d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81

Resubmissions

05-12-2022 19:46

221205-ygyhfsdd5s 7

18-03-2022 13:00

220318-p8sxlshfg2 10

Analysis

max time kernel
173s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

software_reporter_tool.exe
Size

13.9MB
MD5

3dcd45838971b3e51d01e62c09d36e08
SHA1

9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a
SHA256

d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81
SHA512

6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa
SSDEEP

196608:CxG1Zx+zRIuG3rIqZ7uqPHhNu7XWyBOKl4lCmK2ouZ:CxGfOG3rIqZ7uKNu7XLBOU45f

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
1744	software_reporter_tool.exe
1744	software_reporter_tool.exe
1744	software_reporter_tool.exe
1744	software_reporter_tool.exe
1744	software_reporter_tool.exe
1744	software_reporter_tool.exe
1744	software_reporter_tool.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1536	software_reporter_tool.exe
1536	software_reporter_tool.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	1364	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	1364	software_reporter_tool.exe
Token: 33	1536	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	1536	software_reporter_tool.exe
Token: 33	1744	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	1744	software_reporter_tool.exe
Token: 33	1528	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	1528	software_reporter_tool.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1364	1536	software_reporter_tool.exe	27
PID 1536 wrote to memory of 1364	1536	software_reporter_tool.exe	27
PID 1536 wrote to memory of 1364	1536	software_reporter_tool.exe	27
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1744	1536	software_reporter_tool.exe	28
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29
PID 1536 wrote to memory of 1528	1536	software_reporter_tool.exe	29

C:\Users\Admin\AppData\Local\Temp\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Temp\software_reporter_tool.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536
- \??\c:\users\admin\appdata\local\temp\software_reporter_tool.exe
  c:\users\admin\appdata\local\temp\software_reporter_tool.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=99.279.200 --initial-client-data=0x160,0x164,0x168,0x134,0x16c,0x13fb325a0,0x13fb325b0,0x13fb325c0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1364
- \??\c:\users\admin\appdata\local\temp\software_reporter_tool.exe
  "c:\users\admin\appdata\local\temp\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_1536_BDGYIOJNYHZSRVEJ" --sandboxed-process-id=2 --init-done-notifier=480 --sandbox-mojo-pipe-token=5040956218682954463 --mojo-platform-channel-handle=456 --engine=2
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- \??\c:\users\admin\appdata\local\temp\software_reporter_tool.exe
  "c:\users\admin\appdata\local\temp\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_1536_BDGYIOJNYHZSRVEJ" --sandboxed-process-id=3 --init-done-notifier=632 --sandbox-mojo-pipe-token=3021157051371543883 --mojo-platform-channel-handle=628
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log

Filesize
1KB

MD5
9ab562101d8a37d57c67702f4d337dd3

SHA1
362b2620d057b0e2db85c2543c694c5383025793

SHA256
4e87ed853bf985f431d86ec541f5f4d6a7ace03ab0a6c47d210f2b7750d8ccf5

SHA512
6c6f0b82e13bf57cee9b4d93b1c806cb0fc09b490e429d6d924985ed711cd20b5eea74b6ee42a67ed63423ac14b8c6655002ef4b701e0eef4956000b76c3daaf

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat

Filesize
40B

MD5
5c0b0e295c203858fbecbd9fa0be8245

SHA1
df3671ee3a8c065a03bc5a4df53588b54a7a2bce

SHA256
7d1238c160b973f19035a1203874534b5cd3d11e12ea503ac98022fe7ff8d67d

SHA512
8470b5a7f09932b4b37e1cac45a29c8817c7d3b1b4c6e5fde5225786c39197473033b22ac60a2408c8d7557e0bf2bdd16427cf7b1d61591d9578551fcca5f886

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat

Filesize
40B

MD5
5c0b0e295c203858fbecbd9fa0be8245

SHA1
df3671ee3a8c065a03bc5a4df53588b54a7a2bce

SHA256
7d1238c160b973f19035a1203874534b5cd3d11e12ea503ac98022fe7ff8d67d

SHA512
8470b5a7f09932b4b37e1cac45a29c8817c7d3b1b4c6e5fde5225786c39197473033b22ac60a2408c8d7557e0bf2bdd16427cf7b1d61591d9578551fcca5f886

Download Submit
\??\c:\users\admin\appdata\local\temp\edls_64.dll

Filesize
446KB

MD5
e9a7c44d7bda10b5b7a132d46fcdaf35

SHA1
5217179f094c45ba660777cfa25c7eb00b5c8202

SHA256
35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1

SHA512
e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774

Download Submit
\??\c:\users\admin\appdata\local\temp\em000_64.dll

Filesize
36KB

MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
\??\c:\users\admin\appdata\local\temp\em001_64.dll

Filesize
378KB

MD5
7adcb76ec34d774d1435b477e8625c47

SHA1
ec4ba0ad028c45489608c6822f3cabb683a07064

SHA256
a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d

SHA512
c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4

Download Submit
\??\c:\users\admin\appdata\local\temp\em002_64.dll

Filesize
2.2MB

MD5
5913dc18fc2a5dd49ba064655ac75c24

SHA1
d941ea7f6a7aa6c8b7dbc65fa37b6bf41dcd9069

SHA256
090b958bd2806e2571198847fad60ba446282b783d2da44efe3a879d0507701f

SHA512
d71edd1d2a5fa643f22fe0947c5910cf6b796845f6a782dd8503907babce49055175010296fbd890ff9ce0b3dd5df7ebfe7b8fb079c0ae4b7e562099d6e84197

Download Submit
\??\c:\users\admin\appdata\local\temp\em003_64.dll

Filesize
1.3MB

MD5
ced50723c5ae960adfd3fc726b34cdb1

SHA1
962a477d168b786b3d1a301793ab91e1a850f376

SHA256
5a9dc132339862cc79f38c1b17db4c0fafa58eec396608ac1583784f1b3b6532

SHA512
ad70cac1f0a65362f4c2d1c221564c23fc2beecc9842aeb513a1448f2820d987e014af0557a30d50ae136d0bea83b8254ba871937576d3097fce567add578bee

Download Submit
\??\c:\users\admin\appdata\local\temp\em004_64.dll

Filesize
6.1MB

MD5
6e1f355a54cf57047647beb9f5aca079

SHA1
529f42911634143507f28d4ea0b6757d6f17af65

SHA256
10a6c06788b110c0bfd26603d1dc4e3aec48ba917d4d80dac9fb34f83808eee6

SHA512
5ca0bbd9d2337c2e0019969725e904c1ab829dde36d4b35235cc6175d86996dabd2542914d7be0378ed298b758c9e542e059107db8ab7e3de424ac48b8d3aa74

Download Submit
\??\c:\users\admin\appdata\local\temp\em005_64.dll

Filesize
576KB

MD5
169a2ef320119891cf3189aa3fd23b0e

SHA1
de51c936101ef79bbc0f1d3c800cf832d221eef8

SHA256
1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780

SHA512
7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca

Download Submit
\Users\Admin\AppData\Local\Temp\edls_64.dll

Filesize
446KB

MD5
e9a7c44d7bda10b5b7a132d46fcdaf35

SHA1
5217179f094c45ba660777cfa25c7eb00b5c8202

SHA256
35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1

SHA512
e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774

Download Submit
\Users\Admin\AppData\Local\Temp\em000_64.dll

Filesize
36KB

MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
\Users\Admin\AppData\Local\Temp\em001_64.dll

Filesize
378KB

MD5
7adcb76ec34d774d1435b477e8625c47

SHA1
ec4ba0ad028c45489608c6822f3cabb683a07064

SHA256
a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d

SHA512
c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4

Download Submit
\Users\Admin\AppData\Local\Temp\em002_64.dll

Filesize
2.2MB

MD5
5913dc18fc2a5dd49ba064655ac75c24

SHA1
d941ea7f6a7aa6c8b7dbc65fa37b6bf41dcd9069

SHA256
090b958bd2806e2571198847fad60ba446282b783d2da44efe3a879d0507701f

SHA512
d71edd1d2a5fa643f22fe0947c5910cf6b796845f6a782dd8503907babce49055175010296fbd890ff9ce0b3dd5df7ebfe7b8fb079c0ae4b7e562099d6e84197

Download Submit
\Users\Admin\AppData\Local\Temp\em003_64.dll

Filesize
1.3MB

MD5
ced50723c5ae960adfd3fc726b34cdb1

SHA1
962a477d168b786b3d1a301793ab91e1a850f376

SHA256
5a9dc132339862cc79f38c1b17db4c0fafa58eec396608ac1583784f1b3b6532

SHA512
ad70cac1f0a65362f4c2d1c221564c23fc2beecc9842aeb513a1448f2820d987e014af0557a30d50ae136d0bea83b8254ba871937576d3097fce567add578bee

Download Submit
\Users\Admin\AppData\Local\Temp\em004_64.dll

Filesize
6.1MB

MD5
6e1f355a54cf57047647beb9f5aca079

SHA1
529f42911634143507f28d4ea0b6757d6f17af65

SHA256
10a6c06788b110c0bfd26603d1dc4e3aec48ba917d4d80dac9fb34f83808eee6

SHA512
5ca0bbd9d2337c2e0019969725e904c1ab829dde36d4b35235cc6175d86996dabd2542914d7be0378ed298b758c9e542e059107db8ab7e3de424ac48b8d3aa74

Download Submit
\Users\Admin\AppData\Local\Temp\em005_64.dll

Filesize
576KB

MD5
169a2ef320119891cf3189aa3fd23b0e

SHA1
de51c936101ef79bbc0f1d3c800cf832d221eef8

SHA256
1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780

SHA512
7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca

Download Submit
memory/1528-108-0x000000013FB37000-0x000000013FB38000-memory.dmp

Filesize
4KB

Download
memory/1528-107-0x000000013FB37000-0x000000013FB38000-memory.dmp

Filesize
4KB

Download
memory/1744-74-0x000000013FB37000-0x000000013FB38000-memory.dmp

Filesize
4KB

Download
memory/1744-73-0x000000013FB37000-0x000000013FB38000-memory.dmp

Filesize
4KB

Download
memory/1744-114-0x0000000000420000-0x0000000000460000-memory.dmp

Filesize
256KB

Download
memory/1744-115-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download