hxxps://drive[.]google[.]com/drive/folders/19oqm4ctuBqTyQu2nKkuIwvXq7B0AJVMh

Analysis

max time kernel
1681s
max time network
1687s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
08-11-2024 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/19oqm4ctuBqTyQu2nKkuIwvXq7B0AJVMh

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
1936	msedge.exe
1936	msedge.exe
4496	msedge.exe
4496	msedge.exe
4816	identity_helper.exe
4816	identity_helper.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4008	1936	msedge.exe	79
PID 1936 wrote to memory of 4008	1936	msedge.exe	79
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 4632	1936	msedge.exe	80
PID 1936 wrote to memory of 2332	1936	msedge.exe	81
PID 1936 wrote to memory of 2332	1936	msedge.exe	81
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82
PID 1936 wrote to memory of 4460	1936	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/19oqm4ctuBqTyQu2nKkuIwvXq7B0AJVMh
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff36863cb8,0x7fff36863cc8,0x7fff36863cd8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,15473953747503955946,9340358714704091060,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
782B

MD5
ef7d7836b0a07beeab850c6761f5fb25

SHA1
42d58f3077c116aacac7baedb91223752bb64b59

SHA256
41eb228b0084cb63b04ad1c13262f6de4c18f8b6e0046eaf388d070fa0517935

SHA512
e54584251cdbcce3dd7f648d11ce3f048fe438ae6e22c2e0b01b1e93c79ae1e9bf4a2217da322dc962e0e4c75f42c0222033adf9988f6d1e61c0774cf3361f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32d593a354de184ca1732a655e18c6bc

SHA1
538822cb604026888810f64284cddfd3e640bab1

SHA256
f34ff87fd26560de2da8c0a917c47d93a505122c9ab26292609162563433f0f9

SHA512
9050e54993a3997b02d788153437000a480abe4ae390ac66bba153eac8589d2edece4220b5e74be67a00e18d8fe5ed8d3e1d93631329419db934c07ef08e1113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec3a180e1f8e5e1b1f331c4cc7367a8d

SHA1
1d212f61f45de37a630fb29243d387b20a852f4a

SHA256
9104d5b7a3e5e26fc641b1b71480a3557326c4a4fcaa3e3f681ff5119ea6b379

SHA512
5c6d22cd5434a4665897ece86e1d3eb49bae66f2307381bb06bdeffbc72f3a2122aaf0b7cacda08232733a48e7a70b6a99a3b72fab0b4a4fa1958fa177aeec42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf3bcfb65efbcab40861aa0a97508a54

SHA1
219b5b25b25b1eb35f456aa7fdfdfb0e9381379e

SHA256
49816cc1f9beb63be72ac38587b62074f36d04472051254d54bbcdd671e54537

SHA512
d28fde43a7da0dd168aa8828e669a8d50ed64629aa6580a7aabe91d564797a9463e57dee515301b2b7c27eafac7dca9fdf595195157c3302dcd11e0bf5d98525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
abafc9b59479b8a2bd787c58603082c0

SHA1
a91b786a347673d4d7ccd7ecccb972e51463c8ff

SHA256
5f7b2fec7753e38bcabbbe2e6e6e35f3eb5ac6736e498042b5cbee3455b7a615

SHA512
08c40d28d101452bf098a40fca3fe3d0eb1473ffcb77cb1f51688551fceefb994fe25c590cfd9037e820a4510add1ca21d9d7cb951a0f467837b9aa460264774

Download Submit