General
Target

intelsoftwareassetmanagerservice.exe

Filesize

3MB

Completed

20-05-2022 09:28

Task

behavioral1

Score
1/10
MD5

5bdebce7118d30a387fec0f9329c5437

SHA1

83a66c54772017c6fa0e243bcf5bbfebd2c29518

SHA256

b8f8ddaba5754af65c9b7c762d69e1b2bd3702307c41589977759d813bf78635

SHA512

96676730f1529972ee7f6582d43d856ffeed4706d26042c961ed14598eb03c0be410c1fe4d993b5a2eb594a7de0eba5b9004c713e29ae7e932947beda1de80b4

Malware Config
Signatures 5

Filter: none

Discovery
  • Enumerates system info in registry
    chrome.exe

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductNamechrome.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOSchrome.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturerchrome.exe
  • Suspicious behavior: EnumeratesProcesses
    chrome.exechrome.exechrome.exechrome.exechrome.exe

    Reported IOCs

    pidprocess
    944chrome.exe
    1812chrome.exe
    1812chrome.exe
    2824chrome.exe
    1812chrome.exe
    1812chrome.exe
    2964chrome.exe
    2120chrome.exe
  • Suspicious use of FindShellTrayWindow
    chrome.exe

    Reported IOCs

    pidprocess
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
  • Suspicious use of SendNotifyMessage
    chrome.exe

    Reported IOCs

    pidprocess
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
    1812chrome.exe
  • Suspicious use of WriteProcessMemory
    chrome.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1812 wrote to memory of 17801812chrome.exechrome.exe
    PID 1812 wrote to memory of 17801812chrome.exechrome.exe
    PID 1812 wrote to memory of 17801812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 20041812chrome.exechrome.exe
    PID 1812 wrote to memory of 9441812chrome.exechrome.exe
    PID 1812 wrote to memory of 9441812chrome.exechrome.exe
    PID 1812 wrote to memory of 9441812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
    PID 1812 wrote to memory of 17081812chrome.exechrome.exe
Processes 31
  • C:\Users\Admin\AppData\Local\Temp\intelsoftwareassetmanagerservice.exe
    "C:\Users\Admin\AppData\Local\Temp\intelsoftwareassetmanagerservice.exe"
    PID:1672
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    Enumerates system info in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb134f50,0x7fefb134f60,0x7fefb134f70
      PID:1780
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1100 /prefetch:2
      PID:2004
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1284 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:944
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1700 /prefetch:8
      PID:1708
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
      PID:1692
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1
      PID:1332
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3036 /prefetch:8
      PID:320
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3328 /prefetch:2
      PID:2028
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
      PID:1688
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3488 /prefetch:8
      PID:316
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:8
      PID:2004
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3936 /prefetch:8
      PID:2116
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3956 /prefetch:8
      PID:2124
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
      PID:2212
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
      PID:2328
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1
      PID:2408
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
      PID:2400
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2228 /prefetch:1
      PID:2532
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5292 /prefetch:8
      PID:2632
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1400 /prefetch:8
      PID:2672
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
      PID:2784
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:2824
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:2964
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:2120
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3788 /prefetch:8
      PID:1720
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:8
      PID:588
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:8
      PID:1076
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,15975368826223893646,14123222298386292068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:8
      PID:1584
  • C:\Users\Admin\AppData\Local\Temp\Temp1_20220520_sample1.zip\intelsoftwareassetmanagerservice.exe
    "C:\Users\Admin\AppData\Local\Temp\Temp1_20220520_sample1.zip\intelsoftwareassetmanagerservice.exe"
    PID:1796
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • \??\pipe\crashpad_1812_QIFCSSTQYSYUYQFZ

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e