hxxps://drive[.]google[.]com/file/d/1gIsNUJigWr6VtEdeRMysyNYgDD9vr5_g/view?usp=sharing

Resubmissions

13-11-2024 07:16

241113-h36g7awqct 6

13-11-2024 07:10

241113-hzk23sxfjr 6

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1gIsNUJigWr6VtEdeRMysyNYgDD9vr5_g/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2268	msedge.exe
2268	msedge.exe
4032	identity_helper.exe
4032	identity_helper.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4564	2268	msedge.exe	83
PID 2268 wrote to memory of 4564	2268	msedge.exe	83
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 1692	2268	msedge.exe	84
PID 2268 wrote to memory of 2456	2268	msedge.exe	85
PID 2268 wrote to memory of 2456	2268	msedge.exe	85
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86
PID 2268 wrote to memory of 4764	2268	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1gIsNUJigWr6VtEdeRMysyNYgDD9vr5_g/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff952c546f8,0x7ff952c54708,0x7ff952c54718
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1388,5800242166571770904,8341768275698296616,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
70023ea53597c891aa3e5c189bb0c9a1

SHA1
90680e3bfd7cb954517b06a947b0a66b0701d9a4

SHA256
573ac6709b8a34fa8450c46d6ba30496895cdbf369be0915d6f1653a1fda92d0

SHA512
533edcb1e7a448e48e96fa17d68f8817d82358e6d736a62e20203693408788f7ee27a4b97dbd60169c26a5c17410ca0ffdb04300eb10b8c4c6abb376f32edd38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
03ea0e657b1f0998e221c56d0e3d740c

SHA1
49ed2e69a7e33ad1e8e7086254841bba19b5df88

SHA256
01cccfafe9eb24dd4aede3a9ba7795e4870f022026d123e5b65ea0714c95f3e9

SHA512
cadf42ebb6c3e33ec68a2490ef639f9215d544e49946044da56cef851b469b9258959f31226558166aae4dbc1df6f81acd96f317af5712616f44edb31500a7be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dec843f24623137463c2eca7bfd76a82

SHA1
e81dd7ecfea5649f8a1562e9b7a3885b202d577c

SHA256
48826e4a2e360af99eee8941e9425d81ec2c28a5d7b5a2c90e17a8c0a540aaa2

SHA512
5ef8e2b62678c6dc14319ac7314ea01f822c0e917f62a6c0f386af3fd56cb44cec7fc7a88d111d32ae357397f51820f92b08a513c93ba1f3048827455ed0da24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4bcbf21293c9d4c855698c7e57be2a75

SHA1
e7bbfaae181667174adaed2ac04c3ca3e905c351

SHA256
55f076be4f907508363c418753ed20dd1db76569e81af47e649158bda541471e

SHA512
bec94f809d0ebd2c262919b723eea57c1876cda656417d1f157f2edc73d27a1f2c2cd5122dbbdab74420766a3bddd98177a1f3bf292a4869d38fb4ada6f45ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
594334ac04edbe4bca927c8262f2e1d7

SHA1
429ff619b4d1639d666c43c6965288d279ae82c1

SHA256
7b6e7ec46aa5256484f2f52babe1e73857a11368814c710b42f46692bd33d725

SHA512
0d68fa4a7f157e6d538579ba00d26096ae3e756a23378c8463cf7121ac5cc70a605ce92652921aebe8eb2d2788c38ae37fb4641fad12613d2df6e1c24af240a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
438b2c97bb7c182b6bb64c76ef6b4688

SHA1
f1355939cc7a75e281842d36b55419101d3080bb

SHA256
3137bf8505f0aee887ddf78235e82177ad01a405907391991b94f37186e09fdc

SHA512
c821ce6a06a4e04276425219681f7bad2f5a687356042683ac7f81a634f8d0686c069950d97cf3ed8d6bcd487a6926f9ae60dcf621fbe882ed19fe139724d338

Download Submit