hxxps://drive[.]google[.]com/file/d/1uYyzndfNfWfv-y07ABsxFBIkM-fzD8Ab

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1uYyzndfNfWfv-y07ABsxFBIkM-fzD8Ab

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
9	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
5004	msedge.exe
5004	msedge.exe
4940	identity_helper.exe
4940	identity_helper.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1940	5004	msedge.exe	83
PID 5004 wrote to memory of 1940	5004	msedge.exe	83
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1136	5004	msedge.exe	84
PID 5004 wrote to memory of 1812	5004	msedge.exe	85
PID 5004 wrote to memory of 1812	5004	msedge.exe	85
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86
PID 5004 wrote to memory of 2976	5004	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1uYyzndfNfWfv-y07ABsxFBIkM-fzD8Ab
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f81e46f8,0x7ff8f81e4708,0x7ff8f81e4718
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2576 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15825296413763804791,7124015431815395566,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\565ca1d3-7a66-4c7a-801e-e87f9fcd26eb.tmp

Filesize
10KB

MD5
a100f11b2b13a7402a6d6595d1db411a

SHA1
877a1d114422ad2889eaf4d572c6419da4bab186

SHA256
e4f9a01be07e89226d5ca87953da1e75bc579ca784aaa17ff58a915947ec3c3a

SHA512
9c32518036a8911ca12ff06b0f390a1904d0a2e8dc966984ff8864a10ca679bc553e4673577bc479470c251420ad0d0774e1ed11179d5f204144e091dd754025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
862a0957291c1b907e436029b01534ff

SHA1
0df7f2c2dbe1a4548b811934be2f36d6190cada8

SHA256
1ff51f6a4f59af4c70d27944e8541560d9885ffb955bdbc78a8465326d5971e9

SHA512
50e983d36823803b5048fdd14a8ab7c216084ed2fe00871e71208cb7c486ee3ab5744957f8f81abbc125d379bb4ebe9fba603bced455eb1ae6923119c51b81a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5c0612d73a3dfc753a7e5dbef31d59c4

SHA1
6576e719638240aeb572671127a28a8d9f7fe3a6

SHA256
65e1231994eb9984ac04185f2d246121ecf97c3f11ce3e938e4908939c7c4b41

SHA512
817ea5df20b1e719b3b93a49b1322abf0c66598c393f4fccb946f98ca6e9ee23122535766d88b70a74ac7e8f0df6c569f54ea27848d02e1311857b41b3eaaa17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ffc644ef5df258b41864e9af59a87ca5

SHA1
32ca263ba687316ae87f7c65c3ebc10045034c3f

SHA256
53aa3a7498f8b2776eeed031713567097d43e68f14fe8fb3ca9c555813876173

SHA512
c86485436114e361f78ad08149f07152df0e9338187d9905e9c7ff35c2b7789c828fc10e03387e1326333f34a5e53a68dbf437b36f3e75be80d503a54bf0fdfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e7cfd4a93328db07d8abe45eff33c25a

SHA1
cad964c50455a7e5818bb15d2fb10d805bd96c1f

SHA256
fe1abfa8734c7f29ec32324ff56bf36a6bb01f0983543b896848c6566471565a

SHA512
f72db7286c33fb3d2bb4bb16d970426d74d349fab233f27caf0f6c80d5230cf0b0b8d00975860385aca6d517f0707d2c9f6584643167b1bd5fdb97074e292852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
96470b1f9ad2fc33f64123a615ef6c1f

SHA1
c28900f59337dceb064cfe4767dfb43cf81ab265

SHA256
393334634afbe38dc28739f188623395ed544aa6f06f768976f5f66dc1decee4

SHA512
2ecd0dee9aa0a317555ab1f2f42ea6ba8d69a93b30c98af9602be2f2931eba2ce639d151695ce152d378a1a26351528a47d9fa83a3a1daf1c297e7692c4bf5e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit