Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 17:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://https//couchemiliogonzalez.com/brou2/brr/
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://https//couchemiliogonzalez.com/brou2/brr/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133568117515925116" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3616 chrome.exe 3616 chrome.exe 2588 chrome.exe 2588 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe Token: SeShutdownPrivilege 3616 chrome.exe Token: SeCreatePagefilePrivilege 3616 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3616 wrote to memory of 2928 3616 chrome.exe 86 PID 3616 wrote to memory of 2928 3616 chrome.exe 86 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 544 3616 chrome.exe 88 PID 3616 wrote to memory of 932 3616 chrome.exe 89 PID 3616 wrote to memory of 932 3616 chrome.exe 89 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90 PID 3616 wrote to memory of 1760 3616 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://https//couchemiliogonzalez.com/brou2/brr/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffe1e209758,0x7ffe1e209768,0x7ffe1e2097782⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:22⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:82⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:82⤵PID:1760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:12⤵PID:3232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:12⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4684 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:12⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3128 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:12⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3220 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:82⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:82⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4700 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:12⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4976 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:12⤵PID:3248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2712 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:12⤵PID:1196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=960 --field-trial-handle=1788,i,2816834933944243800,5706063348660721404,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2588
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
677B
MD5fbdd98b2e3f750a57890ef66f0cd9f08
SHA13b5b959b3471e0f6404ad95b919e50f8e38a4a87
SHA256577c53bd39676dcea00cde1ae0298025f695e3156fb34a1384bf320950100d68
SHA51256d98ebb83eef9e0ac928f22b9e4da4fc11d8c0fdcb278dc019f212cbabb0c1ae296ffa7baea363dffb6bad6ca3a2ca702bc04592a6bf67693bf5f32f1da8e6d
-
Filesize
6KB
MD50b7366385fa750c3cfb22b4b4922ae31
SHA16e05e7733468be1bc193c68c1696a19717aac0fa
SHA256bd44d910a8194a938af482fcd0b3e658952e8f5b1003fdb7190a4e1987727c55
SHA512a10572edaa2b9e2e577a39dd88927a092f03c14d54227e754d5c97a0599922fdcb24f2c943a655ab8d8d6663b0e2e66f0b3780a00b8d6adb250e3f22892e45ac
-
Filesize
6KB
MD51fb20c0311355dfcad680231f9281621
SHA1779a28e4652090f328caddcdd1b489c15ff32d52
SHA2569d945e2301940844ebc91dd5bbde1549c1878a999c33e79702e8b511295293a8
SHA512d827152d505f60f23130b39c8a0d4a30f96f56e743b1c0879ce77451def399130d80d6629b4da41d16cace433fa0f2b33fede4b153f504a5c5c1be850833a2a2
-
Filesize
128KB
MD586883bac413b7a5ba7c93b3413cc68c3
SHA15705e8109b141c32d8c71b2248349dcce7bc5e0f
SHA25622f421ebcbd5aa38efe105e28a52da8281f2598436a0e14f1ab98c4c177164b8
SHA512dd6143e03918907a95d6ae0f261357b5170e505b42f37d15f8c83a35fac1fd97a0686c3b8d5f6e15ee6379bb42aed862ff4502f2f0e93985f34aa581d4346199
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd