hxxps://picoyplacasolidario[.]movilidadbogota[.]gov[.]co/PortalCiudadano/#/pago/seleccionarPago/6225110

General

Target

https://picoyplacasolidario.movilidadbogota.gov.co/PortalCiudadano/#/pago/seleccionarPago/6225110

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585114092708636"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

3348 chrome.exe
3348 chrome.exe
1628 chrome.exe
1628 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

3348 chrome.exe
3348 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3348 wrote to memory of 3128	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3128	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 2012	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 1792	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 1792	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe
PID 3348 wrote to memory of 3504	3348	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://picoyplacasolidario.movilidadbogota.gov.co/PortalCiudadano/#/pago/seleccionarPago/6225110
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe44d8ab58,0x7ffe44d8ab68,0x7ffe44d8ab78
2⤵
PID:3128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1776,i,17194820640275306856,16331394709847960726,131072 /prefetch:2
2⤵
PID:2012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1776,i,17194820640275306856,16331394709847960726,131072 /prefetch:8
2⤵
PID:1792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1776,i,17194820640275306856,16331394709847960726,131072 /prefetch:8
2⤵
PID:3504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1776,i,17194820640275306856,16331394709847960726,131072 /prefetch:1
2⤵
PID:3144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1776,i,17194820640275306856,16331394709847960726,131072 /prefetch:1
2⤵
PID:452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 --field-trial-handle=1776,i,17194820640275306856,16331394709847960726,131072 /prefetch:8
2⤵
PID:408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4448 --field-trial-handle=1776,i,17194820640275306856,16331394709847960726,131072 /prefetch:8
2⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1776,i,17194820640275306856,16331394709847960726,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1956

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
523B

MD5
f3dcdf382fe32f8df831446278770aa4

SHA1
f96d32708c6e768b0ab3217ff88c749ae459a25d

SHA256
478367fa2b1445b1953a367d5f857ef50c08214920a45401035cba6e410108a4

SHA512
a8fe89d265ab3bbd28e47bb0e5e3a694cdb4c8a56e0d15831534e2e0eb4b34d863f6a73f1fade610b8f9a1baeab12d043fcb8ba01bbad214f9546a29d173709a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
60a591a1e29bc496222d3471129c7a22

SHA1
53e88ef2aa8ebd158c433b132f51d5591f976cf2

SHA256
e2485ad1b6b3b409e2815294e17d0bdd88d585fe2499c307141a5a71d2e86546

SHA512
506853092747db36973bad35a224f084483441ddc2c4afb76ac91bd14e5197a3b6091e158d3785d45b17301628f0012145e59257d9ba40f454f53d9ea647d601

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
127KB

MD5
ab08e663be80b39bc904476539694792

SHA1
644787d2fa3acfd8701fce54b0682ca5b0dbd0fe

SHA256
e8b70703214c7e5577a0fed8707f8207a7cf0d886035019d890c7da908f9d9d6

SHA512
4565b16db656b0e441976b3337bd6533cee32651c9f146b33fb498bfe9833afa2ef7309217c03db95ab0f5cfb0c406d068e644c236e9d5c9103ca137577811b9

Download Submit
\??\pipe\crashpad_3348_PQRWENXPUFVNKXXB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads