hxxps://drive[.]google[.]com/file/d/14KxixzUCc1IisKStNtUM20xZWmZj6O2-/view?usp=drivesdk

Analysis

max time kernel
35s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/14KxixzUCc1IisKStNtUM20xZWmZj6O2-/view?usp=drivesdk

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
6	drive.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133679071933084362"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5180	chrome.exe
5180	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe
5180	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 5156	5180	chrome.exe	87
PID 5180 wrote to memory of 5156	5180	chrome.exe	87
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 1692	5180	chrome.exe	88
PID 5180 wrote to memory of 2804	5180	chrome.exe	89
PID 5180 wrote to memory of 2804	5180	chrome.exe	89
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90
PID 5180 wrote to memory of 5008	5180	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/14KxixzUCc1IisKStNtUM20xZWmZj6O2-/view?usp=drivesdk
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8a8d2cc40,0x7ff8a8d2cc4c,0x7ff8a8d2cc58
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,3994463835320518380,2650409876276731714,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,3994463835320518380,2650409876276731714,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,3994463835320518380,2650409876276731714,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,3994463835320518380,2650409876276731714,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,3994463835320518380,2650409876276731714,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4532,i,3994463835320518380,2650409876276731714,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4364,i,3994463835320518380,2650409876276731714,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:5452

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
742353b60872e9f9b386c692e0b1de2e

SHA1
425e18c1eef9a0eb0c9a89c3e2a26d158b10ae9d

SHA256
2361b581f4be93c3881904d80b747aec9f35cbad792c1026400e111eaed8f6d6

SHA512
dc4971a18812996e76c0b1e8be32d626ccb45dc6b76595e5d0989d660f7dca465e6f5a9d5b4cbdc1334bddab1aeaaffa881dc1cedbd762475e940008ff65aa3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
312B

MD5
32f3c962d9b26ca67105a8d89c628fa3

SHA1
a3738d59352d60a23009c5e0991c6076f368329d

SHA256
5ab7c4dec641a4c97d2dc3923b45449494094e266309ed76180f741b60441fb9

SHA512
9dba4b263660830d4e122f0a31d0058bcb41de11f1137f73a59182d58b24fddf8c9dae487bec4646f938ac427ea730a41eb55714bef3bf517d5b18a2e3f38887

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
23cd1a250c43f3e8423cc4624b1441da

SHA1
a6c4f8934ad7eb3b813bbea1c880b2eeb4874526

SHA256
b9a9140a48fe87f495182f36e5241572eaf182d3a6f4cba32d9f61410502a49b

SHA512
226d473ee46d20eb7f67309cb85a202476b0f779dea40331426fdd5881fe5ddacbfe31fc1dfc9037eb5cde884b14241cc267c0a350afb3750e0ffcef79d58c6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
56a1cebdea2f9af9d07b0ef3b0bda17f

SHA1
22f82de6ac8fbd2532bec0c47e96f32a9a2a53b8

SHA256
2f5fbdf44eed570fa3949706fce638c28ae6d12dae71d712f5f2ea8d3e137833

SHA512
45fa8f23329bd68cb5ec046beb41f8b522e86c7aa585d86a9d7bd146880e73f235778337e4f0c3d404f8fecb92de1ae87ee8cc12d1cec3a1ec088a79f9c4c250

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ba80fbde38531ea9df7618e158572199

SHA1
094f501a4dff88924683f545950e058ab1300b4f

SHA256
c541159cbafec2992034e05d04180d5995a584d30094acfeae80e4b9b665dd1e

SHA512
df55dcac34c256740e3c26ec2364bb023d161d21bad6ef8d6be849d24535f6b6ba4997d180661022007128dff510285ae8d86fbf387b655253f6b1ed37812da5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
a259849f20690a7891fe8ee8edd84356

SHA1
e53b57e56c373ce23706820ae49fa3d60a4a4a84

SHA256
e3e83e810c3d35f0b9b919eb59b8d2d0876e6d23c709c038f7c958eba1da71a9

SHA512
c22c515565a43a7d28961dc1e38ea4444c603a152813330623aff6badc646945fc43ce8c4cbef6c68068eb36465905de650f93753f11255c60e531cec6f473f9

Download Submit