hxxps://drive[.]google[.]com/file/d/1MBe-183UgTXK0f4q-UJESBQ9SbPBrIyx/view?usp=sharing

Analysis

max time kernel
62s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1MBe-183UgTXK0f4q-UJESBQ9SbPBrIyx/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4520	msedge.exe
4520	msedge.exe
4788	identity_helper.exe
4788	identity_helper.exe
544	msedge.exe
544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4160	4520	msedge.exe	83
PID 4520 wrote to memory of 4160	4520	msedge.exe	83
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4656	4520	msedge.exe	84
PID 4520 wrote to memory of 4468	4520	msedge.exe	85
PID 4520 wrote to memory of 4468	4520	msedge.exe	85
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86
PID 4520 wrote to memory of 2588	4520	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1MBe-183UgTXK0f4q-UJESBQ9SbPBrIyx/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdce3446f8,0x7ffdce344708,0x7ffdce344718
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1780 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,12639876751713317628,4263824793318641676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
5c5b6b7cfa2d4fbccd58968923f02245

SHA1
91a59d1208408a70555273253aa068679ad4ff23

SHA256
083f0f52dfad33fd25470f2ee6a3f3ec1b9813b1a6f7e457feef9dfa0ce91fa5

SHA512
6e8139500c2187145dc5724523dc0964835e7250c9ab6e5433e60f86de41ec1f0113deb3f5afec244f99c7a5868f25d3712bfe00455d8324035a5ed8bb34fc79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5a7c6ae5de1c948b0147236da6b368f3

SHA1
3d48de95af3a11a29a1d82738943f4620923cad6

SHA256
48eff4e37eab2372102fa2e3edad13286824bf02f4ea0039ea87837664abdf67

SHA512
f13ee25d3b443bdac9b5e9cdd4edcb4c9bea9d3ee0e8913f728d48dd44185563a2e4c57617dc6987462601f114af8349aa4f475895b8a0da4d9c0114fdb19c87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc71fc8a3478e43b5081717c6ea873f2

SHA1
13378f126c9b674c75e1728eec49986b613f5743

SHA256
f25877ade6e9c3fabb448bd8ee9dd16580198daeb938c3f1e22736792bc3edcf

SHA512
5856a33018ba828945d086bbca305cbd8f8f59bfb3232c8dafe371f30701927b5042070ffe91dec0dd3ace4a70d4d2e97eb968d6c0ed52283db28f7580a29ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
751fef08a02b570959f269c0072a7750

SHA1
03f3631f07f39411c9efb785feb769311b46bfd4

SHA256
d0bca675a3acd4299c4e5d538be2d9232156b274436e773a0d253b56e0943109

SHA512
2c8b233c2392d4ec29d0c315a6c91b61b775224efb727dc1e0709189fc91d73c397380c0059f10b487c5c8a51c998f6fe46542e3d6e2f66fc617df75b53caf63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aac5d5fc54badf4d051012620a839224

SHA1
8944a5f072e1bec299fb835c73cf62f37f19e1b9

SHA256
a3f8130075e4670d7cc511b7403ba5825613f89253d8e1a55f0d3574b944f9d1

SHA512
765e4ca3ce51c196d508ec6d812048340ff3826a3959e01c1fd113eb45e9f019e5ff5e967941971af5026a534c9f4e262765e6cedbb5fa6b241e0f2373c55438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c821b140c28519427a91b7915ed05e1

SHA1
f3ccce4323fed6c7e80f7c3e494936de38acdb15

SHA256
797ba915551a5c2d3ca587b06d198492b52019d351977f9621880fec4f34b177

SHA512
ae2084b6a08ec2b0695173ab1802a6273c6d2c1ecca05f0d26da670991c41802d62da80dff03e1b7b588db9e11d1cad0251750b07d7f7a935a1c6ee0d7c5d303

Download Submit