hxxps://babaszepsegverseny[.]hu/INVOICE[.]js

General

Target

https://babaszepsegverseny.hu/INVOICE.js

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609009277231377"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

2268 chrome.exe
2268 chrome.exe
3964 chrome.exe
3964 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

2268 chrome.exe
2268 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe

Suspicious use of FindShellTrayWindow 32 IoCs

Processes:

chrome.exe

pid	process
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2268 wrote to memory of 2356	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 2356	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 3372	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 4004	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 4004	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe
PID 2268 wrote to memory of 1864	2268	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://babaszepsegverseny.hu/INVOICE.js
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5e2dab58,0x7ffd5e2dab68,0x7ffd5e2dab78
2⤵
PID:2356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1912,i,11847307920067801,13726638187490351799,131072 /prefetch:2
2⤵
PID:3372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1912,i,11847307920067801,13726638187490351799,131072 /prefetch:8
2⤵
PID:4004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1912,i,11847307920067801,13726638187490351799,131072 /prefetch:8
2⤵
PID:1864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1912,i,11847307920067801,13726638187490351799,131072 /prefetch:1
2⤵
PID:3604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1912,i,11847307920067801,13726638187490351799,131072 /prefetch:1
2⤵
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1912,i,11847307920067801,13726638187490351799,131072 /prefetch:8
2⤵
PID:4084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1912,i,11847307920067801,13726638187490351799,131072 /prefetch:8
2⤵
PID:2364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1912,i,11847307920067801,13726638187490351799,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
6405a67139457da9aef15788c13a2f23

SHA1
6566d1875d5971b226ae410367375fb999f152cb

SHA256
8a5ac827cef1b50a37721d65798ca51be196545b8158196f5ef6a8fa4478add1

SHA512
de70c69d2e389ac36aa03a41d8f38d02b3d41d89045a1180e9d2d070ac4b0b65751ecb05c5509894e1fb9faaf21d9aa1dc67a9f5193c58eed8e085fb159cf28f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5c9d1dfd80544ff5fd012fd3481f6185

SHA1
fbd0805fafade04567c9215885bf9400d9d7337d

SHA256
9eb9f43e7fd44acc01036bdb0dfdcf69a3a4c94ab6ddd49ad3720f2efa98c881

SHA512
646de9f5a5b5f703bf0ee9a4b15e92df5feea440c43020c150e38be5c38768d90dc201f1dcdc01fa1fed56cbb5e51b5a40ecec7689601e99ef5e1a6c51aa1986

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
736c32ae86066affc3df3717f252fde8

SHA1
47e740e55e6afe17107e9036cc12fcddccd2d4a5

SHA256
7a27ba714db7cd6450a8f85d5774a87881124073407f50a32bea336c03b38a5b

SHA512
892afce964a3c2d6c2ff0b0fd75a9e1016dedf4be37abaeb1265abc1d95b81e86afbc4cbc0f1693f5ca6e2c11235783c59908c79d0fac477ba0d0122e5ec34cf

Download Submit
\??\pipe\crashpad_2268_KNMPRABABGYNFBZO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads