890c0ee515f899fcdd032f11b5a7298ed33626b75f239d0011830c78c84bd729

Analysis

max time kernel
149s
max time network
157s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
26/03/2024, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

González-modulos-cumplimiento.html
Size

1KB
MD5

79b38af7ce11800dd434b39e06ff3139
SHA1

fedc2cbf3408287b7453e53f624a63cfa632c249
SHA256

890c0ee515f899fcdd032f11b5a7298ed33626b75f239d0011830c78c84bd729
SHA512

3372e32157e97685e0a83e2935e3395fa0a28173effc854645e2d588d93c24db3650e1a620cd56fd38792438cb69a91224a8f4d656319bb81aed166606dfa419

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2896	2220	chrome.exe	28
PID 2220 wrote to memory of 2896	2220	chrome.exe	28
PID 2220 wrote to memory of 2896	2220	chrome.exe	28
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2716	2220	chrome.exe	30
PID 2220 wrote to memory of 2776	2220	chrome.exe	31
PID 2220 wrote to memory of 2776	2220	chrome.exe	31
PID 2220 wrote to memory of 2776	2220	chrome.exe	31
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32
PID 2220 wrote to memory of 2604	2220	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\González-modulos-cumplimiento.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7639758,0x7fef7639768,0x7fef7639778
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1168,i,2309680827368961257,12042325003657302226,131072 /prefetch:2
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1168,i,2309680827368961257,12042325003657302226,131072 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=1168,i,2309680827368961257,12042325003657302226,131072 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1168,i,2309680827368961257,12042325003657302226,131072 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1168,i,2309680827368961257,12042325003657302226,131072 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=996 --field-trial-handle=1168,i,2309680827368961257,12042325003657302226,131072 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3224 --field-trial-handle=1168,i,2309680827368961257,12042325003657302226,131072 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3888 --field-trial-handle=1168,i,2309680827368961257,12042325003657302226,131072 /prefetch:1
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=1168,i,2309680827368961257,12042325003657302226,131072 /prefetch:8
  2⤵
  PID:1600

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86466ffb74b65b1fa764ace97b5b6502

SHA1
64452965317aecfac44b749f6e25ce8ada5b7119

SHA256
5db1d7bdcf5b83ebdf83dd545c503c36a8945b5572a15409d7e044cfa05c6fd4

SHA512
eefe931cfd72915fe7722b324204c1749649acc7edd400bc5cae446c89091c6f3e91bf451e73d794fb01eb3e1bbd095bf0d04450420dcb3c728acda9d78aa8c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
5166d3fb2a72a9d3db10c8d0beed0369

SHA1
d3814b52968d0d29f577c5a262f54ca14bacd93d

SHA256
125bcf55528a3914152f4ca9ff714d71cef565fbc7a584310fe08346bddd2b2f

SHA512
99919f58f706b8fbf52efe09db72df8e66ff39466d6bb290e89f08db8507a964190afa1c315f83a54ceb4b62e41fd1e72cc91d69852819ff29a817c9082fe434

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
254d11468b063c4c7f0fa273b438c811

SHA1
370b6de4a11bc30adf8aa44eddd13854944babca

SHA256
3f317f4aea415b5d7b73248b566dc202d4fac16556322e7edf56914d48c0cce2

SHA512
8f785e08b8d0146be7eec798028fa053332f544e74ef1b0faacb59f5989051f54ee7c7256f446b4c39e87678c0204a57e137de1eab0e7f741c1c9cbf79a1071a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
962eae380c82f1790677cc484c683f2c

SHA1
454a39f3a41e7c8d8e164e645fd00393414ad87a

SHA256
e5ba8310f02cd051895471464ee3c7d9d68ea16337c64bc7ae6d3795c64e7cd6

SHA512
428c62a26ad086e4e4db59b5114c1f1495679699966962655f39d70d63c7eb1f9e1f491b30744df8071af9e791f4a687108f4ddfb9cc13459fc300b2ded587a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8647.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit