Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-es -
resource tags
arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
16/10/2023, 14:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://melcusme.bubbleapps.io/?cid=961744413382313335961776886693739745154425190938
Resource
win10v2004-20230915-es
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://melcusme.bubbleapps.io/?cid=961744413382313335961776886693739745154425190938
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133419414520659869" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1028 chrome.exe 1028 chrome.exe 4516 chrome.exe 4516 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1028 chrome.exe 1028 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe Token: SeShutdownPrivilege 1028 chrome.exe Token: SeCreatePagefilePrivilege 1028 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe 1028 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1028 wrote to memory of 2624 1028 chrome.exe 65 PID 1028 wrote to memory of 2624 1028 chrome.exe 65 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 552 1028 chrome.exe 86 PID 1028 wrote to memory of 1492 1028 chrome.exe 88 PID 1028 wrote to memory of 1492 1028 chrome.exe 88 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87 PID 1028 wrote to memory of 4296 1028 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://melcusme.bubbleapps.io/?cid=9617444133823133359617768866937397451544251909381⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90c7d9758,0x7ff90c7d9768,0x7ff90c7d97782⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1888,i,15736764836688303656,4971235406219587866,131072 /prefetch:22⤵PID:552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1888,i,15736764836688303656,4971235406219587866,131072 /prefetch:82⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1888,i,15736764836688303656,4971235406219587866,131072 /prefetch:82⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3244 --field-trial-handle=1888,i,15736764836688303656,4971235406219587866,131072 /prefetch:12⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3212 --field-trial-handle=1888,i,15736764836688303656,4971235406219587866,131072 /prefetch:12⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1888,i,15736764836688303656,4971235406219587866,131072 /prefetch:82⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1888,i,15736764836688303656,4971235406219587866,131072 /prefetch:82⤵PID:3604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 --field-trial-handle=1888,i,15736764836688303656,4971235406219587866,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4516
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
903B
MD5b4cc00e308eedae8aa5e0c3f7c60c129
SHA16561e8bc051caf448565d095e90961627987e1a9
SHA256506039052c6519aca03f9b4b23e5bd0538dded257bee39cb8608ec20d721b05c
SHA512a902094a4140deeda7eafa25df34c9e4a6be26d8f2a74651bd01c02baacccbd9bc0f2eabc446821542bae0b6842c2aeb6add4003852ec850b10844721b0313fd
-
Filesize
6KB
MD5085c787ee2b7583c99abfc6482460b95
SHA12c99c8728c5321161041089331149acbfa70516f
SHA256f79da31c9475d6e5cdf40fd0e17badbdd175da17abe481c0dfb6a06f6a003c15
SHA51245aaa23df5bac3924e0e48f6000f2a393b5640a4cc7088b7e4289c6a3c0724809d8eb27f63a221c95aafcae7508280543ed25e7fe561de0f1e06378384f8caa0
-
Filesize
101KB
MD5597449f25cc03e0c3b47259eeeb15d31
SHA156ec2fddcd58cfed394ba3b78a569447ba552925
SHA256c1e220764cce0dc639b589cc4c1f6435e26deea64c1d1fe939754aa40c35df89
SHA512a92e9beb254da977b77eca3bb31d6516593517ce7dbe3a1059dc408c9b2786bc2bdae9481aec93dd85111629e5bdefd81704224df2868b77135af2882e121ab1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd