Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 02:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.news.icbcstore.com.ar
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://www.news.icbcstore.com.ar
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133639305473994379" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1876 chrome.exe 1876 chrome.exe 3556 chrome.exe 3556 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1876 chrome.exe 1876 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe Token: SeShutdownPrivilege 1876 chrome.exe Token: SeCreatePagefilePrivilege 1876 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 364 1876 chrome.exe 81 PID 1876 wrote to memory of 364 1876 chrome.exe 81 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 3016 1876 chrome.exe 82 PID 1876 wrote to memory of 4292 1876 chrome.exe 83 PID 1876 wrote to memory of 4292 1876 chrome.exe 83 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84 PID 1876 wrote to memory of 3572 1876 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.news.icbcstore.com.ar1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed416ab58,0x7ffed416ab68,0x7ffed416ab782⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1872,i,5017144846905952840,8227352208376136559,131072 /prefetch:22⤵PID:3016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1872,i,5017144846905952840,8227352208376136559,131072 /prefetch:82⤵PID:4292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2056 --field-trial-handle=1872,i,5017144846905952840,8227352208376136559,131072 /prefetch:82⤵PID:3572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1872,i,5017144846905952840,8227352208376136559,131072 /prefetch:12⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1872,i,5017144846905952840,8227352208376136559,131072 /prefetch:12⤵PID:808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 --field-trial-handle=1872,i,5017144846905952840,8227352208376136559,131072 /prefetch:82⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 --field-trial-handle=1872,i,5017144846905952840,8227352208376136559,131072 /prefetch:82⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=936 --field-trial-handle=1872,i,5017144846905952840,8227352208376136559,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3556
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f618d2b96acb3a9f070d26a9a66faaa6
SHA1414c968d813c98a777723a7782be748ed835817d
SHA2562e7bcb0b7b3d7eb8e55343d814374ad2e630ec046c59b0c53944e7a5b6f25114
SHA5121a19dc66a690b0257cc8c29d8cc7f309678c48794b094cdbefa4a0a48bfbaea1e1668e9f61082189b5b2cf15f11ba9b57e0bbcfa6c8324cacabdd302c1efdc4b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD52350cb0dc92fab9dbb2acd840c3c23f7
SHA1b6d10693c841ba971f459014962edc9b0204cf9a
SHA256a6f18e09ae8214d971958fdbc855815c9a8e2523ada84644d5b2d9d81e14ddff
SHA5124c2ea4b7d1fcb6939f780074bf2b48cfdcf3ad2c9e3e277df849b44c77bc41e29816b9fbc770f57f3a9139afc702d848786bb56d4b2e9f004b82f2af88d1acbf
-
Filesize
7KB
MD5c692cf5ce20c00b449c57d90e7b7e870
SHA1aca0a12dbb87080d2907eaf7f0ff2355ea4cf376
SHA256431a37ff530c02eb069b02f58a75e79654c04185ce3abbe9b2856c8ef78cad13
SHA51267c85774e765a64843d8c871d917fcc3fa196184cf3a583eb12b35a981b2aeae41beea4727815b4285eb92ab13644539c0d27fc5f6fa0712b2007a4ae3c5d560
-
Filesize
7KB
MD5cad692ec53574f2569d3b1133ec012dd
SHA1020103a680755755c040f9723c9ef1be58fe24f2
SHA2566a5cbbd02f0bd25febc47462eba36a00412da4498b57a43e31e9912145560c39
SHA51217e6a1f064e507763344287f688e9c56aae174a09e77666d6650432aadc5f9aed45467c6f9595c229cd070d531ef66d16bb7c910b2a44fee0ad28409f1969e33
-
Filesize
255KB
MD56a3a5b440d1c0a9132adcfbbe14875a7
SHA15df3898deceaa7d182c7d2a653b23865edc8c10c
SHA256c7b2b5ee41618f57649839fdd8c39a4b73812d35cc743d7a3cb5ff6f9c3bfd92
SHA512b65314c7d6de1645d811de1864e59e1941e9e3578762aef05bb0c6bc803dc33e018f6d399d73e48df4944b305f60f2aa8cab0bdcf251100218bf8ebd03b11911