hxxps://lawblogng-1319072254[.]cos[.]ap-mumbai[.]myqcloud[.]com/lawblogng[.]html

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2023 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lawblogng-1319072254.cos.ap-mumbai.myqcloud.com/lawblogng.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133343869982562699"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1320	chrome.exe
1320	chrome.exe
2920	chrome.exe
2920	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1320	chrome.exe
1320	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 660	1320	chrome.exe	67
PID 1320 wrote to memory of 660	1320	chrome.exe	67
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 4980	1320	chrome.exe	85
PID 1320 wrote to memory of 3732	1320	chrome.exe	86
PID 1320 wrote to memory of 3732	1320	chrome.exe	86
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87
PID 1320 wrote to memory of 4696	1320	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lawblogng-1319072254.cos.ap-mumbai.myqcloud.com/lawblogng.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f3d59758,0x7ff8f3d59768,0x7ff8f3d59778
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1884,i,12014563921886288897,7835733258280417614,131072 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1884,i,12014563921886288897,7835733258280417614,131072 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1884,i,12014563921886288897,7835733258280417614,131072 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2920 --field-trial-handle=1884,i,12014563921886288897,7835733258280417614,131072 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1884,i,12014563921886288897,7835733258280417614,131072 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1884,i,12014563921886288897,7835733258280417614,131072 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1884,i,12014563921886288897,7835733258280417614,131072 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3172 --field-trial-handle=1884,i,12014563921886288897,7835733258280417614,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
77ba7e94df918ffbd1eb266ea94e1b60

SHA1
819e33feb1766297fa01961466f48662280e86ba

SHA256
0e972bb4bcbadaae2978b55be6ac27a67b99d42881d16d03a339102fda0f39c4

SHA512
87683da45abed436394300f5ab35c634abd5211f903523d08b4f8304273b6063cd034352dd5e1e32b406315d06b88a3348f1b3d45a3b324a1c8c5574cbc73cdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
099ded8462c41eb0f3d6ef1a612e46b5

SHA1
090d801b4fc5f31e7fe1d96ffd82878d4ed57f2c

SHA256
4b618a11dd494341d7111ea3e02c9c7088ed65e2f6436d7b0067e7bcf3edf51a

SHA512
a92051ffa992737b8e95f3d5662b415a6c06222fabe4d04c2c15428d2cd45358fb7cf13ca11d0677c32b3329d401df3aca7145a466b5c1c8c166a98dece156ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
8aa57f5766b4d920e6173eceffc0fba8

SHA1
c36479007b8345e902a078c5d26fdcb081b193b4

SHA256
7098f3f3bcf09b98ec599a2009f3b026cb9d900cbac9f5b67e75d1432acbf6a8

SHA512
8383a57df706ada83a497e204aeecf46800fe786dd0d975a333a7d68d30154b4283a76a12a684921c8be1a1dd4d63021712daf68460dce118ad0a18f52a16b7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
46312bec4fc8951785704d3005f7181e

SHA1
7b6a963e8dca1a3aa009fb6b0d3b9b6a0a4e3f85

SHA256
aee011986e1dbf630a2d52ae0c31ef2159ca9ec4ffd58a0a56cc22c669f272d7

SHA512
b551494e0fe5859e350e1e44a571d7cbae27b8709fde63d9fd07750536a0a70bb23f5b612c5aca53f4d2624ddb826397a9ec5f687f845aea264bcfff7b707151

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
1161170fe718877054a0cf567ab99186

SHA1
78e9786d241b6f6981f46511b3638c08976b43aa

SHA256
64493abeca3d3a7b87078f06420005c93d411ce7d189e5aff8d15a381f760ee3

SHA512
ca7a07b3022e98fd8a1e7a71c2f00c6d28752acfe8d1cf153705318932084cfa8a52190cf1aaf1a60a5ba912a1af37598be5d5add2abfaaee4e420c07c20f353

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit