hxxps://www[.]jomba[.]co[.]il/account/?r\=akshay[.]aghi@ril[.]com

Analysis

max time kernel
114s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.jomba.co.il/account/?r\[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642982234053771"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

1192 chrome.exe
1192 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

1192 chrome.exe
1192 chrome.exe
1192 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1192 wrote to memory of 4932	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 4932	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 1828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 3828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 3828	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe
PID 1192 wrote to memory of 2472	1192	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.jomba.co.il/account/?r\[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8be90ab58,0x7ff8be90ab68,0x7ff8be90ab78
2⤵
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1880,i,11302594851974444833,13906969007057063315,131072 /prefetch:2
2⤵
PID:1828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1880,i,11302594851974444833,13906969007057063315,131072 /prefetch:8
2⤵
PID:3828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1880,i,11302594851974444833,13906969007057063315,131072 /prefetch:8
2⤵
PID:2472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1880,i,11302594851974444833,13906969007057063315,131072 /prefetch:1
2⤵
PID:1484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1880,i,11302594851974444833,13906969007057063315,131072 /prefetch:1
2⤵
PID:3832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 --field-trial-handle=1880,i,11302594851974444833,13906969007057063315,131072 /prefetch:8
2⤵
PID:1816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 --field-trial-handle=1880,i,11302594851974444833,13906969007057063315,131072 /prefetch:8
2⤵
PID:1284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4540 --field-trial-handle=1880,i,11302594851974444833,13906969007057063315,131072 /prefetch:1
2⤵
PID:4272

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2236

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
4250c709b710511cb950f9b7abce8dcb

SHA1
dcb2d85d7a41b92abae86b9619c779300110c1e5

SHA256
d91bb752b9845343aeb452351bb3acb92cc56a1718892e3166c268f37ef96ab4

SHA512
cba414fa2658dc5a75708a1ccf95769c3c1fec510d5e1590e7e210b1fe605f49717e855c343b96500392151681d825f152165490ea058af7c81f15c3ba3f1c2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
1614f6aecbd9d0fe16f1fa304b0050d5

SHA1
3e38829037a6d9969410fbabc32ae2d2151c752a

SHA256
600454122513b9474056b0c3bbb0694026a18dfead9164a02beeb7f57a2e0e1c

SHA512
f4f5af90a8337960177a04cd7c150fbc42e5806a2560dc54384d1ead5a55094a1196cd4310509632afd79f669503cc2325b62f8fa061d2b5821ae629737fd76b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
b2ef4c87b63f0946adb52ef117f6acc6

SHA1
dd4775f2351e1f3c58a48549b2370752635a1047

SHA256
6c20a8cd00f3fb65a6f67ea09bd9690c265617f8fa4b299bc3bde8d31a7f474d

SHA512
8d052c7c5974b56482b441f779da74666541dff688bed54037dbc68f5843f2c7c5bd5db56bbbd373c8f898b1f9a92f1f1bfa73e26c1ba3fec3612d55a57393b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
129KB

MD5
47773d9d20b81f559a51c6e466586c45

SHA1
fc32fe0ffc5992855a0f261036b459f545b21288

SHA256
8a2da8f25d192a9cbd432d58f2b24128373c0d3f22cb28d83c4d3e4c8f5f1d31

SHA512
fa3fd19724afa379391f15b82d1e093197bd6b6cc22bc4d4c25322733d16f282b9d588d5cc98fa78ff367c4e4addf64eb369f9055b93cab268b6501a2bd46bc2

Download Submit
\??\pipe\crashpad_1192_XFJKPONYBDWCGWAR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit