hxxps://drive[.]google[.]com/file/d/1XjvC_w7FDHisZjQLuk16dtocdhzkiJVz/view?usp=sharing_eip_m&ts=66aa52be

Analysis

max time kernel
24s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2024 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1XjvC_w7FDHisZjQLuk16dtocdhzkiJVz/view?usp=sharing_eip_m&ts=66aa52be

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
4	drive.google.com
5	drive.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133669151150752578"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1632	chrome.exe
1632	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 800	1632	chrome.exe	84
PID 1632 wrote to memory of 800	1632	chrome.exe	84
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 2560	1632	chrome.exe	86
PID 1632 wrote to memory of 3040	1632	chrome.exe	87
PID 1632 wrote to memory of 3040	1632	chrome.exe	87
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88
PID 1632 wrote to memory of 3440	1632	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1XjvC_w7FDHisZjQLuk16dtocdhzkiJVz/view?usp=sharing_eip_m&ts=66aa52be
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff90b2bcc40,0x7ff90b2bcc4c,0x7ff90b2bcc58
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,9897103055864600286,6564638360745676270,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,9897103055864600286,6564638360745676270,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,9897103055864600286,6564638360745676270,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,9897103055864600286,6564638360745676270,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,9897103055864600286,6564638360745676270,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,9897103055864600286,6564638360745676270,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4992,i,9897103055864600286,6564638360745676270,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3792,i,9897103055864600286,6564638360745676270,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4464,i,9897103055864600286,6564638360745676270,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5284,i,9897103055864600286,6564638360745676270,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2180

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
61e6222567e8d0cde1c9b8923f4c212d

SHA1
da592eaca5db588f19d9396b7124e0a93cda3755

SHA256
47713781bea6e0f9730499f430f6b8d0b0ca852757e32d31c62fadaec1a48fed

SHA512
9edb0db9be6d9d6aea1b8ff7ed12b3bc195b959857546834c2bc4968da8be5de1434c9e68d360423a3a6f16e8e0fcf76e7c8ac95aff6ff7720810eb579f11c03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
20a42198689b6ae3a7b4d48c1012188c

SHA1
7453e5daaba771b6e85cdb74391411cce043a0dc

SHA256
2296f559d8ba64496a151feca1ccfc27059fac984169b0d271a07140735415b6

SHA512
8a3e6a6159b539dbc8051d65bbe8c0979a60bb1144c4f5e5e0c08882b40289d5293eba77c7a349ae4b0f18249b2fd6aee2b24e5374a886adc3bf9bdc072a7c6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
020d6f60927555d0427be8eea8d11112

SHA1
3dcefe136c0d41fa584f396cc82d9f121159dc64

SHA256
44e05146257ce07cfa379eacd58dd361abff475f966525e91566e7880ede83a0

SHA512
5f857ec63b9316ab8ff2d3ec43cf645893824b1596774591fa5ca8097ae90793a333f31840c6a277900f85e9341f79948d893644f446edbce533e7995e6b5ab3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
cb198ef21048cb4c32c6c78b20d4c696

SHA1
940f4c99f004a907e082a5e9cb4857b2584cc265

SHA256
6d7dee80cf7ac7389af8edd607717bf526a8d49c6994c307988951632941677c

SHA512
2bb22b49b216eaee940522a7afd8ad29e93b78b2c3ecfd915ad9db2e1a222a26e5ab0a7769bda93e49ef04772be1adf3fbc6f6ac25a00318434391c72f2b98e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bf38f722b87a212bcd00fc860e17d2fd

SHA1
601ffdefc69b89d0b7bebee8d9874d39179e062d

SHA256
dfd9f88eabcdff240217af86b09ca07894a65098e19d16151805bcfcf97587ee

SHA512
27a2330804106dbcc87af498d5fa1a34fe08534bec7d98f30e8e4c0204664e93047a8294ceee7f8df443ea4e01591c7209c98b993aefa8170a9e13d438ac6057

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
8d486c0b1191bc99c6a1a31bf8abaefe

SHA1
296a1925b5fb5a22a11486c5df69e21d3ff567b9

SHA256
fe7acb75c9a6f0cadff270b6dd4284ab12eb9ad49c220572b1a9ef71c9291f46

SHA512
768c49bf108e8e4125e77f1b5347192f13b527795da1c83f990d511909b4da1cc5967078fbe5e7cba3d0ecb7b71bea508f19f2f25876547641a27f317b213ee4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
34218f2d1d8a46a2e72e445b4294f2ad

SHA1
3c37a289e932d7a7041969c1695b4a958d875aec

SHA256
aa77256c3457a9a78d418e45a043707ede3f193dd45fa87a3b8814106b355df8

SHA512
615f524d36176b14e6603452e605873a7af9782f8424ee556c87f18f09c0a0e22b0c8ab8bdd7a574014c8461b82400fdff9b3196e65ef768be90e1021e2ec4d6

Download Submit