hxxps://drive[.]google[.]com/file/d/1c9uBkP5SVNbTB_mnmrzQCHFcU1vI-cFy/view?usp=sharing

Analysis

max time kernel
480s
max time network
485s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18-10-2024 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1c9uBkP5SVNbTB_mnmrzQCHFcU1vI-cFy/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
1780	msedge.exe
1780	msedge.exe
1408	identity_helper.exe
1408	identity_helper.exe
2432	msedge.exe
2432	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2980	1780	msedge.exe	78
PID 1780 wrote to memory of 2980	1780	msedge.exe	78
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4208	1780	msedge.exe	79
PID 1780 wrote to memory of 4712	1780	msedge.exe	80
PID 1780 wrote to memory of 4712	1780	msedge.exe	80
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81
PID 1780 wrote to memory of 804	1780	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1c9uBkP5SVNbTB_mnmrzQCHFcU1vI-cFy/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb35b13cb8,0x7ffb35b13cc8,0x7ffb35b13cd8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14405168832797841837,14597983460724681801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d53f4d836e2571ad2df7e03d177a3090

SHA1
92b8403445936b304bda8ec0e6ac2d61f98b5fc4

SHA256
84cd2d6ddd480bf3e6d7dd87d830026d18da0588e831c27e21f365d3d9cb40a3

SHA512
f96ea17c87b58eb7840b4accff2006eb0c4721bd00ee4103bebb8bf680e6085ed522f5f5e0b20b8f99b00f38f468c58d72fd324a8d7e7a4d766a7c5a7a4de0f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
30a3d46144770a2ddc321ed69a8ace2b

SHA1
97b5ad312b5ea5be2d74389467bc9b19e6844f69

SHA256
33b42bb3fd35b5602f994b0557b4fa6d6613decce4e50f1d7d33c2c7f1556f76

SHA512
64bd2f4ff346b68d92a4730763e33f9dafb2af03bf71b619c6f9b393f02dfaa7d378b72c93b33d731417394c373ab7be51c3bbeaa93802302e5ec68fd7f7ff45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6a22b8abfbff91372db3ef3b894055f4

SHA1
1f423a5b097b423ad955e749d944ac7b34bf8062

SHA256
5f07420dbcdb126ecbbae463a2737b836e006ef601c1154d7508755f8233749a

SHA512
0720fb39b2263d5982e4ddfdee0b0a48e21376499acf68c45bfe42b3ac2d2a8cb8f112fbffe2c55c9ee3fc0b489048d54ad5d8d92f38a09791abe3a5197e4174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
26c36ee269fb9fb55c2805e2f537a298

SHA1
8500c49121c07f4318b84ac32d25c68ad95dadbd

SHA256
42315a9e4d84f8f876d8f4a7ba0a7e512843cba365e325f47b3d70c5afa717f8

SHA512
9d46d410b2ca42f0fe31f00883237211ee42c06c2c76a683e7a79aaf6ad6eb2d8db81e99a0e0d0354f483023a44d904ede073652577a0eb51e1a9a35534123d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35abbbe4a1d7aea71012572a8d718ef9

SHA1
24a3d2814182983fd5b523b7ecaa091c89122da1

SHA256
b02047f89728d2e2e72c361dd2b657a398b14fb6b4b4c3a98546bb78224eba91

SHA512
a2383da5c6192252a2a0769da4ba394ceee9934633337892ea3b5cb9bef0b77e30ece741a86137f7fb3704cd7906d4deed29244e6b1ac85bce47cba9a36e6077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
dc785cefd19b82f9d2db56f22249003e

SHA1
dec5216149767ccbeaa713c8bb74aa27bcfd396f

SHA256
730edb21e78df15dd9db7b13fb4bad0c0184a75469f0c431f6c5965c7f6fbb6a

SHA512
f3bb0510b6359204522516d076994e764fc418fe6623e17984ce771ef42dbf0f4335e6b890036f763b2e33a69a5b35f101fa3b9cef89790c4312a41ab7cb691f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a0ecfebc798886dc35f833e6fec833fc

SHA1
4bb93fc82ae6aac59feedf0dafd9b440b953c869

SHA256
7322aa343c98b2480ffd51cd52cb435149864494ca1ae3a00e52d81e5f39dff5

SHA512
dcb6e064b9f91e606087ce67e1c7bf8cad1b2010011c619171c9fe75245d607ffe8cbac1d868ad7114c524f916e30873fdfcc4d97972c8157b5dee42db485852

Download Submit