hxxps://drive[.]google[.]com/file/d/19tzOZjXljm9Oe3_VMxASJdCMQFg4uD-a/view?usp=drivesdk

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/19tzOZjXljm9Oe3_VMxASJdCMQFg4uD-a/view?usp=drivesdk

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
4476	msedge.exe
4476	msedge.exe
1752	identity_helper.exe
1752	identity_helper.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 488	224	msedge.exe	86
PID 224 wrote to memory of 488	224	msedge.exe	86
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4436	224	msedge.exe	88
PID 224 wrote to memory of 4476	224	msedge.exe	87
PID 224 wrote to memory of 4476	224	msedge.exe	87
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89
PID 224 wrote to memory of 4392	224	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/19tzOZjXljm9Oe3_VMxASJdCMQFg4uD-a/view?usp=drivesdk
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc7cc46f8,0x7ffbc7cc4708,0x7ffbc7cc4718
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1752739765706591118,6037021845989239120,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
f647e1867a5c9ab2d99ef44fb69d4f62

SHA1
4451ec60347002c7d5529e943ab6be757eae8a6e

SHA256
8c1904525bfd508b2e6513251d92a6a1afbe361c569e9d8f7ef41cffd345618e

SHA512
6591572c44cf8750159906fbfdea59eb2ffa9f2c7fa2005684788be3e6c4595647b3934b822952d86cad45bb7aec674b331544559d75b494e92b21fd541f74d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
01a4ba71199eb81c034d185c99fdd59a

SHA1
66e81854145b1b546c90593431fd303c58d6a374

SHA256
eb251b0fb3a40cd37695c77859a2f859e2547fd26457a024c14c9ebada62f2f6

SHA512
121052fad3945fbf6b49a8ee06900c6a8b89daec51d4bf3c390e8576a588db84c337b028deef26346c0873584761adaaa9adf6e31fdc6b4a9a89b8922efc5d38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0748ab94646b0d121200587488a4b38f

SHA1
a029dc2ca25773cdcbb0e556bf34f36bcdbe6173

SHA256
392255dca16d48c37b111a540285dab86f8960d9415c7882b2985a3284c0ae43

SHA512
39dcdddfb7f20ce592697e0ece35aa96da13c89eb6dc62a4a6c2d836375d0931a97862c58e25c3ed99098025e4628f1522e384f33c1fab361ae3f962aa29fbe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb2b9ca015f3dad88d7958d1b7a376c6

SHA1
cf6967654e0d4e9d8b254a5398e78502c36b474b

SHA256
f8caea9326a816bb1a4752208abf609e6d0cb823fb4440d0ddbbcb326b2b9596

SHA512
7b0a8c93ce95299ec7a16d281fbc723a3e7ee9103b74ebd0c964d589d099a1fdf58093316bf5b7406cc2f3b4e1d05fd16c9bba7cdcb984cc1903fe0dac2da43d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4a33ba79820e9156f5cfefcb3c0ddf8d

SHA1
ea34d774a19b9bcf469360c6eda9ef8e3343285d

SHA256
59bf848470ef4bf158e3e96ea947b5d78645c01edd8d937118e439bcdc2aa489

SHA512
d40c9a739c007ad372b059341f88ecf698710a8bdbaddd35cbf0532b2b036e9ee9f5472c2e33c2a370c9844277d21069f180e7fb581d7c5b5a1738aee9f09c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
a553ed37741112dae933596a86226276

SHA1
74ab5b15036f657a40a159863fa901421e36d4fa

SHA256
ec16b2f20ead3d276f672ae72533fcc24833c7bcfd08e82abf8c582e1bed5e87

SHA512
25d263aeeda0384b709e1c4ec3f6dba5cfcb8577e026d66846c2045b543f6446439b946163b1ea8f7e53cc6ebf38c93172452bd43e2560b42b56c4d13625e107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
1fb46de8319287d98b0046349ae01866

SHA1
557eff80b17ec7a8c92e2387621e573a871fd19f

SHA256
a4ca26f6eeb9975d71e96fc50221d11162beeb7f1b0c53f0588ba83bb6c2824b

SHA512
5e67f91fb51bfee747278b7b921f048b6400067ea201d3e0bf8d9e1bf9e7910394d0b114c39bbcdbf3605e99e03f2a06cdf456f20927753e80a1cea244c87985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c781.TMP

Filesize
203B

MD5
f951a39800c7da39f3a60fd536040479

SHA1
f8363188068ec93cd93ba6332dbeb783a36aad50

SHA256
e600a7f0954cf7a6b61f319a485e24d802a9e30ec7cc7d082dffc9339ac42e6a

SHA512
89962f496f5238baa2370bed136aee42606b86f50aaf2e80b5bf766a370f7912b686f594f4919b02a550b6f37aab0fe1f15c8cfcada4e4b6b5e5316b21aaa1fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
68a96796b280f2854c1b8aca459d1cf7

SHA1
e2960f243219eddb6c55b310c2fadd0ca1fc0a5f

SHA256
31d966e43fb1baaf00b9353302988eaa31dde20f714739f87b1ae34bf04814de

SHA512
2b4768571b7470b28cdac634f6dc69a850fec249d7eb84e77ed7a6c57d3c291f3cebb3610364a27689c8516fd9b9fbde6ffb2bcb09a8f1b3fb748ac65cf8e9b3

Download Submit