hxxp://tawnlfzkel640fc8f766961[.]andergc[.]ru

General

Target

http://tawnlfzkel640fc8f766961.andergc.ru

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133238027655176365"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

2352 chrome.exe
2352 chrome.exe
1624 chrome.exe
1624 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

2352 chrome.exe
2352 chrome.exe
2352 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2352 wrote to memory of 1868	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 1868	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4788	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4788	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4528	2352	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://tawnlfzkel640fc8f766961.andergc.ru
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffea3969758,0x7ffea3969768,0x7ffea3969778
2⤵
PID:1868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1816,i,5623173335893560788,3979268500796451236,131072 /prefetch:2
2⤵
PID:4068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,5623173335893560788,3979268500796451236,131072 /prefetch:8
2⤵
PID:4788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1816,i,5623173335893560788,3979268500796451236,131072 /prefetch:8
2⤵
PID:4528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1816,i,5623173335893560788,3979268500796451236,131072 /prefetch:1
2⤵
PID:3956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1816,i,5623173335893560788,3979268500796451236,131072 /prefetch:1
2⤵
PID:4708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4644 --field-trial-handle=1816,i,5623173335893560788,3979268500796451236,131072 /prefetch:1
2⤵
PID:3356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1816,i,5623173335893560788,3979268500796451236,131072 /prefetch:8
2⤵
PID:3196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3912 --field-trial-handle=1816,i,5623173335893560788,3979268500796451236,131072 /prefetch:8
2⤵
PID:4548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1816,i,5623173335893560788,3979268500796451236,131072 /prefetch:8
2⤵
PID:2912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=748 --field-trial-handle=1816,i,5623173335893560788,3979268500796451236,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
ad5931e1d9e792b5761921f1e9af3ea1

SHA1
038fa60456292046eec82649d36148076180913a

SHA256
e1feaf311d1f0364ebab3e2eef90daf27c4ab1f7f89a3be77890fc11974ff051

SHA512
1726d69a0e972e13e948bbb85f05e5f06db6f0162457eea24ec0117258a2bc54682d7f9822763e475a5d7ee76672b22a3557f2107775cfd37795cbadb1c0e78c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
c64fa1050c840b50dae546b910e2a963

SHA1
caf7dd9d7aac00cb2f1ddd79487238d0abe969e3

SHA256
17178d3b3421aa8ac53b83db166315cfd90357ead0a41113122c36421e111fdf

SHA512
29c8e5101d3082ee3120c1d6a2d2fede780696de5a55e184e2eececfcdc8821b5c2f7468abee8a01d0c4569c905c6b82add329cbfe63039f31688286b4ed07f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
7a10020e5dc0b832d95314e9de5a13d3

SHA1
4024e719f528450908ab9ee90a800880319ff191

SHA256
56d7a9bd9ba35ece538a919c19be9096a0ab307c900036266ada93bdd50b848f

SHA512
f504f120a3c893908d5ff2b8337deaf3dc66b25b7ce3669524a2c278ad4f5289b6728f61b11dfe938097866780c25fb0730f7ffd7cc38ee2baa21d596cb27560

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
2efbef99fceca9c704f1c865f640e26b

SHA1
baf32d33ce057824fd1869117dda4ca524a31e54

SHA256
ac44942e7d0766c4de041b9b6629102c725234df6dfa5b5ac3c8c4f29c6b8d1e

SHA512
6bdfe23308bf38282727a4ad9661ce702df863d270ee953c1874b56918e2f4de487e9b980731d2f47d5b265072782f1b7f8253005b1db083d2483dfd353b7817

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
143KB

MD5
6373ddfb8d91ab8aeecab01153f1d11c

SHA1
410c4617a6606bc01589e0d6af50a69f7e381cf1

SHA256
cf9ee8ac55fbf1739fe5433f1eb5045ae3078dbd3eb2574c2e5435665532e342

SHA512
0644bb2974f21286347789e2024eb6ac6881651662c2d4b05701b1d5abd983282e92dbbbf93a0e59a73b4953a18063a598ea009f5dad4a2d9bf660b9cfd06975

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_2352_TLAQEFHZLGIIZEXL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads