hxxps://drive[.]google[.]com/open?id=1KDkcVZyLcbkVEhBTgxC4_SWdcOwWGHc_

Analysis

max time kernel
73s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/open?id=1KDkcVZyLcbkVEhBTgxC4_SWdcOwWGHc_

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4568	msedge.exe
4568	msedge.exe
5108	identity_helper.exe
5108	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3240	4568	msedge.exe	82
PID 4568 wrote to memory of 3240	4568	msedge.exe	82
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 3600	4568	msedge.exe	83
PID 4568 wrote to memory of 4288	4568	msedge.exe	84
PID 4568 wrote to memory of 4288	4568	msedge.exe	84
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85
PID 4568 wrote to memory of 3664	4568	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/open?id=1KDkcVZyLcbkVEhBTgxC4_SWdcOwWGHc_
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf63346f8,0x7ffcf6334708,0x7ffcf6334718
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14373288039051974805,11056016094522268205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
9ae754c4db947838927453dd3dae96fb

SHA1
867f710db766479a0db0a0411aac1e69aa2c9b66

SHA256
3a06c7da1180de118dbd6df94902a80dbd2d42c61526db7e11eca321019149b8

SHA512
8c25af61a9440194b846bd20f34b59daaf0b82cdbcb7a77d52adb57616bc573cbec9eb8897c3b488310859fe42a35c672a2e0963dcd0c20c0d76c502197e218b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d27eb844c335277a987683c5a9cffdf7

SHA1
2690311d1709e194d1b0cae66957b35dd8ecb4a1

SHA256
4fcae608c197dda8e4404bc61cabf4452a24e1621d0974949114bfeceb4c1333

SHA512
1613e4f1ee3a5d0d6975152571f789778b6d74a90fdbafd46b9e13c52eed8d3edec5750ca6f4e12eb6e833556c75f82e32588eecfff1a4ec086e2b7baa997d7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a73e923fd81b1c7d954698af6be4b408

SHA1
57ad43014229bfdc50c4661db637ce56da662c50

SHA256
48b1cc16a770eea780f25650cb62e85b123b2be1c0066754c5c8c6ed27fcf734

SHA512
3368dd1a43a306fbe52049178a7d57d8c4eb5a598618b373a2e500cc2c28515cbe88ea78d25e67e54abed35d7de676e3c96e9ad94a9cdb21106fe319864159a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b2913a5c7214df4804eebcc5cc30c96

SHA1
85dd48feb30223afb8114cc2a5a51ac50e50ddbc

SHA256
679c6a877347f6d87f2045fc802722778b6a1ccc70364912a93a1a01baa43e1d

SHA512
d7a624a4925e95f226e4fc6a83c1c7dc366f1b7040083ed8225b8dbc417feaf744d8748b843961fca1ba0e19d48b229dca40c31e699fb2480db015f81b5057b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6b78795d29cdf0c1edafdb599408fb69

SHA1
65124337a420fdeb44c055fa630aed7dd44bdce8

SHA256
decd2aade7ab60df05c77bc81b147882f97cb422ad0d1991db8e8c9ebe6519fc

SHA512
e0de9dcaebd9a31689157735b883042916d94712c98bdb92c15071c8e20e33ff8e0da4f29032c70da2b664929239aa5fe832f8bef6de81deec0233df96bf9ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cf0eaf28efa8b464d02b73741297aacd

SHA1
ab2f82a008c973d396b3b353fdd9985ef9f2832b

SHA256
67c4b5dc4d42ebf0a0e78850a482dd183508a2f46e212279174a7bae75c71083

SHA512
561184f32464f88ef1c54ec5a4b8454001b25063d9bbf76c4a0fdd631fa0490b1b3f2b48dfb0e4f7210ced5435b8fd6c1d425533f5203ff1c6200023235e6ffa

Download Submit