hxxps://drive[.]google[.]com/file/d/1e3wHrQpGRia9Me-2h_HwKtqK4ZCb_4jA/view?usp=drive_link

Analysis

max time kernel
246s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1e3wHrQpGRia9Me-2h_HwKtqK4ZCb_4jA/view?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
14	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4144	msedge.exe
4144	msedge.exe
3664	identity_helper.exe
3664	identity_helper.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 2584	4144	msedge.exe	84
PID 4144 wrote to memory of 2584	4144	msedge.exe	84
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4276	4144	msedge.exe	85
PID 4144 wrote to memory of 4828	4144	msedge.exe	86
PID 4144 wrote to memory of 4828	4144	msedge.exe	86
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87
PID 4144 wrote to memory of 956	4144	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1e3wHrQpGRia9Me-2h_HwKtqK4ZCb_4jA/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd01646f8,0x7ffcd0164708,0x7ffcd0164718
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,10357767187533212558,2644093939956117290,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
cb7efb32c82e98673d710b80d4992f1c

SHA1
0cd905e4811538ba261569f5d7f2f20a3912d455

SHA256
c9796838b1e0b8fe708699a72590033ac1035153a9059224fa2d9c21ca318480

SHA512
0c03b6578b762d99a378647785d4ffbc4e1ec7cf09773e4b9a5fd6a77f9db1f2107df937946075dd76369f23e63401ac91e9bf3172a006360b95745edb4c83da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6a26914105f41b0de0f9aac9faef5ed9

SHA1
65fef0c83a7cad5e9f7f0374839ea839aef9256f

SHA256
71bd4c5e1759f59c035945f61210068cd88df241ab779a274db69f13438c39c1

SHA512
606a58cb7e09008cbe30f9500cbbcf5e2657fd4c15353e60ad68e0e2a348524b06341f180293d858f71eebd00b3b2bc25c844c1ac8b66cfd874375a406766b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b94545f05dd199a8d9ae634f60bbd003

SHA1
91de87f761e204c37378d88c0bed1224bb90a8be

SHA256
e865c821335e16a88c0e850ada0d7b277dae21e7e752b87b8f78844ced0300e7

SHA512
af133693e6df8ca37d9c0ed6eb316008a75e041e283ec9a5d0562b9437377a9ba79c31aa71c1e5dc3d0247a221c1ea976591b6a4249d7ca802fff20670811a02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e95c74313a3337e640508f851f6514fd

SHA1
968334f3b3c0ee2fb5f696d8c5e77410e675f0bd

SHA256
33397cf771eda16177574e957e72a9b2cc855d93dee872dcbad6abe6ad8b4d43

SHA512
e59f75b69746c5f9cd61d2151c02b9e6de780b45a84681a7251621b088a7f9d636049a7beef8f03f4da8131def3d2101a0b43e8a9984dd54b61711f39147bf2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c4346b52db7ef569ec81e6d187ed70d4

SHA1
679a85cd967669112589d0e5eb4e9d9692934445

SHA256
a316bdaa9564408d7e8354cd8149032435e97bfee23b0ead26b5c6393986abfc

SHA512
6901909dac261ee8b041e8d705b95bcd070787509e62c03c33b6b425067f00d3b3bef5c5cbf9f242a76468537b81ddce93f17c0d474af04662136bedafc6aa1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
62b250d814387b9f32293982a8815014

SHA1
59e236ee9a6f1d8b6ce7a38f9a8900865dfc0c95

SHA256
554a1e7a88ae3be34e882e7aa011c8aa623171c5e134c038ded73473eaa6115d

SHA512
3931b94ecec3815c8672d829cc6cf3f823b35ef47a8afa2eccdb633e46e4347fc68e618661b133b00a9c9d8bd7d41a7b3a27513da0cbf97101aa630d58ec2dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b12a.TMP

Filesize
203B

MD5
5ef7b22e0b3e91eb4097cb95bde88544

SHA1
7d2aa5bd12df4415b862de1519fea8e0e56cc53e

SHA256
0d5d4248874263cdb25062baf0dd7ca46d11b1d5841dbe47bbb3f0113cae6950

SHA512
855bad6f025257b9a75095ed96cae85c2bf71750887de8d1b22c057f80a9a648d6d5d097abd4df2b0097eb0910c81468dc308f56121ea6abe9c88ca6041c39ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f30fc13311022ba3055b9186776eed86

SHA1
9a028145b4886c9f95954348bfcc9eb2c9a4373d

SHA256
fca4271038af194cbcfd9e0f3cc7742a984234bfec4bef89e1c627487f693c91

SHA512
e17695db340adff7a7c81270704d604ddcd69b4a96344b14edebf0c9388e322bfbd0e603c24558aa0f7b4a85c8b6929bf4d7a208183a8255bd1d634f3e778b4f

Download Submit