hxxps://drive[.]google[.]com/open?id=1bLxXMS99N_hy41iA_VwIU4qAcGVF8r_Y

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/open?id=1bLxXMS99N_hy41iA_VwIU4qAcGVF8r_Y

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
4064	msedge.exe
4064	msedge.exe
2316	identity_helper.exe
2316	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4980	4064	msedge.exe	85
PID 4064 wrote to memory of 4980	4064	msedge.exe	85
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 2740	4064	msedge.exe	86
PID 4064 wrote to memory of 684	4064	msedge.exe	87
PID 4064 wrote to memory of 684	4064	msedge.exe	87
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88
PID 4064 wrote to memory of 2640	4064	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/open?id=1bLxXMS99N_hy41iA_VwIU4qAcGVF8r_Y
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff984a646f8,0x7ff984a64708,0x7ff984a64718
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2022140606209772970,3082071262735967019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
783B

MD5
7968a756b82c28b0f3ae0d49dcf5c5c7

SHA1
4c178bbea911671bfa258fe129ae14b8a286c0a9

SHA256
238302906b6eb9f3fe829476aa8b18576ca8cbaa89d5f4ff193bf741bfb3068f

SHA512
124654210648c18fd90618598a5cd2360bda062bbfd3e14ae50dfc6a51f3c22b75c6bb80197c3fca456fa483c7a897ebb34ce68c395933eba93961931f457ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9cdf3904312ac941fd86ecbfe27e117

SHA1
7d24a66bb9b20bba4a47cdf41c3f6c916288f963

SHA256
1d224bd651674b57a0e26788f0b598f9432dc1f5595d07e5bd9c16130c6ed820

SHA512
463cf0dd21d63624627dc966d40af774c302745d5cde7cd3a9e9f900cc9e2ce9979a6958bee6d3fbc896d4f8023c92e416bcc8fbd6ebc5879789b00b6e184c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
009c9cc6aeea60d9eec151fb905fed63

SHA1
2961bfdd704893827d316b505c5d0fe851d03ccd

SHA256
17dfc35a310961ec19580fba7512d1a3a5dcd44a8326e495d8e45f2b63addcfa

SHA512
8ddda7eb894c16d8fbcb8fd4881a8c1379513eb308db0ad7a72bf85191a2877fdf7c7585c30053324f37081d302b34b78fbc6a26de8d761eebdc3b5ea5bc18dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4cf16ef5207b00a57e743ef70c5c0f4

SHA1
f13386b35bae151914552dfe2d11749ad8cccd74

SHA256
48d856bd714f44a6877083d68ab077d69e45625ba3c74daa1cd01553885abfd6

SHA512
e700dfa6cb1bc42e5a3b4f463178c7ce58e6d9be80f45a035960717ba3dc59f5fbadafeea372ef058c41b45d45540a1e6cdd8674f9c28d32a9cf3d02996d0220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
3648cb84065f28d102050a0bc2dc8f54

SHA1
6070681fcbb75d48fc342f752a1b405dcfcf1635

SHA256
ad2c44252f890ef270b822ce289ed43c3ec65d038467f3b52a1c54ddaaeefb1f

SHA512
8114a49b64ebbb2a67738919b8c6964b3e2a218ece481f6f5a9655a14a033262f3c6a4fd6ee08a81a12c6b52c7779b9a4d7afcbf7e1690244caadcbeb19b0f30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b10b.TMP

Filesize
204B

MD5
3a0031f13fe817584ae0e5199ebc6e84

SHA1
6ce2390000bc6947924ec2a9801a866f41fb538e

SHA256
9486e5a07336789db70a724257874c9ca9d814991863bb0c62b89ad64eab2e37

SHA512
ab9bc29d4d73b391ba6dd45a5048520637de6b36ea13c8c4e4fb946b3f9d1ee3801d11e42df82ef71509f9ad6951e6f1ba968e7639d1e07175fbbd91841c3960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fbf0748b11458e9d6f9477b45bc47ad6

SHA1
d44db8b6b16777c6c36913739210690e77aa8766

SHA256
aed55007ec1860b949996f4435199c357082f965cf550c950109f84c36edf4d0

SHA512
28fc16f5040495de7da83fa50f4e1a64e0093bfc26351950821dcecaed8936657566837f3431113b4580098393c6417b9d3f7c38a8e53df4a31637b4dacfa8de

Download Submit