hxxps://drive[.]google[.]com/file/d/1GZjlJx_17a_ZZZ29DVilHNZWhoa6-ueU/view

Analysis

max time kernel
31s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-08-2024 08:44

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1GZjlJx_17a_ZZZ29DVilHNZWhoa6-ueU/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
4772	msedge.exe
4772	msedge.exe
2212	identity_helper.exe
2212	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4340	4772	msedge.exe	84
PID 4772 wrote to memory of 4340	4772	msedge.exe	84
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2556	4772	msedge.exe	85
PID 4772 wrote to memory of 2700	4772	msedge.exe	86
PID 4772 wrote to memory of 2700	4772	msedge.exe	86
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87
PID 4772 wrote to memory of 4364	4772	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1GZjlJx_17a_ZZZ29DVilHNZWhoa6-ueU/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacade46f8,0x7ffacade4708,0x7ffacade4718
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876014749306074038,11300863544265469125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
69eb57bc1b552a33156195581e6ef7a5

SHA1
414559fd0cea2739f9b093b39ca7c0f931906ea0

SHA256
29e2524fa2363bf57191bec0574236853c52671938b84d503fa0795428c52973

SHA512
53fde285c04d4628db372f0ecee3960b8919fdbe8785119d5bef8dfc22d9f4faae64c39e037555a9cd1181c9fc9221ceccbfa1dd4e83c4642725958f17a89f09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1f71c00010e61b8e28addf13bf163b3

SHA1
53f3dd3db87b6bed501b2d7f5502b99ce8826639

SHA256
223da3811b4342099e335ef10e3fbe72e0be0c768dd2508a9d99e3a2570636b9

SHA512
79f927cbf2be3728fd694e87b17409cf84bdfbbe7e4e533528c920266ac4b711962cf6e77e307f27893bee7d67fe1ac1816ae676927206dce0d2d1870f6783c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
14d78f3aa462da030065d3677598b4c9

SHA1
9dcea281777e226b8b560bc159b80a2a1c800519

SHA256
40f00f9daaea58c2d075651c68b39a3a1c8aa761a20a2a1cf594efee0b94de15

SHA512
b720c69cb4e82eff779f2c9ca55b34f3bb9bef9049dba66384ba4f326cc308e6a8b167c2cd3088e55a3ed57b7f9d337aff0b49e6cddfe2967fb58275e1106368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73ed76c400163ef360496b95cbef70a1

SHA1
ea6bfbac20b7d83fcb99ccfdf9f218b847b49358

SHA256
4b175a0e51f0593820bffddf0517f926b80650b61b79cdfaaaa544e3d7156057

SHA512
b036adebfc5beb4cd581e444576710aafdb2d542c831358884a913db4430446856b5e39809a52c407cdd633fda38ed33959f41cdf1a32f64cc0c9f460910f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
75ed62b22d0477a33a87ab1c1713bb2e

SHA1
a2437380dd1a8102da6f2263b48effa7f1a5ab9d

SHA256
7c6a9790734a8aa77805d38156a901529cf57ea0a14643cbf7b52b13f44768db

SHA512
4cfe4c65f72a0aead7a22cafd6f4de523849f9bdb26b67e2039023fb5167d8f605f91665d59524ebb6013418dd3847c596c78f235efcfc6892cba5887fce1ab1

Download Submit