hxxp://www[.]mercadolibre[.]com

General

Target

http://www.mercadolibre.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609619687981546"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3016 chrome.exe
3016 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

3016 chrome.exe
3016 chrome.exe
3016 chrome.exe
3016 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3016 wrote to memory of 1428	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1428	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1604	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1600	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 1600	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe
PID 3016 wrote to memory of 2228	3016	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.mercadolibre.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc2d75ab58,0x7ffc2d75ab68,0x7ffc2d75ab78
2⤵
PID:1428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:2
2⤵
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:8
2⤵
PID:1600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2152 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:8
2⤵
PID:2228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:1
2⤵
PID:3944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:1
2⤵
PID:4816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2904 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:1
2⤵
PID:2100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3164 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:8
2⤵
PID:4840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:8
2⤵
PID:1828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4440 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:1
2⤵
PID:2764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4248 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:8
2⤵
PID:3344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3744 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:8
2⤵
PID:4684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1800,i,3181239729338390105,6191942730872665497,131072 /prefetch:8
2⤵
PID:3440

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3344

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
576B

MD5
6121a030241557bb027d3bde8faf02c3

SHA1
2f68ec7c47308c951fc19003f47820b3e40e47be

SHA256
97cdf6c5e237d40d5943bc12606fea4dd95dedc2061a33f4de124beca443d6a5

SHA512
b5cf71e7b81f024d30c83df6d7a48f89679913e2bfae1da84701c309f61a561d90b7e5c5e424db8715a1cf61ae158b48e7dd683c3eba0e8d5f93e0f4e5763092

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
6b94ced7d7e17818e25fb7b9ae8dc6fc

SHA1
a0a3c457db45e5a22715b48416780210c4051b41

SHA256
35a443fa4690601b64f3e59df3ec70ea2f4a7c10558edf55359e84fb90d45d0d

SHA512
4cd8c1fb3d8ff9c4bca65263f6be5373a8c48218f713e80b601625bcecb5d6b6c41a4acdcaa21c94eaa8f32ca13b04a0da3ed66872b77fc736edc10a0183c18b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
4b44cc8541e32e325202f5cc1332be24

SHA1
32c802049203984576e857e6f6292097f4f6a78d

SHA256
08bff2dcaa718f09666ee8b88d47759f244fdc8968e463c4c3e95d89a7932a2a

SHA512
2a0468196d5af095b1577755186ab0fe0f1a4d82524dce6f490db46163fdf765832bfe4e70019e18213d9400e59bcf6e893723536a24aeaf2d2f2c4bacd22739

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
5bb79341f00c64ce1a90faebb2c15a0b

SHA1
1bc88cf4a78fdcec65f2276addfc7c194a851e88

SHA256
4a0d4f43a3ad82ba95ad9958687363dd7d651eb12a00d9cd0b57e9a62205b483

SHA512
34a72515a90c63765b4385ba2f6be093fe668ddf9928806a1b492fb55c0fde55cfef44120ce6a83757acdf8c65069f4de235647755cbc6d222e2b8d3c29802e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
7298418a23d1239263bfe013b92c4d4d

SHA1
13ee0c83051ab89f6ae97b1df3a79a8196ad770d

SHA256
008d9cbf7c90fae987eabc426e09a1be927a727ff79309a01bccef2461c1f70e

SHA512
805d4afafd3397311d0ffd93f48fae8767c202d8d51c4104a4b6addf99364458af0b0521093b324c40ef55fd5e68b0000103825c4110560d15d43f5d2e514888

Download Submit
\??\pipe\crashpad_3016_KCFGTCWAXHRVMTWD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads