hxxps://drive[.]google[.]com/file/d/1--M66qWhPgFtfR20V68vzJJPY4WJVodn/view?usp=drive_link

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1--M66qWhPgFtfR20V68vzJJPY4WJVodn/view?usp=drive_link

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
7	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
2240	msedge.exe
2240	msedge.exe
3068	identity_helper.exe
3068	identity_helper.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3912	2240	msedge.exe	83
PID 2240 wrote to memory of 3912	2240	msedge.exe	83
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 2632	2240	msedge.exe	84
PID 2240 wrote to memory of 3504	2240	msedge.exe	85
PID 2240 wrote to memory of 3504	2240	msedge.exe	85
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86
PID 2240 wrote to memory of 4552	2240	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1--M66qWhPgFtfR20V68vzJJPY4WJVodn/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff266346f8,0x7fff26634708,0x7fff26634718
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,290326593188770170,12957214020916642937,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5412 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8056b6acf76f43be2efb5f09e40153e4

SHA1
507ac17c6a190baa9b3e95ddf94baadd8abdc1ba

SHA256
de51b7aa06be457a944de22baf5d216c376444ffa52643046e3327f5087ba47b

SHA512
b50e1dd86caedefcb730f37e0fbbb7c5bf4720ef67d16d694fb29b764a1e401075b0c60a192ebc7316e08c5b139aad4205fa2a6b018b2cd94aafc8cf87b2dd8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d697b1d39938c0dc1d8db9a0d9e4da5c

SHA1
6bdce0666696d623d857a66b29928e38a4cbb04c

SHA256
1b212a2e190ab0076ad26900ccff7b8b75de39820a3f9995f8d9b52b46860e14

SHA512
dfc8eeaac900878e478c4b31a1c768d926e5d621fed58e290238489402b604425b1332fd6e2adfddddb71a224bc37060123c8846d66f1bd5ad31476639518ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
667444a52426de2cdc410494de707ace

SHA1
712a12fb3b0171b2f66cff57babda251ef29cf19

SHA256
58349ed53e4623f2782cc6ead26086613cbeff114f6986fdab5378d51b91ee1e

SHA512
d6f04952c473cdaa79b53aee83936be88b888c61b550b219a288758a87332a06f2ffd6f174abf49b2b20dba79958561a47ed02213b05402463b1bea52c237bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c7e1a981464eb0bd54e28d82e3158415

SHA1
aa612324f975652304ba9cca8977aa012da69775

SHA256
142daccc288bab59b5d0d792032b2f098ac1cd886fa9f735c96ab01d1bdba928

SHA512
64d854ae3da8c37f94248704271d6a2f23dd32fea9b501b4795d535a4cc52f97a759f61679cede28a0b606918afa55dbfa4f06aed2eb98041140ff162b8f110f

Download Submit