hxxps://drive[.]google[.]com/file/d/1Xg9NxSftzFRnv2Xk3qB7APEc6gADUtRL/view?usp=sharing

Analysis

max time kernel
147s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04-08-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Xg9NxSftzFRnv2Xk3qB7APEc6gADUtRL/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
1	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
5348	msedge.exe
5348	msedge.exe
3352	identity_helper.exe
3352	identity_helper.exe
1932	msedge.exe
1932	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5348 wrote to memory of 3984	5348	msedge.exe	79
PID 5348 wrote to memory of 3984	5348	msedge.exe	79
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 840	5348	msedge.exe	80
PID 5348 wrote to memory of 3276	5348	msedge.exe	81
PID 5348 wrote to memory of 3276	5348	msedge.exe	81
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82
PID 5348 wrote to memory of 1136	5348	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Xg9NxSftzFRnv2Xk3qB7APEc6gADUtRL/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd45b33cb8,0x7ffd45b33cc8,0x7ffd45b33cd8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,3233896267252138814,12473186689770532663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
81f4b8b461236520a0244c46c5ea5abf

SHA1
8d27a5aa118549a8076c5172319bf7a770467b05

SHA256
ace578a42c69897ad950f6f3ca8a0dc49d5a5c58f6c13adfa4e73d6114719d95

SHA512
33dd0bfa7415a55fa6e1f9489b5842e47b5556da4f7b689e1a479dc09025520fe9728ce6c64d8a9a46fb2cefb8da98c9fc2d1b3491cad118c3eceed024a5e556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d624d114f2338a4b8d177163e3f89c4e

SHA1
f60ef19d1ccbb43db47eb87ecccd15ed79807740

SHA256
46c21d98d0557beb5573c121a7f1b97ea76aebcf36a4834ef0e2dab1ec3d7191

SHA512
27db97c34a902445ed46a27f941538535a3196291ed52101840f2cc83e773f59bb4d1b3086c1ac8cb2e851ac122dcd49db06125b19dd63d5448cf08e7a1b5100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3baba40a2e549eaff73c4ceac59d87d1

SHA1
521af58b5aeb28450346e0bc1d501884273e4680

SHA256
0b38cb05bd5c42b1a7c479590dc794359457501a7740975529d7e4783c9642e7

SHA512
aea5d1d81dffd79f9da48325c713a0dbd40b170842570a18517d31b103a864c9b8f2068711c4eed07275a947fdefe7d6e3b2f1869fc3ee36ddda017d6d0b7b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c9e80e7988585e08e6dbc824ed2b2c30

SHA1
bdceb70f0b824988bd08ae5c825f218aa013bd24

SHA256
9e64c058d9048b9eb02d81f871117c79351f7269ff9db23747102012a76d4a4a

SHA512
8b1e778dac93bf3db0422c97536e61a3799f725088b0f4b3532912ae4f03869ee94d0b6d89b454840d195fea738f9cdb2e31aecae11ec846a916880592686fd8

Download Submit