hxxps://drive[.]google[.]com/uc?id=1ABQ3JC4wcvS0kLa0U0utiJl4AXKouOiq&export=download

Analysis

max time kernel
0s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?id=1ABQ3JC4wcvS0kLa0U0utiJl4AXKouOiq&export=download

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1824	4924	msedge.exe	14
PID 4924 wrote to memory of 1824	4924	msedge.exe	14
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 3524	4924	msedge.exe	25
PID 4924 wrote to memory of 1644	4924	msedge.exe	24
PID 4924 wrote to memory of 1644	4924	msedge.exe	24

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeec0846f8,0x7ffeec084708,0x7ffeec084718
1⤵
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
1⤵
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
1⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
1⤵
PID:436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
1⤵
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
1⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/uc?id=1ABQ3JC4wcvS0kLa0U0utiJl4AXKouOiq&export=download
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,16623029063675921664,2182258470280842885,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5980 /prefetch:2
  2⤵
  PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
520B

MD5
a9f70267ea19938b28903ad9fa72c6cf

SHA1
5a7f65e2d7d2f1d0101a5502925a178f74c4decc

SHA256
866841e5a2751485c966e313cac4f14512a2c00650032c18709cf8f440c6bf2b

SHA512
3bad1782aedf1ce273b1a13e9a352daf04bcc1f80ce1d7582380d0fadafeca7409768e00cd33a162f1b31a91abf3025fc52122723571322770278b17a171831a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efeb0a8f9209a3e61b4341b2d350d709

SHA1
422449e07e7513ad696e078606f4cd06e48c8360

SHA256
27fd5501fa10cec3dcd39a43245b6379b88fbdf35d8cffd1766ea1049850dd26

SHA512
c735acb2443d06a704458f5bc9e096014307ed27b9ec24f298ded46aa30efca18a5fde5bc0344b0a43c29daa242ce640e9b5a7af174fb095c3a472d5a4f43ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
15KB

MD5
87530e3b3e7dd89a49e59390bf9be238

SHA1
a17c2914bb170edd104b77722f482ba2ef5b615c

SHA256
6c4f48375f13713b0354bf20960a84292fa58243a30e62341db32a47c9ac1e1a

SHA512
e99afbad20e8b5b134c3635770742a799fd99b747567c222fbf97e5fe325e46b1df346f727df92ca01148805b5a31215c2f7932d3a12e5fd91a2a61be43cc617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7505de2-338e-428b-b511-f42a67fa8a48.tmp

Filesize
2KB

MD5
4beebab580390379cafd9cad9d965db0

SHA1
c50cdc451ca79a1d08f7f317554ec20b4106b825

SHA256
35148f4fd57a28fc4bf9f88808f2f0b5f621af333de8427867c76876af83de21

SHA512
e66da10d446ab50f662f4c57755faa470feacd52524c1a5852ff1c1d657ddf132c50b894d3f88fc3c3c1c31730efe6343d482b9cfc717b42a09d14b18abebbed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
15ac7ed7bfd430ff65745b2103f2c63b

SHA1
7d03fe54fd14fefe810f804d4c8232a7e40a6f4f

SHA256
030e73dc84c90f5edfff1a6d210e765013fe11e5425a404fb131dd9c06f32089

SHA512
8342097ab2a5f3bd7d05abb8b3dd5ae2fd06f688abe864c4a12f91c30285bd005f0643d20641ed514307e39b698954b786e44a76c3b67953e26b6806df4f8f49

Download Submit
\??\pipe\LOCAL\crashpad_4924_VUTZSARPBDIEMRAC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit