Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2023 21:28
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://domain-89086.bubbleapps.io/version-test#[email protected]
Resource
win10v2004-20230621-en
General
-
Target
https://domain-89086.bubbleapps.io/version-test#[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133323749277677930" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 648 chrome.exe 648 chrome.exe 3980 chrome.exe 3980 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 648 chrome.exe 648 chrome.exe 648 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe Token: SeShutdownPrivilege 648 chrome.exe Token: SeCreatePagefilePrivilege 648 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe 648 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 648 wrote to memory of 792 648 chrome.exe chrome.exe PID 648 wrote to memory of 792 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 924 648 chrome.exe chrome.exe PID 648 wrote to memory of 2728 648 chrome.exe chrome.exe PID 648 wrote to memory of 2728 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe PID 648 wrote to memory of 5004 648 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://domain-89086.bubbleapps.io/version-test#[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f5fa9758,0x7ff9f5fa9768,0x7ff9f5fa97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1892,i,2781793647242948655,5824424665909117955,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1892,i,2781793647242948655,5824424665909117955,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1892,i,2781793647242948655,5824424665909117955,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3172 --field-trial-handle=1892,i,2781793647242948655,5824424665909117955,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3148 --field-trial-handle=1892,i,2781793647242948655,5824424665909117955,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4508 --field-trial-handle=1892,i,2781793647242948655,5824424665909117955,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1892,i,2781793647242948655,5824424665909117955,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 --field-trial-handle=1892,i,2781793647242948655,5824424665909117955,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 --field-trial-handle=1892,i,2781793647242948655,5824424665909117955,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
360B
MD5187b73be60493dc751b058fa8cbb8791
SHA10aba884737328c008684f03cc6d2fe6e4c6b6113
SHA2563b55e38738ccae2cab57167b27463d789a6e3bd101303ce4c41f369e43aeaba6
SHA51266b87530213e10bc61e9c8bd8be72106a73ea7012e417975b99526ea3f811a2736078527855806db728c8fd576819534b7b08a72b3523047d09ed918a8698eb6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD55d0c8b0df29ccf11289197ec887dc494
SHA130fb4ba3643ddc0be350646e1a8ddf46ca7824a6
SHA25665d9944609b502cfe8bdbcf891038551c6bc77ebc63d3ed0756befe32fb6d8e8
SHA5129f36cad2d3018cd29d5b31791ba91fc862af339e237ff595d89e93a07af1301385c469def6809d5fde20c0a5bbcfb5478cba99e64a23bb410545bdc388de7a5c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
706B
MD594d377f6a0257558e5a3d3fb3e579bfc
SHA123e6d6bf6cc07a94a5ce09c27c6b5578c9445a47
SHA256c06b9beb53c564c99cf95e43720f152bb1ecccf40b936a2609334eae77be68bc
SHA5122e31499f95c806ac3039f6e870a048152b571d8985e56faee3784ccba3a1a53e278fbf4e7d5bd357373ea5fba00a29972ed137de603652b87a3f47fcd4101747
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5114a1377acb2023359a9ede720daab6b
SHA1e5193326b32d3ac93468547cb287221d2e3cca7f
SHA256bcae55b1e7d078e28f5a7cb8cf81c08a775fd5466dcbead3bfaea2f0df608987
SHA51298080dc8cb834a8cdcdc1db10e1a08d592d7698c0b64f1a60c2733de62ce6761c8bff24c4cb49a16758d9fa1e68db06d7fb63a0dd27404b194062d39cf9fae56
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD560f07cb3efe11ff7392159ddfd443d5a
SHA1c6669602f4fdda88bf421071509c15e15fa34e2c
SHA256e27fe8fd9f440cc8ab91dd87644785b44046acb2ba73e60126a83fa06d44b698
SHA51238a070b43589bb688221d96c46dc30575b9b0b2301234deea1d46a6b8c0322d0dd44749e9b104ba527a12ddf2f72a838fb686abf56c21a040bb52aad6a74ded8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD58eff7bb12f4422912df9b605aaea37e7
SHA163adf773fb4e4087e4213e48ebc6e945bd446f53
SHA2564fe1aa2fcd9721a47af4ab9580e02a1b0e862a5dcf9f1a6f0329dbdb902c5c67
SHA512fe229213d209d26370fde67d6e8afee0985d78e3f29f75ba563718bcb10a4d3a4d9ea62606c1b2ba8b3d0c3962d89c93799b7ec17e2924dd41667d19dc141a28
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
175KB
MD5eb3ad857873ce5c77656bd2cdd5b5ea5
SHA1c8cff339195a6f6106890da52b13261a14923547
SHA25659ee582eac1a0c04dcdc33542def035af182f01cf496f2cd07c106880371b424
SHA5125d87d39a902737a24c509fd873ad986de2158492bab50de052df97e72e8c2ff9472b917e0943728627375cc184ed63487a3aece638faca430965ee9a42c0b5d6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_648_YGIYWSAHHZZVPHYGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e