Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 13:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://drive.google.com/uc?export=download&id=1aDQ93KLASV-LqhzplcipjdT_mpeYyKZJ
Resource
win10v2004-20241007-en
General
-
Target
http://drive.google.com/uc?export=download&id=1aDQ93KLASV-LqhzplcipjdT_mpeYyKZJ
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 drive.google.com 19 drive.google.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2044 msedge.exe 2044 msedge.exe 2544 msedge.exe 2544 msedge.exe 2576 msedge.exe 2576 msedge.exe 2704 identity_helper.exe 2704 identity_helper.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2404 2544 msedge.exe 83 PID 2544 wrote to memory of 2404 2544 msedge.exe 83 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 1764 2544 msedge.exe 85 PID 2544 wrote to memory of 2044 2544 msedge.exe 86 PID 2544 wrote to memory of 2044 2544 msedge.exe 86 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87 PID 2544 wrote to memory of 2428 2544 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://drive.google.com/uc?export=download&id=1aDQ93KLASV-LqhzplcipjdT_mpeYyKZJ1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff0cb46f8,0x7ffff0cb4708,0x7ffff0cb47182⤵PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:82⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4948 /prefetch:82⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:12⤵PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:82⤵PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:12⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:12⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:12⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:12⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1748445163295499337,6578817739995778880,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4284
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
Filesize
800B
MD54baf0a4fd56e5a27454f066b935ae23d
SHA156b66ef0cd39f7cbf7cd1dba20ec79bfa7a5aff0
SHA256cef8f720508dbcae34f4ca89408583617da35472f40a3504d90c611934673e91
SHA512c7522e57b6b088349def621467057c3fe83cc0d91a4db2edcda2c96e71fbc2b1610c83ed1ed0aac4bdba1a077e96ef3458717f19594546733a26023cd93f14fc
-
Filesize
5KB
MD5ee906e5f7723da4315ffe86952360bf1
SHA1d07fe2883c1976f70313d5bbed86d223b83f6799
SHA256cd1ce9bc002bb48528b18bb11685c588e9d2ba1ca32316048ffb9243c73f5edf
SHA512b2581fe58f7508ca2529665fbab270b7bad8d033906ff6b77f2a8e64f2f6869daf21839e0035110f975584774a555bce1e73429b5ff019e594059a0d2b6bd192
-
Filesize
6KB
MD575cb8142cc78e67c16046baaf9bfbd62
SHA15038bd47ed0198ee0846f86a5b61993e52f3532b
SHA256dfdca3b00444ff0ffaf6f65eeb6b601808b712edee0cae20868963761fdc66f4
SHA5122c592943aec3911503d7ea47381ce25176ba5bf145d7fac5540260fe27d764f5e12dddc85c5066195a629f4af616f11286759476df63afa5ef323e7b14522f34
-
Filesize
371B
MD54071fd39f2a603e6cc88de4c77810c45
SHA1034be6df1d73c07113a29fe3ec5ea98309605cac
SHA256378b817382626f162c78d5570ee4c0fa9e15823921b4b2cf5bf63d545d4e4b83
SHA512f8e51a9bf0e024ebb30bf8981445b1bfb2e9e86d0fb70c954072b81b23a91df25ec75afe6617f75a71d826e67a80ee0b189f748915281a20a14af0dcf04249f7
-
Filesize
371B
MD57b2c4fcc727cb9fcc310764b685d7191
SHA103e0852cd2ebb40de3cd8eb92edc9f4d4e2bdbbe
SHA2567453c0b1856c95640de86b157268e4d726a561694453e2f66f64aea3862c4b64
SHA512f871425a3ec6055960c6127891fef2238fbf0d2fdb991acbedc1fe44b25475bc97ac8f27473cb8337cc47415d95d2bbd53682f32e239b9deaa0d056f096c92ef
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD50daba9bc5d350274ef05498605f4fb72
SHA1df48fb57f28b790f9e8709beeec9504df677b6de
SHA256adab2e9c9c108f16d9320513a718414753097e255413ac13a2b6c75ce931536c
SHA512a4ec0496d8845ef0585b105aa05f3d61a5ef873ed0f66246ce3a556cd4e86184300fbedec0bef51a21f32721fae3ab46a5a3136f3ed776b6c5983f0062c1a202