hxxps://drive[.]google[.]com/file/d/1Vw7SUKVxO1lKgMkEdq2KMOXZXSwwHU_b/view?usp=sharing

Analysis

max time kernel
193s
max time network
233s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Vw7SUKVxO1lKgMkEdq2KMOXZXSwwHU_b/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
8	drive.google.com
9	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
2880	msedge.exe
2880	msedge.exe
4536	identity_helper.exe
4536	identity_helper.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3356	2880	msedge.exe	86
PID 2880 wrote to memory of 3356	2880	msedge.exe	86
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 1300	2880	msedge.exe	87
PID 2880 wrote to memory of 4852	2880	msedge.exe	88
PID 2880 wrote to memory of 4852	2880	msedge.exe	88
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89
PID 2880 wrote to memory of 3296	2880	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Vw7SUKVxO1lKgMkEdq2KMOXZXSwwHU_b/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad63c46f8,0x7ffad63c4708,0x7ffad63c4718
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,8020653538933875449,10905829044634278552,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
6aeec55abcd37dffbe521b68670dd622

SHA1
0087936d22627c84a1cfa72da5cf757187844801

SHA256
78e2e62aaea87e76bfae0e3719486b329df73bacc9db6a4e4ea4adef23755466

SHA512
7c224196947f1a6023bd263999d9d8abb1592032f4542c97809cb929b7c8adcd322b69971c8b5235edd5141c4f84f27054ffe65288921d488ea47bb3dbcc11a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ef9fa7822ed5c3f257d94983fbd7a49f

SHA1
8a9f4705041ae211bbb3c53e723f5f418fd43e2f

SHA256
97425d335f01940e73fcc23ff791ec1575396900a4734e509c15938695757630

SHA512
2c791043525aa7e3f916a9b613c1da757a8334331f8b740c9bc9703c2aac8fb25e8d4117c24bea884a7a6d2f8837742c740278b04007d0a5b7e7679c88697635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
464be9443c851c33f4e8bafb9e2dfd9b

SHA1
a36b292a93731229c57af8f9c903879039661281

SHA256
27ad010326e34822c62753947737c6b9c1687507de8cade7465a150ca933e8ef

SHA512
dbf49328bd8497f5f931130e8c28c53938d6d32d72296685ba6e94fcd822c5dbe5aec79daebe3be6ef0fb97b0ece0c4cb0957afcf81fe1b0a58d74ea44984bc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
61840db5ce2aad92e33c864099460a2c

SHA1
7b1e2df07b6dabb6b41437f7c95f8c34f4488eb3

SHA256
82cfc0b521257dba16e7d0da3bf5116bc81a388261164a54f0dc50c264ba3597

SHA512
00d3d119b25047af2abeaa1840c8949a1801a9bf6523fd77266b87d71fbe4b23a581a54165c8dad3a5201d6bd598e47262a049a417e45b1d10bafe518a38c48c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e4ba8eeae200dcc191160506e530beee

SHA1
b568a81c6d96ed9c8275eb908dc27f69ed601945

SHA256
0ce703f131400e4adb768db03b9074b7aeb545935989cbd141700a825ebd1f51

SHA512
f6b21d6244ee219cd1cdaea723db8143d8a389912cc772ec59ecb8bfdebc808ad0ed79fa4016d1ec1a357505acf7f3cbb17555af4535c9592470d8e928d5f176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9dcb8686977b9e1150acea7ebb568277

SHA1
69eb1aabcc78103206cf62cb28dcfc4cc476e261

SHA256
1d1a50e2bfdcc639bc94ab3f1a7a80fad3a22bf6182b5ab607450d0a30bb4d3c

SHA512
dbd793bc81d19359feb074171e658591a5c079ca0f9b800c97986e03f261eec77bc1b563e89994cf6bdfc12b8e793e5b92ceb3887fa6e63f09f2017a2722cd21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6a5f67a672554e10be92113982a0fbac

SHA1
a612b1ef18991f80570b4dff4e49734fa394423b

SHA256
4b4fbf0dc967a6c99385c7bac76a4b5de3ecf64adc32925f15a312a37089c0e0

SHA512
3d88d23e5ba1eb19e653c58f3d78693423e2416781275caf20111e74b90c2d49914eadb8b557c0511fd5dbf6b5a0cbfbb92e0154c1d89f22a70448047b59b5a1

Download Submit