hxxps://d3mengenharia[.]websiteseguro[.]com/seg

Analysis

max time kernel
253s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://d3mengenharia.websiteseguro.com/seg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133558892589059427"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5028	chrome.exe
5028	chrome.exe
3312	chrome.exe
3312	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2392	5028	chrome.exe	86
PID 5028 wrote to memory of 2392	5028	chrome.exe	86
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 1524	5028	chrome.exe	89
PID 5028 wrote to memory of 3936	5028	chrome.exe	90
PID 5028 wrote to memory of 3936	5028	chrome.exe	90
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91
PID 5028 wrote to memory of 4388	5028	chrome.exe	91

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://d3mengenharia.websiteseguro.com/seg
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdbdc9758,0x7ffbdbdc9768,0x7ffbdbdc9778
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4872 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3060 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3252 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5032 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3984 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3472 --field-trial-handle=1880,i,14643682704724743530,18257761479353471831,131072 /prefetch:1
  2⤵
  PID:2356

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
ff7eb6b224affa2cb65dfd8db0cd05a4

SHA1
4c2166345702711c5f31541263a752311bf4fc85

SHA256
2058f1c9ee91d342f004806e26364af45430c22cc8cc826ccd82cba8788f3c00

SHA512
8ddcd58674bf617f756d3665e2828e1249674bcf957045be0e70485a89577240a08114a03f2546adf8f3c75f324b7c501a0883792b4380738927371f1b9711af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b8970331e8dd8f6b326bd820bb084d35

SHA1
35481d42a54c68214b2b49475ba4aa799475ca09

SHA256
bd854b82538ceb3ab1599e32da5f1a0ed7b4bd961c90880e32e9fac1258c4b04

SHA512
78d412b72238ccc1446eb772c9fd56ec10841840a3c67bb49f3a1df8720ff833f3f0b7ecf5366d73047a9714357ffcf4c174c8a69c570af7edfbdb2ac0decc16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8b548035c3e2c13a73d337a5609c8c46

SHA1
ed54ea72d4675f7a438455c157f42ad6724c2f64

SHA256
a220af09d45a1eae4a05313d3fd8ba0ab4279bf0269054cb6ee2e038c84310a6

SHA512
7287d1c5791caf13a42f5353c7ab42b719fa88a9abaf1482905c8b63a52d560246016fa1b344233e1fb028f0bdc7d7dfbf2ebddc01a4f8a8a8ed66bc1043940b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
9b870be86bc8dd90a4eea218c1b7e74f

SHA1
7bec638cf2efecb6d9d0e25f291964c14db297ec

SHA256
0014da7c2a4a52037da75369222b4f3de338ab07f5a3f746bfb0088450efa477

SHA512
628fe0d22ea54db02e9eecd8ff200bc13303e1451eccebbc7120ca268b1c76dabe746602ad37e9c2e3a0f17350adf93e1fef53e2938c22df0c1b7015ea224588

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit