hxxps://drive[.]google[.]com/file/d/1sqb5w6Yb_i6zEebBmYvCPcYBfy7vp4sY

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1sqb5w6Yb_i6zEebBmYvCPcYBfy7vp4sY

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
1648	msedge.exe
1648	msedge.exe
4408	identity_helper.exe
4408	identity_helper.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3400	1648	msedge.exe	82
PID 1648 wrote to memory of 3400	1648	msedge.exe	82
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 1944	1648	msedge.exe	83
PID 1648 wrote to memory of 4556	1648	msedge.exe	84
PID 1648 wrote to memory of 4556	1648	msedge.exe	84
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85
PID 1648 wrote to memory of 4896	1648	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1sqb5w6Yb_i6zEebBmYvCPcYBfy7vp4sY
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff829c546f8,0x7ff829c54708,0x7ff829c54718
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3822841653288464971,3701645387196936688,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
a4c2b1fb33054ee6253948dd58f4f79b

SHA1
187dda37d18439c925669b63f59bfce1a4888cf4

SHA256
c40b0c4da2b04d3e1338cbec3115a71075f588a22e2bf2312828ba9d58471687

SHA512
2c7212cce0ae5a84ab65560e52f223a977c74cead437d70bdecb8488b33bd705c5409951fef3a3e68f44d186438be8e6f9705c329a2ec0bbbe26e9d1d754ecd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7fb0a68add0df1eb766d7dff3236e31c

SHA1
7abdc4c8d7d5aebfe34a4ecf96878754feed4ce7

SHA256
c7d73d5dfe44028c4bc641bfbcbfce26863920be7c6046fb235e81fbd49c49cf

SHA512
33e64cb56c5c9137be080f8306b25d17b4da2f933e753ad4ad24270c1e291383112e06b0d5c6d6a48961878f9bd7174505f61b92fb36f405768c5f3b5a4467e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
65bd5649a16ab500087e1007d3de1621

SHA1
ac8455ae0b5e40d93f4c2dcb0a2906d8e90ba595

SHA256
25f1a4fd662664f83f39ce690989d73cd76cfb946094bee66932fcbb0c3a92a2

SHA512
5d31bb9951508dd90c7ff7cce9293f4ea65f4411dac337f78d7993e419f79cc8e16d77af5595bbbee1f4e0de13c9a2396e5edc60b69653139c00b3b23b8bdc85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2cc2a737099040c0ad086df690721bf

SHA1
291c9b5204e40e280c5b298cd6599a5f9db1d92c

SHA256
8ee48a5d58723ff652baa7ef6bb5424e6b2a08aa898c859e2875f2712f61895c

SHA512
184ae902ca5f69d1ee804a3637fe13c6eef86697e02f5e859d1d8baf8f54b77cc9b38ec7557bf3aacb5a09a51b231dcfd22befddfc5521b7a3238ce27c4729f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7c280d388d606a1a3112e8fbbf12641

SHA1
328af44e95aea9ad9675da8943d1a487bcd1e3b8

SHA256
ad887033eaede40245c3f8317e5dcbbce88999a0af05ab1c210a2eb993e9455e

SHA512
9fd000d1d7a3dd120ccbc272ee8da6dd2912f9e37ecc7dd155dd983bd5e60a83a24c6c80920cdf4cee738bed5fdddac25f0d49f4daa1eb8a8116ea93a7604e9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1bbfccd0f7d05137261b4851867696a6

SHA1
af789edc3055423de97cb3522e67406eef0d9ee1

SHA256
61d263adf329496286e26ae426bc1f6913311ef633dc333aa41296da8ea70fc8

SHA512
d1b229e2796b28264d99ab790c29dfa3a740d6f4d8fa505482945049b55dbb003a8fbe7b1f4b667d75ec17fdfa06e790be7b1c113f8b2dbbfdb2ff45e269199e

Download Submit