hxxps://drive[.]google[.]com/file/d/1ImtyN3QJXNquP11ryS4venuzKEx1YVDh/view?usp=sharing

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1ImtyN3QJXNquP11ryS4venuzKEx1YVDh/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2944	msedge.exe
2944	msedge.exe
4016	identity_helper.exe
4016	identity_helper.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 540	2944	msedge.exe	84
PID 2944 wrote to memory of 540	2944	msedge.exe	84
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 4840	2944	msedge.exe	85
PID 2944 wrote to memory of 2208	2944	msedge.exe	86
PID 2944 wrote to memory of 2208	2944	msedge.exe	86
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87
PID 2944 wrote to memory of 2504	2944	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1ImtyN3QJXNquP11ryS4venuzKEx1YVDh/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc30c46f8,0x7ffcc30c4708,0x7ffcc30c4718
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13642605225017314388,5647276582425657096,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
91b52b42796b98a20f917d2f307f1af4

SHA1
fab7592863f08e95de808e0a5ba64d7d682a41b4

SHA256
28fa3e4bad6a2e3daebf423780f081ebd97486a1e14831071681b2bca228533a

SHA512
1c7c5d99551b34145de675537c0a9b9e185f62738380fbf8c9db66187ab14395d219c04889db71751546d5915ef8d895df422c179e8125db2062a06d32536dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2bea877b2ff29340200343d8bd813ba9

SHA1
6e93d72c9dbc7e77efb628d43e61a483af2a554d

SHA256
59f3225db1cb79241ca57e7303c37c724f9aee7d19e79155d9274ded06a87df3

SHA512
460c9747c9555073447803c61afca4d7257d0442d4c502007cab2d7bfdc1596988de2b253bfab2e62d555db9407b68e172454fa746969ff7cf9538b4908f746a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fb0bdd8d03978421054c6bd158c1689a

SHA1
a19d6cfeb5c36ee53b6bd913a32deb7ddbd6788e

SHA256
965ea3170f15df2be4f4f5d156f33cbf201a3b3390d90b200ba2e2a0d25525cb

SHA512
ecb7ab8d80024ad170d798c03fc21eb7323ed03b5c59db4bf6b10741fafc009bace2fa2379052c5678c63e10276d4a5ee91f72cf015056298935f7043725e747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f28140eab04bc15d868792ab624d1e1

SHA1
d82b53d12cfd5b7c5bb4cecdce3d94c68e7c9b6c

SHA256
d5f125a4c0af832738be5e6f39cac949bd2d6c11225d35a65d416787cb03b6da

SHA512
82d15728d3cb28351769c1f6eaba78225ea337ee50093b4a6d95b036fde78ef4d020a0f2afea7648c2c577e1c79174c500f300b72502c134ac24dbc62aa0c28e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2a43281-50da-45b1-bb55-9749636f04d2.tmp

Filesize
6KB

MD5
8ff7efac54086aa83a310642f12ac718

SHA1
c57e5c7b3c459a8b63010ecc40078471d4b74625

SHA256
442ae1287255b83a7e6a3e0dd84b0cf90cbfadce57370f73ea954657361a5af1

SHA512
5b0b3f2264cdaf2895d35961b15ee000db9e68ede835f24cd6b27e36e67ecc126bd8137db24d9e86a122912fa10518e2765a084b9bfa06ec3e1caa73556fc173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4b79b5febe27d804d74476112f99688e

SHA1
f7f68b3759302b02bcaddb164b5e1806826a82bb

SHA256
dab498e30c78d7b2c14e7be73444230299a7b4ba9d8eec0eaa2d5f98e505a434

SHA512
d3f78e8f44b40073ceba75e902593f8c9f95bcb36809ae3d9a0e5d3eac1d69a25efa167ac1f123cafb83439b1e96da748091efc5b3b0379466ba7aafc0945ff4

Download Submit