Create Interactive Tour

Windows Analysis Report
https://app.expopass.com/magic-entrance/d3d7f758-b8fa-4c4f-901f-9efb084d9376/mobile

Overview

General Information

Sample URL:	https://app.expopass.com/magic-entrance/d3d7f758-b8fa-4c4f-901f-9efb084d9376/mobile
Analysis ID:	1528378
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64native

chrome.exe (PID: 2344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 4336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2196,i,6338386280590294436,9281080431039769799,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2204 /prefetch:3 MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 4716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.expopass.com/magic-entrance/d3d7f758-b8fa-4c4f-901f-9efb084d9376/mobile" MD5: BB7C48CDDDE076E7EB44022520F40F77)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://app.expopass.com/main.7aa1e2da8cb3c2a9.js

HTTP Parser: (self.webpackchunkexpo=self.webpackchunkexpo||[]).push([[792],{49854:(h,c,e)=>{"use strict";e.d(c,{z:()=>p});var t=e(43234),r=e(88975),s=e(12642),l=e(36443),a=e(85897),i=e(26860),o=e(54460),n=e(95968),d=e(25689),u=e(23719);function _(b,y){1&b&&(i.j41(0,"div",2),i.nrm(1,"app-expo-spinner"),i.k0s())}let p=(()=>{class b{config;appservice;loaderservice;production=t.c.production;optimizedresizelistener=null;browserdetector;loaded=!1;loading=!0;countdownnumberel=document.getelementbyid("countdown-number");alert;showalert=!1;subscriptions=new a.yu;constructor(g,e,m){this.config=g,this.appservice=e,this.loaderservice=m}ngoninit(){this.subscribe(),this.evaluateviewport(),this.initintercom()}subscribe(){const g=this.loaderservice.app$.subscribe(e=>{this.loading=e});this.subscriptions.add(g)}onrouteroutletactivate(g){const e=document.getelementbyid("splash");e&&(e.classlist.add("splash-hide"),settimeout(()=>{e.remove()},500))}evaluateviewport(){const g=.01*window.innerheight,e=.01*window.innerwidth;document.documentelem...

Source: https://cdn.expopass.io/static/expopass_entrance_v2.html

HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\scoped_dir2344_2026898791			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_2344_2079684822			Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 45MB

Source: unknown	TCP traffic detected without corresponding DNS query: 104.70.121.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.74
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.121.47
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.121.47
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_73.1.dr, chromecache_64.1.dr

String found in binary or memory: return b}JC.F="internal.enableAutoEventOnTimer";var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: app.expopass.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.indicative.com
Source: global traffic	DNS traffic detected: DNS query: cdn.expopass.io
Source: global traffic	DNS traffic detected: DNS query: api.indicative.com
Source: global traffic	DNS traffic detected: DNS query: www.expopass.com

Source: global traffic	TCP traffic: 192.168.11.20:52050 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:52050 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:52050 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:52050 -> 239.255.255.250:1900

Source: chromecache_77.1.dr, chromecache_90.1.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_91.1.dr	String found in binary or memory: https://apps.apple.com/us/app/expo-pass/id921625648
Source: chromecache_73.1.dr, chromecache_64.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_91.1.dr	String found in binary or memory: https://cdn.expopass.io/images/android_download.png
Source: chromecache_76.1.dr	String found in binary or memory: https://cdn.expopass.io/images/expopass-images/expo_favicon.png
Source: chromecache_91.1.dr	String found in binary or memory: https://cdn.expopass.io/images/ios_download.svg
Source: chromecache_76.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: chromecache_91.1.dr, chromecache_76.1.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Open
Source: chromecache_76.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: chromecache_76.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialicons/v142/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWSw
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWT4
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWV0
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWV4
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWV8
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVA
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVI
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVM
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVQ
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVw
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWKBXyIfDnIV7nBrXw.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWKBXyIfDnIV7nDrXyi0A.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWKBXyIfDnIV7nErXyi0A.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWKBXyIfDnIV7nFrXyi0A.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWKBXyIfDnIV7nMrXyi0A.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWKBXyIfDnIV7nPrXyi0A.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWbBXyIfDnIV7nEt3KSJbVDV49rz8tdE3U1f4L1kA.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWbBXyIfDnIV7nEt3KSJbVDV49rz8tdE3U3f4I.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWbBXyIfDnIV7nEt3KSJbVDV49rz8tdE3U5f4L1kA.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWbBXyIfDnIV7nEt3KSJbVDV49rz8tdE3U6f4L1kA.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWbBXyIfDnIV7nEt3KSJbVDV49rz8tdE3Uyf4L1kA.woff2)
Source: chromecache_85.1.dr, chromecache_79.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWbBXyIfDnIV7nEt3KSJbVDV49rz8tdE3Uzf4L1kA.woff2)
Source: chromecache_98.1.dr	String found in binary or memory: https://froala.com/wysiwyg-editor/terms/
Source: chromecache_73.1.dr, chromecache_64.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_73.1.dr, chromecache_64.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_91.1.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=io.expopass.expo
Source: chromecache_90.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_77.1.dr, chromecache_90.1.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_73.1.dr, chromecache_64.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_91.1.dr	String found in binary or memory: https://www.expopass.com/wp-content/uploads/2023/03/logoexpo_2023.svg
Source: chromecache_98.1.dr	String found in binary or memory: https://www.froala.com/wysiwyg-editor)
Source: chromecache_73.1.dr, chromecache_64.1.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_77.1.dr, chromecache_90.1.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_77.1.dr, chromecache_90.1.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_77.1.dr, chromecache_90.1.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_73.1.dr, chromecache_64.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_77.1.dr, chromecache_90.1.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_73.1.dr, chromecache_64.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_64.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_77.1.dr, chromecache_90.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_76.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-77226205-4

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: classification engine

Classification label: clean0.win@17/63@22/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\scoped_dir2344_2026898791

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2196,i,6338386280590294436,9281080431039769799,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2204 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.expopass.com/magic-entrance/d3d7f758-b8fa-4c4f-901f-9efb084d9376/mobile"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2196,i,6338386280590294436,9281080431039769799,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2204 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\scoped_dir2344_2026898791			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_2344_2079684822			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Network Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
expopass.com	141.193.213.10	true	false	unknown
www.google.com	142.251.40.100	true	false	unknown
cdn.expopass.io	108.138.106.87	true	false	unknown
d3kitxvtmefwcl.cloudfront.net	13.225.63.79	true	false	unknown
dsc89dzv5h035.cloudfront.net	52.85.61.65	true	false	unknown
api.indicative.com	34.98.104.50	true	false	unknown
cdn.indicative.com	unknown	unknown	false	unknown
app.expopass.com	unknown	unknown	false	unknown
www.expopass.com	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	chromecache_73.1.dr, chromecache_64.1.dr	false	unknown
https://tagassistant.google.com/	chromecache_77.1.dr, chromecache_90.1.dr	false	unknown
https://stats.g.doubleclick.net/j/collect	chromecache_90.1.dr	false	unknown
https://froala.com/wysiwyg-editor/terms/	chromecache_98.1.dr	false	unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_77.1.dr, chromecache_90.1.dr	false	unknown
https://www.google.com/ads/ga-audiences	chromecache_77.1.dr, chromecache_90.1.dr	false	unknown
https://www.froala.com/wysiwyg-editor)	chromecache_98.1.dr	false	unknown
https://www.google.%/ads/ga-audiences	chromecache_77.1.dr, chromecache_90.1.dr	false	unknown
https://td.doubleclick.net	chromecache_73.1.dr, chromecache_64.1.dr	false	unknown
https://cct.google/taggy/agent.js	chromecache_73.1.dr, chromecache_64.1.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.225.63.118	unknown	United States	16509	AMAZON-02US	false
108.138.106.97	unknown	United States	16509	AMAZON-02US	false
34.98.104.50	api.indicative.com	United States	15169	GOOGLEUS	false
52.85.61.65	dsc89dzv5h035.cloudfront.net	United States	16509	AMAZON-02US	false
108.138.106.87	cdn.expopass.io	United States	16509	AMAZON-02US	false
141.193.213.10	expopass.com	United States	396845	DV-PRIMARY-ASN1US	false
142.251.40.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.225.63.79	d3kitxvtmefwcl.cloudfront.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.11.20

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528378
Start date and time:	2024-10-07 21:37:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://app.expopass.com/magic-entrance/d3d7f758-b8fa-4c4f-901f-9efb084d9376/mobile
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@17/63@22/10

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.65.163, 142.250.64.110, 142.250.31.84, 34.104.35.123, 142.251.40.170, 142.251.40.131, 142.250.80.72, 142.250.64.78, 142.251.40.104, 142.250.65.206, 172.253.63.95, 142.250.72.99, 142.250.80.106, 142.250.64.74, 142.251.40.106, 142.250.176.202, 142.251.40.138, 142.251.35.170, 142.250.81.234, 142.251.40.234, 142.250.65.234, 142.250.65.202, 172.217.165.138, 142.251.41.10, 142.251.40.202, 142.250.65.170, 142.251.32.106, 199.232.214.172, 142.250.65.227
Excluded domains from analysis (whitelisted): fonts.googleapis.com, accounts.google.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, www.googleapis.com, dns.msftncsi.com, clients2.google.com, edgedl.me.gvt1.com, www.googletagmanager.com, update.googleapis.com, clients.l.google.com, www.google-analytics.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://app.expopass.com/magic-entrance/d3d7f758-b8fa-4c4f-901f-9efb084d9376/mobile

Input	Output
URL: https://cdn.expopass.io/static/expopass_entrance_v2.html Model: jbxai	{ "brand":["expo", "PASS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"This Magic Link only works with a mobile device. Don't fret Simply click the Magic Link again from a mobile device Contact support@expopass.com for additional help.", "has_visible_qrcode":false}

URL: https://cdn.expopass.io/static/expopass_entrance_v2.html Model: jbxai

{
"brand":["expo",
"PASS"],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"text":"This Magic Link only works with a mobile device. Don't fret Simply click the Magic Link again from a mobile device Contact support@expopass.com for additional help.",
"has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	2953
Entropy (8bit):	7.919236831225309
Encrypted:	false
SSDEEP:	48:g+IDgBUT5UxMHkSKiSiGuoWji0M+SK+FtWXa1DDaxwqFy7VzSWVBRuf3KX:/cl5U2vFSxeAK+qXxeBRufa
MD5:	2B225206EA09D2939AB90A3A1DA486D3
SHA1:	EDEC64442F504125310CF65D4D8B2D5FC7ADBADB
SHA-256:	6D98D57D5FE8BE7B6C19743114D5A50BC21F5332F8AA0E73806D17FDA0C4FF23
SHA-512:	2EA8AA792DEDC27822E11DB08A17D7FE51AB0916FC88EADEA66DC2139F59E482B83AFE68D73895670D288370D10C6EC4F50E71097C84B126888430C69703C180
Malicious:	false
Reputation:	low
Preview:	.%...z]u...qY.L_...X.%..jD..Q .....T.v.B-a.`e...ST....W.$..w.[v..].$..RV<.V....5...xL..BT.C-...(.8H........f.3.xi_7`.p.c>..SL._......y.....7.....p.~.&..S.../.....O..........V.....-..>}~.i..........U.....??;{}}.....L....r..].......{2.<..Z.U%...o..w....W.../....?..s..5Gf...f........<l^?}\|..p.F-.....~..A...........x~....e............7.........q+...../...Vn...j.^bbD.0t...1..;r.)......#.V&EL%..]....Zk.t. #....cV.....L.>...........q{}zry...\w......+w...f.....................b..<{>l...............Owo.6.,3v....>..........y.u..n~\|..a...r.t.@V..._..+.....W.E..N......Ho....Z..;>=....C-=..w.Z.....X.1....R....v....x....>....W.~...'..Z./.......e.......T......i.....E" ..C.g...u.........i.O..Bo.u..a...n......TBS..d5.......f=^.^..G...m..h....wOFVTO...w..`..p.nD.;E......9......B~...I....j.G.G...u..wL.f.u..d.....~.>E.,mc...S.#W.:.4X..0G7.7P.d..I..q..'..`......t..%.........K....;&n..=j..L..zP.%..N.O..Ng...+....aX_.\|V_E.;[.....T..`.W.RP.%v.%o.e.+.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 21:39:21.349919081 CEST	137	137	192.168.11.20	192.168.11.255
Oct 7, 2024 21:39:22.097791910 CEST	137	137	192.168.11.20	192.168.11.255
Oct 7, 2024 21:39:22.863020897 CEST	137	137	192.168.11.20	192.168.11.255
Oct 7, 2024 21:39:29.109657049 CEST	52050	1900	192.168.11.20	239.255.255.250
Oct 7, 2024 21:39:29.167668104 CEST	53	50156	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:29.195168972 CEST	53	52049	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:29.939904928 CEST	53	64833	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:30.113637924 CEST	52050	1900	192.168.11.20	239.255.255.250
Oct 7, 2024 21:39:30.989276886 CEST	49678	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:30.989612103 CEST	56124	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:31.118139029 CEST	53	49678	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:31.123713970 CEST	52050	1900	192.168.11.20	239.255.255.250
Oct 7, 2024 21:39:31.138005972 CEST	53	56124	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:31.544740915 CEST	53	64112	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:32.127446890 CEST	52050	1900	192.168.11.20	239.255.255.250
Oct 7, 2024 21:39:32.501297951 CEST	137	137	192.168.11.20	192.168.11.255
Oct 7, 2024 21:39:32.752971888 CEST	53	51795	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:32.814882994 CEST	59463	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:32.814989090 CEST	49855	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:32.910820007 CEST	53	59463	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:33.036473036 CEST	53	49855	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:33.262386084 CEST	137	137	192.168.11.20	192.168.11.255
Oct 7, 2024 21:39:33.554538965 CEST	53	61853	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:33.733877897 CEST	59344	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:33.733982086 CEST	62957	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:33.835999012 CEST	53	62957	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:33.837560892 CEST	53	59344	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:34.000061989 CEST	55430	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:34.000133991 CEST	50184	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:34.012736082 CEST	137	137	192.168.11.20	192.168.11.255
Oct 7, 2024 21:39:34.095377922 CEST	53	50184	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:34.096582890 CEST	53	55430	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:34.239690065 CEST	61370	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:34.239831924 CEST	60332	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:34.365334034 CEST	53	61370	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:34.365394115 CEST	53	60332	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:34.743295908 CEST	51989	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:34.743376017 CEST	52927	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:34.848675013 CEST	53	51989	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:34.849244118 CEST	53	64721	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:34.869801044 CEST	53	52927	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:34.919332027 CEST	62041	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:34.919425964 CEST	62175	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:34.922041893 CEST	54165	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:34.922230959 CEST	56926	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:34.938857079 CEST	53	62923	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:35.015290976 CEST	53	62175	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:35.016016006 CEST	53	62041	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:35.017991066 CEST	53	54165	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:35.018343925 CEST	53	56926	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:35.155915022 CEST	57141	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:35.155915022 CEST	54958	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:35.260335922 CEST	53	57141	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:35.348697901 CEST	53	54958	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:35.748503923 CEST	53	52559	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:35.780149937 CEST	53	58790	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:36.643790960 CEST	65348	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:36.643907070 CEST	60713	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:36.776248932 CEST	53	65348	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:36.778291941 CEST	53	60713	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:37.615241051 CEST	52291	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:37.615287066 CEST	65004	53	192.168.11.20	1.1.1.1
Oct 7, 2024 21:39:37.749541044 CEST	53	52291	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:37.749636889 CEST	53	65004	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:51.655380011 CEST	53	52803	1.1.1.1	192.168.11.20
Oct 7, 2024 21:39:58.803777933 CEST	53	52600	1.1.1.1	192.168.11.20
Oct 7, 2024 21:40:13.618654966 CEST	53	64140	1.1.1.1	192.168.11.20
Oct 7, 2024 21:40:29.185086012 CEST	53	53031	1.1.1.1	192.168.11.20
Oct 7, 2024 21:40:39.271538019 CEST	53	57393	1.1.1.1	192.168.11.20

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 7, 2024 21:39:33.036659956 CEST	192.168.11.20	1.1.1.1	cb6f	(Port unreachable)	Destination Unreachable
Oct 7, 2024 21:39:35.348952055 CEST	192.168.11.20	1.1.1.1	cb49	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-10-07 19:39:35 UTC	542	OUT	OPTIONS /service/event HTTP/1.1 Host: api.indicative.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,indicative-client Origin: https://app.expopass.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://app.expopass.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-10-07 19:39:35 UTC	464	IN	HTTP/1.1 204 No Content Date: Mon, 07 Oct 2024 19:39:35 GMT Access-Control-Allow-Origin: https://app.expopass.com Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 Access-Control-Allow-Methods: OPTIONS,POST Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin,Authorization,Indicative-Client Allow: OPTIONS,HEAD,POST,GET Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	15:39:26
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff75d540000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	15:39:27
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2196,i,6338386280590294436,9281080431039769799,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2204 /prefetch:3
Imagebase:	0x7ff75d540000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	15:39:29
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.expopass.com/magic-entrance/d3d7f758-b8fa-4c4f-901f-9efb084d9376/mobile"
Imagebase:	0x7ff75d540000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1114813
Entropy (8bit):	5.7407643998815
Encrypted:	false
SSDEEP:	12288:ZmQk7Ij+GgZWWXDduKGX8J6kTmoV3GlV28:ZmbG6BDduKi8QkioVGP
MD5:	62C52685C3A16D08D09AC8D4BF21894C
SHA1:	81BBB64A52F622BBA3D71C7EFB0D4A5BD38307E8
SHA-256:	5E74CD06FAEFE80E1E570EEA734CE2451A28768701A48464866521E3F8D21BA5
SHA-512:	F6905BD1019971D6AC7DDB0D326DBB818F8775520C7E844678550FD7F81A8410D95CB3B5B8FE93E9CF21AB12C974F01CF338E48E2D48ADAB57EFAAB4ACC2FBAE
Malicious:	false
Reputation:	low
URL:	https://app.expopass.com/scripts.da584fe6619c8534.js
Preview:	!function(Rt,on){"object"==typeof exports&&typeof module<"u"?module.exports=on():"function"==typeof define&&define.amd?define(on):Rt.FroalaEditor=on()}(this,function(){"use strict";function Rt(e){return(Rt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t})(e)}function on(e){return function(n){if(Array.isArray(n))return mn(n)}(e)\|\|function(n){if(typeof Symbol<"u"&&null!=n[Symbol.iterator]\|\|null!=n["@@iterator"])return Array.from(n)}(e)\|\|function(n,i){if(n){if("string"==typeof n)return mn(n,i);var o=Object.prototype.toString.call(n).slice(8,-1);if("Object"===o&&n.constructor&&(o=n.constructor.name),"Map"===o\|\|"Set"===o)return Array.from(n);if("Arguments"===o\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(o))return mn(n,i)}}(e)\|\|function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5858
Entropy (8bit):	4.349628081046411
Encrypted:	false
SSDEEP:	96:L90Wvit+itwGbNSb6OgfFMrtoQnvgfFMTcSjBDPIulbrrXEs+iAfTxrBtnkAfTxV:J/06bgfFsosgfF6lDP/lHrNBuNuuNn
MD5:	B41CE968CFA929BD87309E63F0480D20
SHA1:	2D2A8964269E286048F96B1E82810FD6510FB9CC
SHA-256:	FC5AC99DE223618B2A0AF333F11C57B9200822F951FABB03A57BA15C24CA136D
SHA-512:	34C4E504665C14440401FAD59146CD9076B048F48B052BE332F6AE581BD455B99318AACB00CEDAE5F3D8244C459334D7F9A9C8242193390E136EB93E1BA27FF4
Malicious:	false
Reputation:	low
URL:	https://cdn.expopass.io/images/expo-pass-logo.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?><svg id="b" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1068.64 164.48"><defs><style>.e{fill:url(#d);}.f{fill:#ed5942;}.g{fill:#fff;}.h{fill:#ffcd03;}.i{fill:#3657a3;}.j{fill:#595959;}.k{fill:#7ac9c2;}</style><linearGradient id="d" x1="704.4" y1="71.85" x2="1068.64" y2="71.85" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#5a9bc7"/><stop offset="1" stop-color="#4460a6"/></linearGradient></defs><g id="c"><g><rect class="e" x="704.4" y="14.58" width="364.24" height="114.56" rx="22.41" ry="22.41"/><g><path class="h" d="m56.23,87.35c-8.52-8.52-22.32-8.52-30.84,0h0s-19.01,19.01-19.01,19.01h0c-8.51,8.51-8.51,22.32,0,30.84,8.52,8.51,22.32,8.51,30.84,0l19.01-19.01c8.52-8.52,8.52-22.32,0-30.84"/><path class="f" d="m137.2,6.39c-8.52-8.52-22.32-8.52-30.84,0h0s-19.01,19.01-19.01,19.01h0c-8.51,8.51-8.51,22.32,0,30.84,8.52,8.51,22.32,8.51,30.84,0l19.01-19.01c8.52-8.52,8.52-22.32,0-30.84"/><path class="

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	215852
Entropy (8bit):	5.377119960818273
Encrypted:	false
SSDEEP:	3072:r4ZszZgFLzZgzZyzZszZmozZwzZbLzZq4HzZ3:r5kSAWxC5FV
MD5:	24BB8BB2899BA035882353AAC79AB6DD
SHA1:	76DE33FEFB66E528A8AF8542BBC67ED9E41C6E3D
SHA-256:	0E553A944081685429E6386FC2C41A1A85E3D214138312950DAC82D3A00AE029
SHA-512:	8BE5A1B44954B7F23E12C9DB13EC527C0DF426745CE81C3BDAD6769B176B69DBC932E6D2A434CA0BC5C0556EB705591DF653A67897AF48574EED79D7ECDCEC93
Malicious:	false
Reputation:	low
Preview:	"use strict";(self.webpackChunkexpo=self.webpackChunkexpo\|\|[]).push([[726],{98587:(v,f,t)=>{t.d(f,{a:()=>e});var c=t(89163),r=t(93508),C=t(75616),o=t(26860),p=t(54460),m=t(19155);function i(s,h){if(1&s&&(o.nrm(0,"div",7),o.nI1(1,"safe")),2&s){const g=o.XpG(2);o.xc7("background-image",o.i5U(1,2,"url("+(null==g.event?null:g.event.logo)+")","style"))}}function n(s,h){if(1&s&&(o.j41(0,"header"),o.DNE(1,i,2,5,"div",6),o.j41(2,"h2"),o.EFF(3),o.k0s()()),2&s){const g=o.XpG();o.R7$(),o.Y8G("ngIf",null==g.event?null:g.event.logo),o.R7$(2),o.JRh(null==g.event?null:g.event.name)}}let e=(()=>{class s{dialogRef;data;eventService;event=new r.J;eventContextSub$;constructor(g,l,M){this.dialogRef=g,this.data=l,this.eventService=M,this.eventContextSub$=this.eventService.eventContext$.subscribe(b=>{this.event=b})}decide(g){this.dialogRef.close(g)}ngOnDestroy(){this.eventContextSub$.unsubscribe()}static \u0275fac=function(l){return new(l\|\|s)(o.rXU(c.CP),o.rXU(c.Vh),o.rXU(C.U))};static \u0275cmp=o.VBU({type

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3418
Entropy (8bit):	5.053958790896955
Encrypted:	false
SSDEEP:	48:+FD0vN0370kbkQ0HNVPnnlVXIVV3VOOqQhZ7QxHUPwXLXRokhJZQHwN0YDqi/Xw3:kDV0nXy3yQhZUHSwXLXRokhHQHi0B3
MD5:	7A4C117863DB52659481FF122BDA5C15
SHA1:	0551BE5CFAC29A17D8F53036E2945AB9593D08DA
SHA-256:	CE7133B066E3FA109F3BE2FB7BB89A15D9D55E79EDAD8C6B5FA4EAC0913C2E3E
SHA-512:	84491FF8159B5C985D218CCE3766B3C0B242CF3D6AB749C2A689CD987D654831C590BD4BDE5E259C54CFDDE3727D39F68A73E40D3CF561077208247991080E95
Malicious:	false
Reputation:	low
URL:	https://app.expopass.com/assets/js/browser.js
Preview:	/*. This file checks the current browser name and version when the app loads. * and redirects the user to the unsupported browser page if their browser. * isn't supported.. * Make sure to update browser.ts file if you make any changes.. */.function _isIE() { return browser.name === 'IE'; }.function _isEdge() { return browser.name === 'Edge' \|\| browser.name === 'EdgW'; }.function _isMicrosoft() { return _isIE() \|\| _isEdge(); }.function _isFirefox() { return browser.name === 'Firefox'; }.function _isChrome() { return browser.name === 'Chrome'; }.function _isSafari() { return browser.name === 'Safari'; }.function _isAndroid() { return /Android/i.test(navigator.userAgent); }.function _isBlackBerry() { return /BlackBerry/i.test(navigator.userAgent); }.function _isWindowsMobile() { return /IEMobile/i.test(navigator.userAgent); }.function _isIOS() { return /iPhone\|iPad\|iPod/i.test(navigator.userAgent); }.function _isMobile() { return (this.isAndroid \|\| this.isBlackBerry \|\| this.isWindowsMo

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.
Tactics:	Discovery
Data Sources:	Cloud Service: Cloud Service Enumeration, Command: Command Execution, Network Traffic: Network Traffic Flow
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://app.expopass.com/magic-entrance/d3d7f758-b8fa-4c4f-901f-9efb084d9376/mobile

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Windows Analysis Report
https://app.expopass.com/magic-entrance/d3d7f758-b8fa-4c4f-901f-9efb084d9376/mobile