hxxps://drive[.]google[.]com/file/d/1DQMpicVABy4b8TLcmj9TUXLPBmkAu1QD/view?usp=sharing

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1DQMpicVABy4b8TLcmj9TUXLPBmkAu1QD/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
364	msedge.exe
364	msedge.exe
4936	identity_helper.exe
4936	identity_helper.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1216	364	msedge.exe	83
PID 364 wrote to memory of 1216	364	msedge.exe	83
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1848	364	msedge.exe	84
PID 364 wrote to memory of 1460	364	msedge.exe	85
PID 364 wrote to memory of 1460	364	msedge.exe	85
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86
PID 364 wrote to memory of 1436	364	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1DQMpicVABy4b8TLcmj9TUXLPBmkAu1QD/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffa99af46f8,0x7ffa99af4708,0x7ffa99af4718
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,5541531914642059780,16498192517625503446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
830d80b59825b04cba5b810df54a164d

SHA1
7b10741b25be2c2fa6ad1e5396c5e4c057f116ab

SHA256
9a70796db56fe4bc7482bb99c96cd615dda897bf29fc1afda061b73d9f427fcb

SHA512
9df26b9706a236b423af328c2115498f93e193f435d93d0f9821c5031ecfd9bdbd54ee875ccdec4a0ebbddffcba469ad07bb3a184a46f28f32f2ae1fd0b8730f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
62fde9bd5375c97d2ca8711f010f6ddf

SHA1
27209d84a60b6ad4dd101c364d18ab8143d1830b

SHA256
7656f524f475909197ec699e09aa4d1ea6d39b1e1dcecb7d999d08c9c7deed35

SHA512
b0f413758901dac280c5b1438b46103d7884d5b7dc097ae6a3e3027d5dca8c528eee0279ea51f38870ffbd5bf50b864330bfc1800d0305ec207b7c0673248210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6e84b27d47d1162891784b638a5f82f8

SHA1
c959e866041968be2458e29292ca1450d4730671

SHA256
da12624c1562ab6e2f6a27ec8b4cfd2b43452c0f87e2d0b73110008619afd31d

SHA512
1fb159c2fa9c00a9a89358fc8e6bfee3daae0840e4bddf639f51a07fccfe3a67e365f735294a92cc70416ce20433894a1362f3ecd09d76779662927caee6aca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ded7ce621242912c0e6cd45c033080f2

SHA1
e871d0a8ad9283aa24b9138b3686ac7e5fbef7d2

SHA256
f201df431e49ab0b24f58de1f6d9ba07447705e67a146d45708fdb2bc6a41e0b

SHA512
cf706057ef64967efaf786715780e77582d9008d353b2017631a02cecab3ca2b176d47f66a48ed2ed583fd4ff1b52ce521d9bc4960a4f1d977033b437654ce7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24446ca36b2438ec1061104112bc5954

SHA1
4d7408ba844c18855af0f75c1babe2cdcc5e8a4b

SHA256
3117fff3ed9af567a0c1638754b02c35483f839a3e756626dbff9679dae338d2

SHA512
cc3abe22e4d97ad1ccf2ddbad134ccb89c6ca39f81e4e58d847c0263ee8c52c9ec0b467f045059dc323274b980a22ee3745d574d5468b51c2289829ed61dd759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1cdb922bed27530b1e75e57186de3637

SHA1
4e6e0473916d4e84003ef96df663cf83571d9bb8

SHA256
b69f386d921c75a3f41827174f77f2959dc7194f0a23623de08c48f610ba2109

SHA512
05dcaecbf87c1be0e26c7e6f3b391d8df58d9a949a48a270ef5e23b91647cd0aaca1009c5e86521433c72934e5607efa4b6252c477187594583077e3976b6d84

Download Submit