Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-08-2024 21:08

General

  • Target

    https://drive.google.com/file/d/0B54D1KS7OlRVUlZnWGZ1LTVMODI5QVVRWThXY2pSMWV6RHZJ/view?usp=drive_web&resourcekey=0-1I2j7C88jtGQrdwUWsIuvA

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/0B54D1KS7OlRVUlZnWGZ1LTVMODI5QVVRWThXY2pSMWV6RHZJ/view?usp=drive_web&resourcekey=0-1I2j7C88jtGQrdwUWsIuvA
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaba0546f8,0x7ffaba054708,0x7ffaba054718
      2⤵
        PID:1364
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
        2⤵
          PID:4120
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:948
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
          2⤵
            PID:924
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
            2⤵
              PID:4812
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
              2⤵
                PID:1896
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
                2⤵
                  PID:4952
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
                  2⤵
                    PID:812
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5044
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
                    2⤵
                      PID:4508
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
                      2⤵
                        PID:232
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
                        2⤵
                          PID:664
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
                          2⤵
                            PID:3056
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,15560887737305569739,17754284551200623835,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3416 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4524
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2196
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:528

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              ecf7ca53c80b5245e35839009d12f866

                              SHA1

                              a7af77cf31d410708ebd35a232a80bddfb0615bb

                              SHA256

                              882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                              SHA512

                              706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              4dd2754d1bea40445984d65abee82b21

                              SHA1

                              4b6a5658bae9a784a370a115fbb4a12e92bd3390

                              SHA256

                              183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                              SHA512

                              92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                              Filesize

                              41KB

                              MD5

                              9a25111c0e90867c7b8f41c5462abfaf

                              SHA1

                              0619625d479f31cf145c2e3714de0df4a69169d1

                              SHA256

                              41bb42020f1beabc9e72913ef6a33aa264556ec829ac70fd92c9c9adfb84803d

                              SHA512

                              0fbc3c64d6f5acc2c0dab67924b0c669fefa994f449240d1f6b78dcac3538343938a4fae972726156189f05806d3aae0e333035df52605ffe28886b82f31ccdd

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              936B

                              MD5

                              c7f761a1171af4d7449fb785c5b1c218

                              SHA1

                              d98274471eb771bdfdbca766ae88d8ea4df76e87

                              SHA256

                              304f036a0953febccad85e82a2f4d68d7c41d8f1e620cef1422b7695a7d6bd5d

                              SHA512

                              ce6b292520b9a2788170e5572a5fbb7e26f79550132976145b19e1347184dffbbdb514e7ec04de44b23b44ee61e8b10951220a72199d1c710236b012d4c545ce

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              111B

                              MD5

                              285252a2f6327d41eab203dc2f402c67

                              SHA1

                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                              SHA256

                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                              SHA512

                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              21aabe2c9de22847f15b066b88cc4a05

                              SHA1

                              b07690f6dc1d2ac41ba020008d3666b6154601c4

                              SHA256

                              3dae696dc20c1afc44fa4e92e7c95d32c5a3d48b2b8c6edc18a2f109353cb5b4

                              SHA512

                              608c4f1b4593b215f73142e092b8c66b3fcbcf3ed2a69c47220d748862990daa73e28e301bb313df760ad443b74842b19ef86a3b70dbd8214c6a4459c46afd32

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              736824b5d0b547db3fad305d571e2a18

                              SHA1

                              0351263f7fa7d182916ec892dff4a5f64ae5f35e

                              SHA256

                              19f362e2f02e07302ad27a39a75c222248782fd652e6b7f28a4534c30200879f

                              SHA512

                              1977e77addbc515b83d1b24eda3ddced617ac487c87f3be774e62f11dd1f9a7eb8459f97f1b007073ea873be44c15ea4736f1d47b50d911f98efa4048c17ee4f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              27a132ff02ad4b9178a0dfda06f9e1c0

                              SHA1

                              aaf56388f473e25b8a4eda59556423ca3ed103e7

                              SHA256

                              1a762c41be9462ab8aa9cbbd25a4a5595d4ec3caa904f9bf30ace385eda7de54

                              SHA512

                              9ae1a835154b574b54d97124fa3b45630a65b391f6fd5468d653ae646b6bd54d8675ed2d31f8d258ff2f69ca09c44bbf7bec90be8fc9ac4d5c5b0a1c04899c5b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              39fb37565ad87ac0c66a614dd029bbee

                              SHA1

                              eb9e6ff7a48a366f251e9f594afedfa9db67315c

                              SHA256

                              06a2d139a3065f66a843648aafc6fe4ea1326376b274c16dd66fe9d099bad3ee

                              SHA512

                              9187278edf439cf0aa20efbca7c3a5fac5fcaeacff568ff6558e95058eb14b378b000db2af8fc615e55a417e0ca3f6af49a22f9bf4d6510316ce4d7463183cbd

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              677bd304d5951ca2ed1a67cb88ba7732

                              SHA1

                              40e10a5649ed08a7262117f8f60ba385c8dc4cef

                              SHA256

                              2d62c9a49b3045bb9582c92620979df06ce135ba64062d628d4c395869798a46

                              SHA512

                              262e7ff46e203e46adeab155a80185da7b96348b52f131e6b816c9bb4900ed60343b3fffc377dd0647ed7ac44fedd278769da57a9a610d356e38943a85e573e6

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              45774bcd7e4e1e78f72dd458fcdee86b

                              SHA1

                              09b9a5bd0758db09bbdae58f7e35876a24b50bb0

                              SHA256

                              e683444ab09f4e83a8e78cea1696855411ddee58f8caa2ce143dc3b9708bd28b

                              SHA512

                              2d9142ae5a0d707db7f97de1398531c2e94ae50f4a32d6980ea95630d4cf72e8e06156f882a8b2e15a3182c144df2c5dae38dd65e79b13c1d037a060a970017c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              43d3e17db79653ba5431a6a819b28ac7

                              SHA1

                              e3baa620273df720357f7d314fe85c2191d48c6a

                              SHA256

                              caabb1a2aee304bc79657a7981bf01266f5f7fa61dbcb73a78cf30244d5b6e10

                              SHA512

                              228bb384de8f33447e562a827f23f78272ca3e1418746bf6cae84d4c82f52645777522caa27ad1b6cb98d03732832cc5ee2f9a7828b7f66ac28b26b072d7e7b9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              30358fdea7011b04520a88873cfb73ba

                              SHA1

                              aa54420580c89b05a5a58c1ad087108032d80891

                              SHA256

                              ef947ffd7c0dcb1ee1ca5bb7cfd9aa0dd8cdde1d464db6ff60ebe092b8db44a3

                              SHA512

                              d93a6af3f5872314e5632733375ed282ef96aae96a8f3d4a36b07cd8df5509418cf79788c83acb7e7506097de0bf52b2f98a1431bef4e2057af0869ec2a4b20c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e53f.TMP

                              Filesize

                              1KB

                              MD5

                              8fccded929eda2f217c9f133b7f4468e

                              SHA1

                              ae6d5d3a4682d15a9c30b473853995ea5d003649

                              SHA256

                              44ead9ee88cad43050ee56f5d8ad738ba42173dc1f2cfc3ebf227c98d85483d3

                              SHA512

                              0b10b518dc129c57c086ea513e3c6cd5f502de66fb802b479cd1e87c88761d02c4fc0b5f0e5f48cb9f918921afc2c56d02506fa2fc5716c05495c8fd87e0ea1c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              c9f87243a7db0007922bfca503eb0f05

                              SHA1

                              828331b8eaf1b1bb519ffcb5d0c1de501038852b

                              SHA256

                              01cdf84aa70d4fb3398ca829e2f3380e3c71cbde1ca095bc258516e16fcd6551

                              SHA512

                              081307e260166b42a4c9bd376c5414c463842f0b88804a19046dc0c018e442bad159d6dccaf550abbe37b86ac5ac72101ed27c6a545832b8cfe4a6ccabce57ad