hxxps://drive[.]google[.]com/uc?export=download&id=1mYGTI-J4aG_UcR0edjEv9eSk-YaBwO-v

Analysis

max time kernel
82s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?export=download&id=1mYGTI-J4aG_UcR0edjEv9eSk-YaBwO-v

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
4	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133676099254100028"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4032	chrome.exe
4032	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4032	chrome.exe
4032	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 1660	4032	chrome.exe	84
PID 4032 wrote to memory of 1660	4032	chrome.exe	84
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 4784	4032	chrome.exe	85
PID 4032 wrote to memory of 2796	4032	chrome.exe	86
PID 4032 wrote to memory of 2796	4032	chrome.exe	86
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87
PID 4032 wrote to memory of 4828	4032	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/uc?export=download&id=1mYGTI-J4aG_UcR0edjEv9eSk-YaBwO-v
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9ada6cc40,0x7ff9ada6cc4c,0x7ff9ada6cc58
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,9156996733655289138,17463079148022920067,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1856,i,9156996733655289138,17463079148022920067,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2548 /prefetch:3
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,9156996733655289138,17463079148022920067,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,9156996733655289138,17463079148022920067,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,9156996733655289138,17463079148022920067,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4560,i,9156996733655289138,17463079148022920067,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:3576

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
3f12653854ad285cabba47df4848445a

SHA1
b36871ee4a05a9375904b72676160b178d7ce152

SHA256
8ff4e9db1f392895f8d909839760fbe219dcbec7b2a6b42bca50a84c866bae7f

SHA512
f488d6ca51e3e9a890544afdc2da9fd993d62ba8f4d6d36b371f285bc28094f1e07db7c0bf7858baee8c8974ac4511106c96b99687a1ee0b3f03c0f8f64ae1f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
581717b3b904b66b0e635a0261a4b6b4

SHA1
b0c7e88e3748924529ede4c03e96223dfd710fcf

SHA256
6c521330972aa17bb502cbbb995f66949bbeb5596978d1977012030423342b85

SHA512
6a49978736be15de7bcbfec7e741598291ead8c3a99b7e2b622bd52aa21868571493628e12668f94c38952a9eb80636f9d20dca2d726e3372f64559d012d6431

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
27a1ed929ed1e53a107552126c752b97

SHA1
d0630c0e3ac965634ae7cc3e7f407778c6586b0c

SHA256
a36c5da5ca6543c75eee1017e4ae6897456075d1ec39cc8b5a9e3b960077ae6c

SHA512
d6c7a907be74c28a24c30aa4777c4eabdcb73ae3f33b1099fb90f64dbe29461f85463812aa44a2470bb0f8b3c16436b59316add09724a05183c63a4c6ecfa092

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a12020552207fda9bae2abd6d4a1a462

SHA1
75e494026f412c373678806cab235f9300f887ef

SHA256
b34ad9edf6e566213aa3faf3ce6a0c7acdd6c7f3a8a8923ade4af68188ab85c6

SHA512
73490edf10df897c5b4f42893343fa1a6cc2b020d08f4b25d82a4f55bb7bd339fa5c8ce68fc1acebfcb383f9dddc92a8d39b86031e8180ddaaf7a31444ad162e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f225b74a64290bf7704b81743dbc2261

SHA1
defcc18a785daee099ada87920f01a0479cda2c0

SHA256
cd36a0b7e197184d54c52ac943e2c2e12f055d608f8d16ffadd8420b21580f4b

SHA512
438257a051f61f22b3ba1b97dfeed8c760a5c6612b97d36d39886cb9796a8560cb081076fdded13c61d2587808561e3407fefb47cb406488b5aa8b1b6a6082db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3d97ec86d706c227c2380051e3ba009c

SHA1
a47f538462e9f0918073f4efb6f48ef901d9e7af

SHA256
c38fe8bd9609113a80bc82c1aa572ad1117257fbfcede56b9a92273610982ebc

SHA512
db873c9660944fd9b2efa159b3c50d292a1cabef114317d4af9690c988805bb470b371235be7866447b8a6e15ac343f888565624e5f26f6b262002a6adb610d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e21040dc-8af3-42dc-9564-3b301ab50fbb.tmp

Filesize
9KB

MD5
a76b48b6925ae3446bce6a80771a77f9

SHA1
3239845127d86ed7bd33c8a996a118885bd5221d

SHA256
b0bc185208a89614afb00007f35e565315e969b15375ca8a5ad023b7610aacc8

SHA512
297c89e043788bf93fd677b6a2acd60dee930b5b482a8267f4a983cb2a05e8e93a6befe57b109ab4becaac915fe92024ad768a0f91701892f09c098fb982d90e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
cde1f013debbab67e9f40e1b305fe456

SHA1
34efb673946c8f964412385a5d431196bae29598

SHA256
df41f8e208af507400aaf8bc7101ed6d48c73f61ac0a39af8a110fa398adb2e7

SHA512
bc9f95a8f0562382edb054acd63a1d1cb70a4333b31a25b787b78b0c67d60f62733043a2db6342dbce4321a98b975a3f0c5bb32088c0a3de1bfd703a9cd0377f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
c01fa36554fb779ce5cd9f6e18532a1f

SHA1
1dbb0a079f8a8fb6b49874dea276480c7224daab

SHA256
24a02b05c69add33dd633682cb0859b3acc3280e8a5e5208e09f6054b520ebed

SHA512
c632eb5aa570d4418adfbbccf321ceb669d9b108352bc135b18b8040df55e7c032af9d104fc9c8951d4d13c9d202a8c7ede448b36bd7ea4046627fd75f0df13f

Download Submit