hxxps://xyt2i[.]mjt[.]lu/lnk/AVkAAA9iavIAAAAIsFAAABTLbSEAAAAAd7gAAJJjABga0gBhZws5xuGGelhoRkGh3roSDjBB3QAW_mw/1/7AYrBj-XoRdH-Y9PXfcAMg/aHR0cHM6Ly9zdG9yYWdlLW1haWxib3guc2VjdXJlbG9naW4ud29ya2Vycy5kZXYvI2t1cnQuc25vZGdyYXNzQGxvZ21laW4uY29t#kurt[.]snodgrass@logmein[.]com

General

Target

https://xyt2i.mjt.lu/lnk/AVkAAA9iavIAAAAIsFAAABTLbSEAAAAAd7gAAJJjABga0gBhZws5xuGGelhoRkGh3roSDjBB3QAW_mw/1/7AYrBj-XoRdH-Y9PXfcAMg/aHR0cHM6Ly9zdG9yYWdlLW1haWxib3guc2VjdXJlbG9naW4ud29ya2Vycy5kZXYvI2t1cnQuc25vZGdyYXNzQGxvZ21laW4uY29t#kurt.snodgrass@logmein.com
Sample

211013-3bzwjsfbhj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

software_reporter_tool.exesoftware_reporter_tool.exe

pid process

1732 software_reporter_tool.exe
1084 software_reporter_tool.exe

pid	process
1732	software_reporter_tool.exe
1084	software_reporter_tool.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
1236	chrome.exe
1236	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
1364	chrome.exe
1364	chrome.exe
2956	chrome.exe
2956	chrome.exe
1452	chrome.exe
1452	chrome.exe
2072	chrome.exe
2072	chrome.exe
2488	chrome.exe
2488	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3908	chrome.exe
3908	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exe

pid process

2352 chrome.exe
2352 chrome.exe
2352 chrome.exe
2352 chrome.exe
2352 chrome.exe
2352 chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exe

pid	process
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 4068	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 2284	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 1236	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 1236	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe
PID 2352 wrote to memory of 3896	2352	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://xyt2i.mjt.lu/lnk/AVkAAA9iavIAAAAIsFAAABTLbSEAAAAAd7gAAJJjABga0gBhZws5xuGGelhoRkGh3roSDjBB3QAW_mw/1/7AYrBj-XoRdH-Y9PXfcAMg/aHR0cHM6Ly9zdG9yYWdlLW1haWxib3guc2VjdXJlbG9naW4ud29ya2Vycy5kZXYvI2t1cnQuc25vZGdyYXNzQGxvZ21laW4uY29t#kurt.snodgrass@logmein.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xcc,0xa8,0x7ff96b0c4f50,0x7ff96b0c4f60,0x7ff96b0c4f70
2⤵
PID:4068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1672 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 /prefetch:8
2⤵
PID:3896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:1
2⤵
PID:2052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1
2⤵
PID:3440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1536 /prefetch:2
2⤵
PID:2284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4188 /prefetch:8
2⤵
PID:1152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:1
2⤵
PID:1288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
2⤵
PID:952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4360 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:8
2⤵
PID:2840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5484 /prefetch:8
2⤵
PID:3588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:8
2⤵
PID:3024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4796 /prefetch:8
2⤵
PID:3032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5552 /prefetch:8
2⤵
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:8
2⤵
PID:2244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4692 /prefetch:8
2⤵
PID:2364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5008 /prefetch:8
2⤵
PID:1676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
2⤵
PID:3828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
2⤵
PID:652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=852 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1020 /prefetch:8
2⤵
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1648 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4420 /prefetch:8
2⤵
PID:3968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1648 /prefetch:8
2⤵
PID:1476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5688 /prefetch:8
2⤵
PID:1740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2616 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
2⤵
PID:3604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
2⤵
PID:2636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 /prefetch:8
2⤵
PID:804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5676 /prefetch:8
2⤵
PID:1352

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=6OCWtFIS0TTkCjQbp9t3/wieifTch4vPD51cDnvt --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
2⤵
- Executes dropped EXE
PID:1732

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=93.269.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7b93b9300,0x7ff7b93b9310,0x7ff7b93b9320
3⤵
- Executes dropped EXE
PID:1084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,12193694778515731969,16394117076072156167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
MD5
3b0606ae5ee3f55e9ee529eb4de3015e

SHA1
01d92c8f07d7693cbd44eee2efcd25aa82e842ff

SHA256
0e7e507123129da0a709ed9cd0ffd361818dc3b63ae41789c43a248f14ee9ccf

SHA512
31b6dee14a038d90eeabd6c36bf6b28137c7fb122fd3d87b2b0d33e578a09e4a9c534f25ac385df9f2f2f074094938525b3bfd7116c98e77b9092f599630cfd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
MD5
283645f960a976ced19529caa6fa2e15

SHA1
798c72e5eff0d1464022eaa16b32a2bca0b3772b

SHA256
171e703d2630c186ba522ca326cd945ca6693c9ab09e2df154095c068b1b4843

SHA512
0609b49eb166ba91f31999f3b028a6423ca31dd623c988a93eed44ca84236ab1dac224f36f357511813f8b4f60ba16599cc66463265628b59eef9f406d525a87

Download Submit
\??\pipe\crashpad_2352_TUNYKXMGOIKTLCBJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1084-120-0x0000000000000000-mapping.dmp

Download
memory/1084-122-0x000001B4BCA70000-0x000001B4BCA72000-memory.dmp

Filesize
8KB

Download
memory/1084-123-0x000001B4BCA70000-0x000001B4BCA72000-memory.dmp

Filesize
8KB

Download
memory/1732-116-0x0000000000000000-mapping.dmp

Download
memory/1732-118-0x0000027342A60000-0x0000027342A62000-memory.dmp

Filesize
8KB

Download
memory/1732-119-0x0000027342A60000-0x0000027342A62000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads