608a58f70518d1cf8fdf9084ea9fec918730ee8c30ba7d7432c1ac15edd55b98d716de1eb7f1947acb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
2b6da4cca020aac91f34af120ded8fa1

SHA1
e122ca92555a880ee7f6cf4528a6aace1b5a0483

SHA256
0898bd3c491a6081ce48efbc087ab308340671f5d4f88211c80012458d66b289

SHA512
24aef166a0b5e5efe9dc796c14fc7e25fcd92fab6d343cd75fc80e5137177a838d10e7bc8c4c15da723dbb32d9b5062255d9fa7a46c401aedc5947abf692f083

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d84d4802ede28725bed81029ff207dee

SHA1
71e86cfbe1d34818f9a2e581ea9699c11f442364

SHA256
a37e56c07f7d500cb311723c63bbd03f2df1d4cf5321606e86b278ccd26d4ff0

SHA512
860b342f1bf4a5a1dcaee19e3ca9a255eecb2479060d641ab4bbe30d359e8dc9d68599cc23aa92df8206d8a6dfbf2bca7dca6c5f111ac4354a7c4bba2107e545

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a06edd1f38a2506654703a11f333f6cd

SHA1
3a7e788a63db289236e983e81045d22e20d2bbed

SHA256
0f32401d7cd21a17f9db8343eb00f990f34a609bd11b010c505a164f91d0acca

SHA512
a92d64013c53ee95a9004fc12f34ce649d2743dba9aa7a2f4144260849b5dc3a2a4118e05b3555ea349cedc50aeb727afb85e5d543bf0d14c1e3158b5d3b60c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cc84b6d7-c68d-4b49-914e-9e2669ca7008.tmp

Filesize
130KB

MD5
2870d165f381d64e76652125778ff987

SHA1
185744253e3927b2913b7f5a918cddcf16932cbd

SHA256
94b40817d5937d804967f5523b89ff4e6317989d42d3e06f66c58eea34953009

SHA512
63aef41f26d94368844ffb61901415e6747f86b360cd78af6295bcfb60f05a3bd54b484e9337522854825b54af7d7f06fc84f2d4095675dc8e03f7962f51cac4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit