hxxps://w2quw9sibcp-1324839608[.]cos[.]ap-bangkok[.]myqcloud[.]com/w2quw9sibcp[.]html

General

Target

https://w2quw9sibcp-1324839608.cos.ap-bangkok.myqcloud.com/w2quw9sibcp.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133553761059883127"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

3160 chrome.exe
3160 chrome.exe
1688 chrome.exe
1688 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

3160 chrome.exe
3160 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3160 wrote to memory of 3252	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3252	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 3608	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2424	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2424	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe
PID 3160 wrote to memory of 2444	3160	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://w2quw9sibcp-1324839608.cos.ap-bangkok.myqcloud.com/w2quw9sibcp.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff971ec9758,0x7ff971ec9768,0x7ff971ec9778
2⤵
PID:3252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1876,i,9358831532934822195,1581848346372998101,131072 /prefetch:2
2⤵
PID:3608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1876,i,9358831532934822195,1581848346372998101,131072 /prefetch:8
2⤵
PID:2424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1876,i,9358831532934822195,1581848346372998101,131072 /prefetch:8
2⤵
PID:2444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2784 --field-trial-handle=1876,i,9358831532934822195,1581848346372998101,131072 /prefetch:1
2⤵
PID:5016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2804 --field-trial-handle=1876,i,9358831532934822195,1581848346372998101,131072 /prefetch:1
2⤵
PID:4372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 --field-trial-handle=1876,i,9358831532934822195,1581848346372998101,131072 /prefetch:8
2⤵
PID:4564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1876,i,9358831532934822195,1581848346372998101,131072 /prefetch:8
2⤵
PID:2116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2944 --field-trial-handle=1876,i,9358831532934822195,1581848346372998101,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
74f19b86b4d2e3f1865418c8525676af

SHA1
e797bb43746827472ebd0aa3277f4e1332e3d451

SHA256
0ce92523fe78d0a60bcf6efde70e6f8d72e3ef652445fe9170435757f744df01

SHA512
5abd21adbe4a462c2ccaf4bfcf86683bc18e01a7a7d480ba18827e20559f2083121984920b8ba21f5fed3d02110ccc2764d0f4731040ace7b41ef195f176d732

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
ea26ac46ab8551d86d30ad5024e62bb6

SHA1
2d38a290b762dcc610541f0cc797606e6feb19e5

SHA256
475e910a5ff487ed840dc2734e1c443a9e62beb131d457373d7ab2e1d4ddbc9b

SHA512
756c243e5376901fd3a8e8c9837b53e0d7635a800b49879af019b645d18c0d5202edf0fa1548890c07d6eddfc6c222520313006b9dba4171a363d493a69f472c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c11384629c030203bd9d28507f670e52

SHA1
75917d89f059137ce1842ffda246876f7684c4a7

SHA256
646ebf5bee2bc7ec1c4c01e8e3aa46caca43c9d2bfec2df775c7426ea25455fc

SHA512
9fb4095b8f8073808fd4ee6286557f548cdb8b8d12d41d9aad18d80f56808b4956fc66215b670cc5a677c1c47e2efd9520dd6e76716b5ee764bc373251b9cfd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
1f5fae514a36b0e1a6c4b21227650faf

SHA1
bf35f73c780378a48f5ca39edfa40ec0590addc4

SHA256
0d312a71f0fcceff6f11bafad4be69646ca83999edfb36de75b91aad487eb53a

SHA512
3b90511d5d81ad7a2b84268afa75aabec9d8a544dd523a339c35cd224eb8fb0fc5a8f3fbee3ad90f25a632e91dc803be28625d084c57879410babfa4b502eee9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_3160_PXJZQAHDWBVZVUUC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads