hxxps://drive[.]google[.]com/file/d/1fBjZC29XCki6FKmKDxNJdHEfdVGrUkJG/view?usp=sharing

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2025, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1fBjZC29XCki6FKmKDxNJdHEfdVGrUkJG/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
3840	msedge.exe
3840	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4952	3840	msedge.exe	82
PID 3840 wrote to memory of 4952	3840	msedge.exe	82
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 368	3840	msedge.exe	84
PID 3840 wrote to memory of 2128	3840	msedge.exe	85
PID 3840 wrote to memory of 2128	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86
PID 3840 wrote to memory of 4912	3840	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1fBjZC29XCki6FKmKDxNJdHEfdVGrUkJG/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffaf7c46f8,0x7fffaf7c4708,0x7fffaf7c4718
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,8575715258365338117,2085030338121166931,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5620 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7b5a5433fe76697fec05973806a648c

SHA1
786027abe836d4d8ff674c463e5bb02c4a957b70

SHA256
c8d623536ebdf5ffbefb84013d1c8ff5f853b59f1b09c80364c32b8ed5e4a735

SHA512
27be4c82e26468bbb9ce698ef305320f6cac46c953f88c714a0372fa524d098b9af2a87a88b14a134ff0f5f4b3d671902908622d2c7ec48e2c7bc458d7f5cc16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8ea156392347ae1e43bf6f4c7b7bc6ec

SHA1
7e1230dd6103043d1c5d9984384f93dab02500a6

SHA256
40b28bf59b3e2026ad3ebe2fecf464a03d7094fd9b26292477ad264d4efc1c75

SHA512
2479b86a9a31aa2f260ff6a1c963691994242ced728a27ffa2ee4e224945446a191bdb49ce399ec5a7d5d362499716133072e97d4253b5b4f09582d58b25144f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
0c3e7686e506b8825f3a213dc0392432

SHA1
1a3bbddc6df4cdcc69c4524939c32ae87b7b8452

SHA256
2f381ec723aa2b3bc9f5038b8840899fc6ce7fbaf44eb1dd82d200ac1ad278ca

SHA512
3b1bf3967e3a7e62d994b4eda08dfb050257292f240d7a85cf94cd3e4a6781332a554948a91d567c9d6b24041bb4aa5153fbeab39200ecd2c364ec96dfe87b8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e5892b4f2af46923fa73022728e75133

SHA1
650e3999f638863b149f2e04803a1eda6f0b6d77

SHA256
4154a4e14f7423e1c56f402aff1af42b3ba5cc8e09a915297650066aa9891379

SHA512
80039e952bc65db61e812f7ed007bb04fd32ce6abc2dea80aed06105e41a1597e5fd07195dfddc531ab56d8d00ecc032c9719646f57305c5c59b27091c6a7706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d49378e32a692d58ae13ade3df7472b7

SHA1
7ea3f39a1bcec799f3467e15b3f8e7db0259d190

SHA256
beef1f45f399ddd8af66ef654bf4c23269d7cc47e4056d9c9691e07ee8c35fcf

SHA512
6e4f336c6b95e9bfcc4a4bc37c6ec295507824db8800862c6c5136285c5b991977dd3d38f63b8f510634f5a5bffdf225150330aa581273874946e41e10750f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1ac185469154357b50d830847e54ea9

SHA1
cd9d7ddbe9c5e019f4897bceaf45a82f38c6b4fb

SHA256
4296797719ac7b38231a8b594c7a26baba6cf4cd704e1637c3d6896eb9a16840

SHA512
7c9c949e8fb3caceeb9d635cad1d50e6e64469efb3af09bab11e62d2bb9e982e4581e3cdf52bbad99c37ffc3e4abdad52e8100b50cb93c641997ec07ec6603b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1b4af83c795a969247ee308c39ec4bd

SHA1
a3424c65a46bc15e486b4b0106a9e036d530e6e9

SHA256
3aefc3b091f90b33aa3a4ad2552fbde6ad412cadcbb8da5e13aec07268d45c8c

SHA512
78e6585b43be0d8caeff91e77de1e515f73aa989193dff027cc5852f0ad00b80b7a3fffe4c9f0db3565e7f294efa7b03fc2b779a3e662a4cd2489dbb6900a80a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b2d84e1b3ea0e7a58372f00317cfcde

SHA1
1fb0280fa519f5f7c45e0a96fdd6ebab84b13dda

SHA256
28b0ff885bfb3ddbe36b81fcd2679a35ab15b4f3e8937cf2594e364df93cd4ff

SHA512
fa2eb19253874004ae7ca525ac9ad252fc4eb0cdb07e2f41d5272a7d83607319764036f89a54bc4cf843a6846515d6383405f8af05f848e2044de52e0246c73d

Download Submit