hxxps://drive[.]google[.]com/drive/folders/1kMj4r90Tv6fr7dLVVyN4i_iMO_cjaZuR?usp=sharing

Analysis

max time kernel
27s
max time network
30s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
12-12-2023 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1kMj4r90Tv6fr7dLVVyN4i_iMO_cjaZuR?usp=sharing

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3544	msedge.exe
3544	msedge.exe
4948	identity_helper.exe
4948	identity_helper.exe
3548	msedge.exe
3548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3104	3544	msedge.exe	78
PID 3544 wrote to memory of 3104	3544	msedge.exe	78
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 4300	3544	msedge.exe	80
PID 3544 wrote to memory of 3672	3544	msedge.exe	79
PID 3544 wrote to memory of 3672	3544	msedge.exe	79
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81
PID 3544 wrote to memory of 3680	3544	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1kMj4r90Tv6fr7dLVVyN4i_iMO_cjaZuR?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe22f63cb8,0x7ffe22f63cc8,0x7ffe22f63cd8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,1247558383765944755,14648146535604388421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
41a11218bccdfcc7ecfeea5f7c5779ba

SHA1
b98ff4307e2f96f0346ba5752eb6e48440f46585

SHA256
7cd4e7ca53099250135a6745e5e4c22171a7ce3ce9a9492a57f360142b9172bf

SHA512
00b69f720cb5bc7ec2fdb3087d7e24f777dd7cdfbc31bf7d529f8dc7f51b9d44e50a75e2f3007a0d94ae98bd00ad3171f16d734a56d0f608009d1ff2f775d954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
b474df69a6be946d8715bcb16e679c78

SHA1
51afe1ede7364d556c8d71b5ef09ace0fba60823

SHA256
5303b5a8271ad670224dcb9d909510064b8fd623c73665f179693dddfe6ed065

SHA512
e5d46018ba8fbedcc7160a6131813329a87688e1ad5a7c20bf5b50be4312f36a1ddb4a4a37a821f2cee9d2171c46c21758b748b47af89ad0c57a20e293c3d21f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc08630636919423a4e0fdb20bed15cc

SHA1
fa25705745551aa0034e4b86c7a0c19b455fe2b4

SHA256
04f7a1d00052b84bfe4b75ecfeaccff9a78c4588e855f984833f6a87f317c5a7

SHA512
d90e1ed6a0a5a1e9fa3faebd7eaf74d8f92dce824553d700b17f59db76d87ce3537d22ebdd95f8efc1e244d7f718776fc73650a38f15aa21c0d902e8cc8fb3eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
ef76dc52649a022f4fd8a5fcc171ff35

SHA1
935d6a40e7b28bf6ae73410610ed9426a7a309c3

SHA256
c0358bd42f3f47f30b7e5ce07ee65bc2756a81decb01b0e5f0775ae3f3955451

SHA512
40773fefb10209904cc9ae24343e57deeb36278eb6288bf3410d5326c979757f66b577800516b2f718f416bfcf5ebbd906f78158c3098366d83b29d91ab00190

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
ff9a8757cd4b13a42ec3c2fc6efbe729

SHA1
e732602cea8de89c3e2a0407612d78ee5665b6d0

SHA256
364daf314f485bec6eb6e5d3c7c08744ce25cc88c5ee271ed8ae59147c2e44ff

SHA512
ded98561aff62b5564fd3fd67c2705333f4190309c759959cac4abed32cc8b7582ab6aa4ad5d9186820e35d394e19e4d1ba7090b05d7c6a976a038c3e0b80adf

Download Submit