hxxps://lawblogng-1319072254[.]cos[.]ap-mumbai[.]myqcloud[.]com/lawblogng[.]html

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lawblogng-1319072254.cos.ap-mumbai.myqcloud.com/lawblogng.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3772	msedge.exe
3772	msedge.exe
1664	msedge.exe
1664	msedge.exe
3748	identity_helper.exe
3748	identity_helper.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1664 msedge.exe
1664 msedge.exe
1664 msedge.exe
1664 msedge.exe
1664 msedge.exe
1664 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1664 wrote to memory of 3532	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3532	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 1692	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3772	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3772	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe
PID 1664 wrote to memory of 3860	1664	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lawblogng-1319072254.cos.ap-mumbai.myqcloud.com/lawblogng.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0a2746f8,0x7fff0a274708,0x7fff0a274718
2⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
2⤵
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
2⤵
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
2⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
2⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
2⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8306023922104055904,9736973369726277219,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
240B

MD5
77307227c3df304232b65c8ebae42b5a

SHA1
732b24e5b12404c3349f0c80c17d2f9af4e24b6b

SHA256
a90cfe07d54a6434afc28d0586fa38bc52ee002fb79d2698423d0bbbbf5d2b13

SHA512
bf5896a38dbeaa1375e45f239b5d737bca19881f470f88c8021fe4c26b0b18c3a3d9960842f68046b93867b329a208d0afd3894fcaff13a015d29c462f2e4089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
968B

MD5
8d01330af8c106d75fa86d6693ab7af9

SHA1
b62258ebd58b2d28d133ba77c66f88c967dec0b1

SHA256
df8cd85305d5dff6440e84ccc541cdf456c4e690a60c8978d190c7f6d710b457

SHA512
df73e79359ce03fd7f1adca9be0089c4736fd9d18ec400ed839c172138ffd957f5efe012b22b48873492b408d06643ef186c551853acd8a880756a0f5a246f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5f19da670e5b9882537c3afc9015bbb0

SHA1
25be41ff95dacccab83e4dd274de86e4085b4077

SHA256
b7c60b8e7cf367db394a0b3b543a23c7be3ca7bb7708f4c8958bff15463e68e8

SHA512
0e44a58854151426022b1c4851be94b1ebab9f2bd2b51d0790e3482565e43e0bd2a3500e7dba7936462cbc8729f023f11b5f442eef34a441e716bcb8ee44b7c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8f12a7ab2975d614ce0c4ffb0b3c09e0

SHA1
0191c942282b3cac41171ddcd62859f2498aeb8d

SHA256
ce7c14be6ced9676f9bab35de10e889215a854816324e1172e42a23ffa1660c0

SHA512
dc71cf81e0c42dd5c80958c6b88c2cb6bdac27ade65700874c747f2846269102358c7f035a35fbf4c96bbc9dbc9a4c24333ac72b11dbfb3e3d33ac35315e8642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
3f21e8ac4d1ff1ba65c527ff416120f4

SHA1
5e3cac70af600806553cd4f8eaa41eadc0eba113

SHA256
7edb02a3e0e51282fd5998a42555330497847cc13f48cbeaeba558fdfbc9412b

SHA512
f3b09f78dd7a39028f53f729e45684b885db6b6f33355490e10a90469a74cb486a7fa35181df6d76405751f76387b8470ff64aa3f34bc035d7a2ed06f863c865

Download Submit
\??\pipe\LOCAL\crashpad_1664_IDEHOWDLYBZJFYXA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit