hxxps://drive[.]google[.]com/uc?id=1069117wp6NIubGbYWKZnJtDuWJSMn

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?id=1069117wp6NIubGbYWKZnJtDuWJSMn

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com
7	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
5004	msedge.exe
5004	msedge.exe
6024	identity_helper.exe
6024	identity_helper.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3900	5004	msedge.exe	85
PID 5004 wrote to memory of 3900	5004	msedge.exe	85
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 3168	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	87
PID 5004 wrote to memory of 4984	5004	msedge.exe	87
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88
PID 5004 wrote to memory of 2948	5004	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/uc?id=1069117wp6NIubGbYWKZnJtDuWJSMn
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5e6c46f8,0x7ffa5e6c4708,0x7ffa5e6c4718
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7665087617794351140,10066035303926316335,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
795B

MD5
c561610a5715d09380752c8a26b2562d

SHA1
04dc21e038ccbd38ba58e6d09ed8fc6bd6c07056

SHA256
a57515997cc736dd065014a0e833750f1bf9ab40a6444cd40d4b0758f5718168

SHA512
184cceb90b6e4a51771216c426e77dc95a9942955747cfb96d8beece87d4ed915ddc47f2e042a090797c1bfc1b8a9ac6963b4abd9ebbace9b1da04e0d0a2da78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
229a2f531334b7ab5ef2eed610f5b546

SHA1
8f6020abafd75f96a9d8b6e2d1649a7d3acc1a37

SHA256
1e485b406cb3b257843f9e4963c5452a75428e4ce580ac3d48308eac6ccf12b3

SHA512
71c4ddfdc9b8d4a2c9c075142f4e292f2febc59558004c8b781d0f4e6a1a6b690dc56ce1cd163ae616da30c98a98f5d770de683599a45af8a7bbc9dc41e726f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1fcd00fd3bb9d6fa658bba32c81358b8

SHA1
a5d41ebd5111029ffe3222092a2bef1c41cc7ee7

SHA256
916dbbc50d7c1ec574ff1b3f72bc0e7b3813929411dfddda02f196170f1d0fb7

SHA512
7e6973c7afedc9f44f691915fa9a2e5e7316b79b53f07f17b0fbc3912bbcf165b8d84bed2d57a424cf847329d5cc6d067d67350fc1c161bbacd3aa4452702ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b47f4773831db69cb591d804aab51ad

SHA1
1987642a37b76754bb1dd7b93e3d1ddb782af663

SHA256
eb27a420f8c236b5e3df9b20e9a86f8d4775d692031540a9a42a931e52b7bb8a

SHA512
f0d2d1ba6acf8e4469066c023b74460c1163bdf0aa45ae0c541760e10e3cd8b8a8d4c0cbcb6a7cfbbb0e235d542a516f6b55ba002b2dfff9a2aa37ddd63bd58c

Download Submit