hxxps://drive[.]google[.]com/file/d/198Ud69g57YEa5jk8zm7k6t4OKnk3ohTm/preview

Analysis

max time kernel
7s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
07-08-2024 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/198Ud69g57YEa5jk8zm7k6t4OKnk3ohTm/preview

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
7	drive.google.com
8	drive.google.com
11	drive.google.com
64	drive.google.com

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3560 wrote to memory of 3068	3560	firefox.exe	83
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3512	3068	firefox.exe	84
PID 3068 wrote to memory of 3168	3068	firefox.exe	85
PID 3068 wrote to memory of 3168	3068	firefox.exe	85
PID 3068 wrote to memory of 3168	3068	firefox.exe	85
PID 3068 wrote to memory of 3168	3068	firefox.exe	85
PID 3068 wrote to memory of 3168	3068	firefox.exe	85
PID 3068 wrote to memory of 3168	3068	firefox.exe	85
PID 3068 wrote to memory of 3168	3068	firefox.exe	85
PID 3068 wrote to memory of 3168	3068	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://drive.google.com/file/d/198Ud69g57YEa5jk8zm7k6t4OKnk3ohTm/preview"
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://drive.google.com/file/d/198Ud69g57YEa5jk8zm7k6t4OKnk3ohTm/preview
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9706a3b3-8471-4e85-a24d-df943d97efbd} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" gpu
    3⤵
    PID:3512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {691332ea-681f-4523-8393-64fc17063958} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" socket
    3⤵
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2892 -childID 1 -isForBrowser -prefsHandle 2792 -prefMapHandle 2876 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7af897f5-2bf5-4c2a-9586-89b4c2e30b85} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:4900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3588 -childID 2 -isForBrowser -prefsHandle 3612 -prefMapHandle 3608 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4596a982-f71a-4d57-9512-bdda4c779273} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4496 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4540 -prefMapHandle 4536 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {545fb53e-a35a-43ee-b2d9-ab8e3007586d} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" utility
    3⤵
    - Checks processor information in registry
    PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 3 -isForBrowser -prefsHandle 5268 -prefMapHandle 5208 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a468a6d-6fb8-44af-bf23-3cd5cdfb4c19} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:3968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 4 -isForBrowser -prefsHandle 5428 -prefMapHandle 5436 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {849e7de5-9d46-4aa7-a5c9-6cd374db1b49} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:3292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5704 -childID 5 -isForBrowser -prefsHandle 5696 -prefMapHandle 5692 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4108dfd0-d0dc-4649-99d0-ab686c718326} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
a40251a34e48589387341321188f94df

SHA1
55dfa874f7e9b75b23d0be5e9d4d2b0047356e76

SHA256
2654838dde65b763df14543cfcae6fb90ed6e9909b51f7b184a034c237140a07

SHA512
b358c691501c039bde6e4a399632a4dabc768b71cc116498eac123f297560fcecaba3f3424f674d3b09d5fed29c3ad36ce5d307883e1c527a1e7f34772c825af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

Filesize
10KB

MD5
0a57c8ee459868539ba1962e17861ef3

SHA1
b435f11701b672fc0ee33ca5b793753680f68e51

SHA256
fa4df77642a504c4035022ce3c3556161f3bc2f8bea2d2ffad6c5ef861c81b0e

SHA512
0d6bab6f927214aa1b97e990760ab2b9f7b00b3c7f94c7f7403b5a8d18b96f0a15a2a134b0cf469891f88997e3b90d6da17125262116cfd72f8ff6b0a1c11dee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

Filesize
10KB

MD5
0bb0b87762bef3687bd65640e89d9c1b

SHA1
92ef9abf77c9a5c76e412bc2ba5ceba8bba33184

SHA256
67321ff791b3a6ff0f765553ebc3dc61d21df4c28e6c6c2a71a5596a735c248d

SHA512
7042490923a9a50b5ff448cea62a56c890fe089a1683995093f1dfc26eef9c79fca58952e7ab2f9b45c8c51180279cd526c94d54ad0265319f2683fcc03f7e9e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
1633ee7d6f78edc5c44fb8064567c3ac

SHA1
3c48a68163a51dcceb567708255ce2c88faafcab

SHA256
f2c74a7dd70d8021a4d55f0d7b1df4caa6a05c76a52cd3ee991f14dfd363449b

SHA512
7135dbd35ec1c6549d20fd89d0fc1c528ca109a8e87f7434b212bdc6d0615bb3ee8909605453704f3b633b0480f73d4664d84fe088d58d7096ca71c870a656cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\25c97190-ef02-4700-9a19-9a90eadd857e

Filesize
671B

MD5
aaa8232c285af23288e57657371df45c

SHA1
a738d65c08fa2fb494b5949a90e42f2837936fc5

SHA256
3d735be59dd0a04803876a6d305d77fb62ac2278fd65174cf1c778513fe6fd4a

SHA512
09113f313ef99ccf07acecff5b626366ad5681653c06d9aae96c0f3533d3127100ad43a047872e3167a1f4c1317020a1d4cfc67e9ccf82de6767a8cebdcace6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\47ff89c1-0b35-4948-8530-d7d33c97e80f

Filesize
982B

MD5
7b348566b4e2474d734c4e74ff926683

SHA1
f5546dee1eb4a4290b9f9b778beac476da2a218d

SHA256
76185f80998ae7c3f30a76b8a540e59bdfe0a2de651b2440b11af4fe408d31b7

SHA512
b9ddfa5f41f3f9681742dfcbf253b7f89a1808b4a878b4bd20b4452de306624939589075e3759868cbae4cebed9d307280ae0318d2846513622d5602a8ab3746

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\c56e1d7a-be4b-4faa-9613-6234918fcdd5

Filesize
28KB

MD5
8defab01680fd4ddc809d8a98a8fda2f

SHA1
1b50ad9c6e972e72cc773338a85c630d7fee2c6f

SHA256
97394788152fc27b6f5baa043a859fe3a1f10a4e79fc39158d1ecf438ae271ff

SHA512
b3153ca9e752a32e5bb413d949574fd7cf617febd2adc9498c9a975bfface228b419f440dcbd902b1bd2e30fd2d9a7476af2eda89b40425daee1efc881a88119

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

Filesize
11KB

MD5
7facad896aa39fa512b1a02871432ffc

SHA1
bd4e6f8dec00f9e7c0dcb7aa4efb5b1ee489c5f8

SHA256
d4be764fff8112d2b2ae79e924aed8470fb00d5b0d822c56c1d91c21fb227a9e

SHA512
75e29eb75366a029ae5e0a87682facd41aed91e608cc1f9d92212912d1384e3b57c55a0b7b93f29fc0070cc1db00dd5c3001bfa12f4654a390b9d7a806e20338

Download Submit