hxxp://drive[.]google[.]com/file/d/1RmzieyQNMSM7vaDQd0jDHfXG28ylz-EJ/view?usp=drivesdk

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://drive.google.com/file/d/1RmzieyQNMSM7vaDQd0jDHfXG28ylz-EJ/view?usp=drivesdk

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
20	drive.google.com
4	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe
3756	msedge.exe
3756	msedge.exe
4128	identity_helper.exe
4128	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 2640	3756	msedge.exe	84
PID 3756 wrote to memory of 2640	3756	msedge.exe	84
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 3392	3756	msedge.exe	85
PID 3756 wrote to memory of 2676	3756	msedge.exe	86
PID 3756 wrote to memory of 2676	3756	msedge.exe	86
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87
PID 3756 wrote to memory of 400	3756	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://drive.google.com/file/d/1RmzieyQNMSM7vaDQd0jDHfXG28ylz-EJ/view?usp=drivesdk
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfe2c46f8,0x7ffcfe2c4708,0x7ffcfe2c4718
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,22476315323888191,16246114211889030977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
233c9036d720e5915bb513e4b76abfd5

SHA1
54028b73c276f707d7f76631da253a3062cd237a

SHA256
94e1d698b19b0bd23d2a71f7a922725ce244f582f02b5cf92fb651d186e65350

SHA512
eff33dc403c5cfd097a1d2e496f3940909e40bb57c98b6904b425b0fc71e84adfb4557c3973e806903c1d87c42ebf0772abc08e9438466a0d425084830b38770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3be3b2c0c4c7535cb3f984ba403000fe

SHA1
4a6c2278ff623546af1f90ffb02f948fea13cc2b

SHA256
fa9a68f1d3e4288b27d603374208a76d60fce81e8392a56240cc072348707707

SHA512
9a4e40d2ffb9be4de5b925f52bf29f3a41e7c8aeb45d449fa816418ab1d219e25ccbf9f90492a336ff5f4fd054c233710c187d413369e880cc2e3bfc1fb2efad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d896ddb25b7e615e13f300f6931d8624

SHA1
21a4057a5837e92f543c0e8fe6e8a1cc1c269cde

SHA256
2db940e7d7beebc4bac941603dc04d9282f5e8b4ee32725750c742f841a87bbd

SHA512
5c876e58f8ac40775c7bb0092a9d6ab8cabb7da046ed9da73725752557047bffdfb4fcb8cb55e3a537f8e45c74542ad5326ae2b9ffcd296e2f0de33b6235746b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f6759a5e9062a5c94a3976e74df5d77

SHA1
9ceb38999d84f267b17a71cecb31486eb49afcb5

SHA256
33faee238489128cfc3511ff60b774098896668cfa6f57f1ae3155a67bf1e4da

SHA512
d57c45d440c3ff869ede6c9427c59f71b4fe0f163cfa99eb72080de0df5cc56725555f22e56d4c7d2d2707c9a00438e2e40484cb9bec48dc323716b5ba5cdf6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b3d0d2ae50028df19aa5a75e701daba1

SHA1
dd31a41db4a53269353972c632a8bfa9c78e5329

SHA256
71f87be4133a98a8b6e8134abc96b27ca8a888be062bdedd8e71b68229bcf06d

SHA512
d73256e6a074658bd6056ae50b4fb437d8a90ff29b574555309aeec07ba3c046094b105eeb286dff5304886a1ba80673fd1bb25a18e6bc104afa029149d49fce

Download Submit