hxxps://mobiliergalati[.]ro/hwFe5nni2Ps3RkFe5x0qzFe5alandpharBM2ady9s3RWO3BM2

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
26-06-2024 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mobiliergalati.ro/hwFe5nni2Ps3RkFe5x0qzFe5alandpharBM2ady9s3RWO3BM2

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133638598855965873"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

2324 chrome.exe
2324 chrome.exe
2212 chrome.exe
2212 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

2324 chrome.exe
2324 chrome.exe
2324 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid process

2324 chrome.exe
2324 chrome.exe
2324 chrome.exe
2324 chrome.exe
2324 chrome.exe
2324 chrome.exe
2324 chrome.exe
2324 chrome.exe
2324 chrome.exe
2324 chrome.exe
2324 chrome.exe
2324 chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2324 wrote to memory of 3104	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 3104	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 896	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 2980	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 2980	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe
PID 2324 wrote to memory of 4664	2324	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mobiliergalati.ro/hwFe5nni2Ps3RkFe5x0qzFe5alandpharBM2ady9s3RWO3BM2
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff973f4ab58,0x7ff973f4ab68,0x7ff973f4ab78
2⤵
PID:3104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1832,i,8018788556127722835,13379135204420422782,131072 /prefetch:2
2⤵
PID:896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1832,i,8018788556127722835,13379135204420422782,131072 /prefetch:8
2⤵
PID:2980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1832,i,8018788556127722835,13379135204420422782,131072 /prefetch:8
2⤵
PID:4664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1832,i,8018788556127722835,13379135204420422782,131072 /prefetch:1
2⤵
PID:1068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1832,i,8018788556127722835,13379135204420422782,131072 /prefetch:1
2⤵
PID:1156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3972 --field-trial-handle=1832,i,8018788556127722835,13379135204420422782,131072 /prefetch:1
2⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4304 --field-trial-handle=1832,i,8018788556127722835,13379135204420422782,131072 /prefetch:8
2⤵
PID:956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1832,i,8018788556127722835,13379135204420422782,131072 /prefetch:8
2⤵
PID:748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=1832,i,8018788556127722835,13379135204420422782,131072 /prefetch:8
2⤵
PID:3456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1456 --field-trial-handle=1832,i,8018788556127722835,13379135204420422782,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2212

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3960

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004DC
1⤵
PID:4088

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
192B

MD5
e9fbc41ac05471d6940b79a9c5f76e09

SHA1
cb2df975cd59baa730adb02189828e0cace7579c

SHA256
0fe1540320f190ba73a914d7f43c63ee388084c627d4b0ff202384463ea4ce62

SHA512
5304b186eec8933714ceb9b8135b449b31e9cc8de449286a35a7f8879685fbf9dc8a24c176876f7c9ded08455145761f0e8ed06d33e1cdebf76a0ad773252587

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
c30a7f4fc61d47cf1372d959fa2e7cef

SHA1
dbe44985f1ee4d7a9d33fc06d2a4823c93aa713c

SHA256
2002d5c4cd5564c156254319849c254c4771ab4d8f99b08ad7b1fb73717b15a7

SHA512
4b70cc8468c551841c250208b6ca45a48a5bc6844c13208799fb39a1408dde351c54a1b5305257382d4f71db154e306c47e5462fbf24f566786474e3e86b349b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
8859322d4c85fa6f7fab1e91cf3fb442

SHA1
a71d73b3c2d58d180b5622c670e65775ac55fd16

SHA256
934fa89cab06d4c6983b1bf476622389995ae9170a7826440696b9ff422c4e1b

SHA512
7dde3cadb23cb1716baeb5d3de027724ce036a2d3384ac740088edfa0b0382539d9d0f38b1cc4edaa03f2016eb62e0d427eab4b4307c6aa4beb5cdc0b2fcf6a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
4630f3b0861f3c05f1bc27f18306021c

SHA1
04002fc2a47641a538228155b83a9a7c60a41793

SHA256
f5d2ea51d7615cd0680535cac4fd166f1f099fb946e3884304757130035a49c5

SHA512
e3671ce244440d7689c12c6d69d9091646ccf211cdf23d5ce695b4549f79fdc23b158455c2fe478cac4492fb6b67909280d9ad0f0d335a62a654a13de6b2dbe7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
89a2c8857361c06d85b85dda67f879d3

SHA1
09b1c896bcfc44bf8813e8969fbed0ef4e844037

SHA256
f5f0bee981552593937011c7a4a3f91faa0bcd0915e5df30f75bb37db44d2aa8

SHA512
a3dbb868910a113f36d85c3d35860fb103a642a2c6d4f196a62d991cd428da79e5881d2670250723827b23d022961127a97374c72d63fd8b960616ef60b6204a

Download Submit
\??\pipe\crashpad_2324_TLUZNHUOSHUEOKUX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit