hxxps://drive[.]google[.]com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?vJtrPHkgT9

Analysis

max time kernel
41s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?vJtrPHkgT9

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
5052	msedge.exe
5052	msedge.exe
1504	identity_helper.exe
1504	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 2424	5052	msedge.exe	84
PID 5052 wrote to memory of 2424	5052	msedge.exe	84
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 2676	5052	msedge.exe	85
PID 5052 wrote to memory of 4752	5052	msedge.exe	86
PID 5052 wrote to memory of 4752	5052	msedge.exe	86
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87
PID 5052 wrote to memory of 4328	5052	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?vJtrPHkgT9
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f8b46f8,0x7ff85f8b4708,0x7ff85f8b4718
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,5040747661583491339,15355391330271846600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c3be18f-ed58-4974-b3b8-bbd10c386ab4.tmp

Filesize
5KB

MD5
e9c09ab77aeca67afb12170d5927fa28

SHA1
a0a0da044be12540386417ee99ad2080f1b3aff2

SHA256
a852d66e1bfc748a2d6943504f1d21b108a4ee5f72fa4f1745840f224f83d5b0

SHA512
a3ad847872a7e23f09d35352ec578eceb1c745517bc17323581a87c17c1362da94ee1ccc664680da9c245f80b19159ff115b88b67818be204faa10330bdd7cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\991546cf-55fa-460b-9919-b4d7a0e033c6.tmp

Filesize
6KB

MD5
f88b020d39596567dad23ed2ac9c263e

SHA1
f414dc6a2cfacdd31ab714de3cd2d0e2405987de

SHA256
7175be17f4f49145b74718d6fb2bc1b96d87518f37427ec92e3e8cf169165f55

SHA512
f72f40466e6bb849e16ca600080a1701fed04021a42c4284be60e9538e441a4c587ceff7d6e3c48e9daa6c2cfe38613a2d604d9bb91f4bdd94ef8995ea0f010b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
c932cf3f3512cc76f6462f515dc5ba67

SHA1
3ce756e081e05bf19722a2a0a7717c030c534a72

SHA256
629c16fdac09f9b1d494e25dca79cb2449171665fa8d0e845ae278e8ae270f48

SHA512
764e10ef334059b1880b1a6f1aa06a4fcabb311debb15ade857fc8af68334016c08d200383629644828cf45e571778b7a38c95adfa6b2309e08b68ba128e1047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9d1156e84358c2dc5d142d510d8f514e

SHA1
215612af44c58ffea59b2b654584aa043cb6d907

SHA256
ffc37f3a4d030c0aa7dd61a693e85aa5af826dcaca701af5fae2844497ecd817

SHA512
5a86f0591a6324d459eeb68a5b2f0dd30bd5f51d7d9ad4a6ca47dcbbf65a6972592664ded8e237c3547e9ca6cdc107cf1aa57dda598df97590afd840a5ca6fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580ed0.TMP

Filesize
1KB

MD5
9ad3d97001b99d4558c07d4548c10f8b

SHA1
be7865d85a84a0904467def6ffcd1e7aecd3dfb3

SHA256
2e809eaaa5e1d5bdc2c50c8bbe88037a55671c3f296ffebe8dfb9300da8393d2

SHA512
b9de4f1b7354c836149195c79f3799354d16e28678d160ea3a748a404beac57db727dd8468c1515f277c8fd29920d50c3e7b3bf23d40e11d7a6a2dcab1730bfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b50e956025b7138f0fd48cd5fa9efeca

SHA1
e1268b7a85764cec7b07ac845fec71dccddef6f9

SHA256
e64e344a32ecf9981fb3a5602ccafff35355e904cc8f8961ee533445d52f1884

SHA512
19edfe98377956c70c9e61803f4275f73b6a6a60c4d20384f576215a40c3492560e933e23a065e4ffb9c1235e86ee17f589dc794136a039457afbe89ac3e84bf

Download Submit