hxxps://drive[.]google[.]com/file/d/1ErjkeUorJLMh1fnzhUo-tsnVj1Wo3tld

Analysis

max time kernel
24s
max time network
16s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
01-01-2025 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1ErjkeUorJLMh1fnzhUo-tsnVj1Wo3tld

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4952	msedge.exe
4952	msedge.exe
2308	msedge.exe
2308	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2984	4952	msedge.exe	78
PID 4952 wrote to memory of 2984	4952	msedge.exe	78
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 1100	4952	msedge.exe	79
PID 4952 wrote to memory of 4760	4952	msedge.exe	80
PID 4952 wrote to memory of 4760	4952	msedge.exe	80
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81
PID 4952 wrote to memory of 3632	4952	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1ErjkeUorJLMh1fnzhUo-tsnVj1Wo3tld
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb50f93cb8,0x7ffb50f93cc8,0x7ffb50f93cd8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13336038908941611265,16698327636042781374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
6fc992040d5c8adc426532ae2413efc8

SHA1
ac87fb590428328fd43d7e0d40886fa0b26c1039

SHA256
dbb84f0007c8cdd964cbc6ec929b96f59d3aa4e2ae7ebcf9a22eabfccf61b76c

SHA512
5e09116ec18eb1643f9008e3ba2c9f5bdd9895e84e06baf192605487d4a6298efda514ca4a9ae9b010e2f923f7a335c7201b79334f3f77e1af6b89f2be8be8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc55e0fac88a8daf1f9ba63ace2290e8

SHA1
9cd0163641c4937065263f16669bc7693bb9ec8c

SHA256
a2379751864ad8edcb12a52ae0f0ffb47a760f39adc2b606da8c7940dfd889f6

SHA512
7f21709bc435c9dc45a9eb2967bfafb1cadfa43dbb9a81804539c59eebbe416237ef4822ffa9a4a92752cd547cf4c602b172ac890d8e3da511e38d9cc79752be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30387b65c5c1aad1ddcdbdb99e715b2a

SHA1
bef750c161642a464a3a8815513e79ee7ac0fbcb

SHA256
e51498cab6bff7507557acaa116def10db19710172500719874cf58428b35e9a

SHA512
ca7fef040708090f3ba9afa35c767d1d8108c34ccb47ed94e561f49f3a290b7f44c2e1bfab5fb63c672ced4c0c6b9c62568c9555d80bd01b517f09a7ff23020b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1625e9315559afdba110c16a5fd5e6fa

SHA1
20b39d6e38ab8491818a526c6ec2e3db16a98aed

SHA256
ae7024006de88c61d9fbfb8f68de8bcfd445ce4cee67fec1129fb55df9e19172

SHA512
69800f9f6039d1c34286990e8fd47c4f070219a0713217a071843d1540ead7167b9a5240b8074767a30d4b15710c846f2ad3614dcb1f5a2151d965dd6e82c608

Download Submit