hxxps://maquionline[.]cl/3ee

Analysis

max time kernel
299s
max time network
288s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://maquionline.cl/3ee
Sample240603-grpvmafc32

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618681662560963"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2312	chrome.exe
2312	chrome.exe
4700	chrome.exe
4700	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe
Token: SeShutdownPrivilege	2312	chrome.exe
Token: SeCreatePagefilePrivilege	2312	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe
2312	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 3196	2312	chrome.exe	83
PID 2312 wrote to memory of 3196	2312	chrome.exe	83
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 2964	2312	chrome.exe	84
PID 2312 wrote to memory of 4824	2312	chrome.exe	85
PID 2312 wrote to memory of 4824	2312	chrome.exe	85
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86
PID 2312 wrote to memory of 4284	2312	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://maquionline.cl/3ee
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0471ab58,0x7ffa0471ab68,0x7ffa0471ab78
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1876,i,460039405690694709,14202100324901629483,131072 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1876,i,460039405690694709,14202100324901629483,131072 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1876,i,460039405690694709,14202100324901629483,131072 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1876,i,460039405690694709,14202100324901629483,131072 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1876,i,460039405690694709,14202100324901629483,131072 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4244 --field-trial-handle=1876,i,460039405690694709,14202100324901629483,131072 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=1876,i,460039405690694709,14202100324901629483,131072 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3260 --field-trial-handle=1876,i,460039405690694709,14202100324901629483,131072 /prefetch:8
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3244 --field-trial-handle=1876,i,460039405690694709,14202100324901629483,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 397ff1e39a37bc71ca93945d689e88f14a8e6256545e003cf43f7478d3d1ce50
MD5 004df8e093f935d3a78ddd474ae4daf8
SHA1 f0cb92e9ad8541dd98cf4bd10c1263435781a051
SHA512 04c909ca9ffa8d5d14c6f45d19841e0ccb324d583f5fd0475d6405ee65a61036c3d7e2e5c6aa147783bdfba605fd9b947c9b6a8388b6d87a946163ce34211557
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2a87811b6da4f987d2ac7892657b05ea73cf93e254055dcbf0aea5f865490b82
MD5 6fb878e1dfe80e6d2b9a46a9f160dae4
SHA1 44cc7e09ea75d429284f826067dd162e5c0d7968
SHA512 2d4db3fb3972144600f933f9e8b743d72c6e85dd0dbf1e358225181d45e11943b682d956cb601b191f638313579bcf6a2569fd6b5f4c383d6c7ba4d1bfc07269
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f869d17964ae59f0d1298ddfd009247a2a8ebcdb1279c8631ec0a78f273411e7
MD5 5f712ccfcca30e3b05b68d2190b991ee
SHA1 98f6eb5e564a3b728f5d0f452f6352c3d185d241
SHA512 9c16c20feaff7ce9ba86ff3334fd2c5038426a0d37cdd4e56e631406f4c952a0139ddacaaee431df0481d17e6c1a03f67a02a1c37f7724aec521ca9a8f183e10
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 c4d20ee0e6d6ea18c7fa984b5fb040890d1b3bb8dbffe3c538f8d91f8a094ee4
MD5 536ccbe0d37cc52fe65f5c8fb8d73068
SHA1 d5ce654f084a9a76da4caa10443c609edf6e546d
SHA512 412021ce88069c960382ae7181a3ac6032ff817830d7b25e7ce484dde5287173f90ec34e5f02ffd134a605e6a7d704f07abd6bd4bf37fa71470e71179628dda8
SSDEEP 192:ozVzQrVdt4aJSX8syh+FTmAEl2EvzP5tjEsXtScR:ozVM5pS5yqaAQvttIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 3324557cdf463b7fc68b496378c6410119cdc60d8d7ef8dce0cc83d3eaba82f5
MD5 f45609f43eaf856d3ef2c3b0980096bf
SHA1 6a9ccdf9c865b276378ce5a3bcebe01c59ef7b4f
SHA512 916324407ba50dea212a032c554d8f1d65b7e31061254116a78d6dd79b0de9dbe19c5c4df1485f68db5869e06d661cdba1c940347fa6a91b08d88d19705af7bf
SSDEEP 3072:5OlJ5TObcly4nASlCdNpLpDqqnhXNFM35jX0HYw6eGGCBa2DX1hB:MQYRPILxZnhLMJjX0EeGzY2rLB
MD5 SHA1 SHA512 SSDEEP

Submit Download