d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81

Resubmissions

05-12-2022 19:46

221205-ygyhfsdd5s 7

18-03-2022 13:00

220318-p8sxlshfg2 10

Analysis

max time kernel
154s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

software_reporter_tool.exe
Size

13.9MB
MD5

3dcd45838971b3e51d01e62c09d36e08
SHA1

9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a
SHA256

d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81
SHA512

6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa
SSDEEP

196608:CxG1Zx+zRIuG3rIqZ7uqPHhNu7XWyBOKl4lCmK2ouZ:CxGfOG3rIqZ7uKNu7XLBOU45f

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

Processes:

software_reporter_tool.exe

pid	process
4288	software_reporter_tool.exe
4288	software_reporter_tool.exe
4288	software_reporter_tool.exe
4288	software_reporter_tool.exe
4288	software_reporter_tool.exe
4288	software_reporter_tool.exe
4288	software_reporter_tool.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

software_reporter_tool.exe

pid process

2312 software_reporter_tool.exe
2312 software_reporter_tool.exe

pid	process
2312	software_reporter_tool.exe
2312	software_reporter_tool.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

software_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

description	pid	process
Token: 33	4556	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	4556	software_reporter_tool.exe
Token: 33	2312	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2312	software_reporter_tool.exe
Token: 33	4288	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	4288	software_reporter_tool.exe
Token: 33	4572	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	4572	software_reporter_tool.exe

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

software_reporter_tool.exe

description	pid	process	target process
PID 2312 wrote to memory of 4556	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4556	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4288	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe
PID 2312 wrote to memory of 4572	2312	software_reporter_tool.exe	software_reporter_tool.exe

C:\Users\Admin\AppData\Local\Temp\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Temp\software_reporter_tool.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312

\??\c:\users\admin\appdata\local\temp\software_reporter_tool.exe
c:\users\admin\appdata\local\temp\software_reporter_tool.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=99.279.200 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff624bf25a0,0x7ff624bf25b0,0x7ff624bf25c0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556

\??\c:\users\admin\appdata\local\temp\software_reporter_tool.exe
"c:\users\admin\appdata\local\temp\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2312_OPQDOURAWOVWFZMN" --sandboxed-process-id=2 --init-done-notifier=776 --sandbox-mojo-pipe-token=12657448806910410057 --mojo-platform-channel-handle=748 --engine=2
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4288

\??\c:\users\admin\appdata\local\temp\software_reporter_tool.exe
"c:\users\admin\appdata\local\temp\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2312_OPQDOURAWOVWFZMN" --sandboxed-process-id=3 --init-done-notifier=996 --sandbox-mojo-pipe-token=7225365521381993728 --mojo-platform-channel-handle=992
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
Filesize
1KB

MD5
ce51e36f116c8e50910c2a5fb3fa8ade

SHA1
69efef343714575f03f33904523888d57365b215

SHA256
20b0c684596aeb5686b2ef2b256589458f8defd041371a04a06e2397f0361f6d

SHA512
cfd5ac3e7386fdadf3a81ddb924920160e155bfd5c1b479a5bc484bd78275268cbde0d11b533c0321258fdc86f4766860865432f48a0189b8175063334f1c00b

Download Submit
C:\Users\Admin\AppData\Local\Temp\edls_64.dll
Filesize
446KB

MD5
e9a7c44d7bda10b5b7a132d46fcdaf35

SHA1
5217179f094c45ba660777cfa25c7eb00b5c8202

SHA256
35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1

SHA512
e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774

Download Submit
C:\Users\Admin\AppData\Local\Temp\em000_64.dll
Filesize
36KB

MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
C:\Users\Admin\AppData\Local\Temp\em001_64.dll
Filesize
378KB

MD5
7adcb76ec34d774d1435b477e8625c47

SHA1
ec4ba0ad028c45489608c6822f3cabb683a07064

SHA256
a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d

SHA512
c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\em002_64.dll
Filesize
2.2MB

MD5
5913dc18fc2a5dd49ba064655ac75c24

SHA1
d941ea7f6a7aa6c8b7dbc65fa37b6bf41dcd9069

SHA256
090b958bd2806e2571198847fad60ba446282b783d2da44efe3a879d0507701f

SHA512
d71edd1d2a5fa643f22fe0947c5910cf6b796845f6a782dd8503907babce49055175010296fbd890ff9ce0b3dd5df7ebfe7b8fb079c0ae4b7e562099d6e84197

Download Submit
C:\Users\Admin\AppData\Local\Temp\em003_64.dll
Filesize
1.3MB

MD5
ced50723c5ae960adfd3fc726b34cdb1

SHA1
962a477d168b786b3d1a301793ab91e1a850f376

SHA256
5a9dc132339862cc79f38c1b17db4c0fafa58eec396608ac1583784f1b3b6532

SHA512
ad70cac1f0a65362f4c2d1c221564c23fc2beecc9842aeb513a1448f2820d987e014af0557a30d50ae136d0bea83b8254ba871937576d3097fce567add578bee

Download Submit
C:\Users\Admin\AppData\Local\Temp\em004_64.dll
Filesize
6.1MB

MD5
6e1f355a54cf57047647beb9f5aca079

SHA1
529f42911634143507f28d4ea0b6757d6f17af65

SHA256
10a6c06788b110c0bfd26603d1dc4e3aec48ba917d4d80dac9fb34f83808eee6

SHA512
5ca0bbd9d2337c2e0019969725e904c1ab829dde36d4b35235cc6175d86996dabd2542914d7be0378ed298b758c9e542e059107db8ab7e3de424ac48b8d3aa74

Download Submit
C:\Users\Admin\AppData\Local\Temp\em005_64.dll
Filesize
576KB

MD5
169a2ef320119891cf3189aa3fd23b0e

SHA1
de51c936101ef79bbc0f1d3c800cf832d221eef8

SHA256
1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780

SHA512
7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
Filesize
40B

MD5
99339ac73355109d55f4a9cbec5a0737

SHA1
06aea2a8d7bc60bdd308ce5ebc3743d2e3506346

SHA256
cb03816bf717c4040164c1f05fe884c15c989b19f99b91e54444e97d5b32f9d1

SHA512
4cb40da943cff7bdac9915fa46c171b10844cdcdff9e20cfdda09ede9c9553aa06fff30a747cda6e9059b171e059bde25a46fae28bd8f4fefdec523b573eed85

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
Filesize
40B

MD5
99339ac73355109d55f4a9cbec5a0737

SHA1
06aea2a8d7bc60bdd308ce5ebc3743d2e3506346

SHA256
cb03816bf717c4040164c1f05fe884c15c989b19f99b91e54444e97d5b32f9d1

SHA512
4cb40da943cff7bdac9915fa46c171b10844cdcdff9e20cfdda09ede9c9553aa06fff30a747cda6e9059b171e059bde25a46fae28bd8f4fefdec523b573eed85

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
Filesize
40B

MD5
99339ac73355109d55f4a9cbec5a0737

SHA1
06aea2a8d7bc60bdd308ce5ebc3743d2e3506346

SHA256
cb03816bf717c4040164c1f05fe884c15c989b19f99b91e54444e97d5b32f9d1

SHA512
4cb40da943cff7bdac9915fa46c171b10844cdcdff9e20cfdda09ede9c9553aa06fff30a747cda6e9059b171e059bde25a46fae28bd8f4fefdec523b573eed85

Download Submit
\??\c:\users\admin\appdata\local\temp\edls_64.dll
Filesize
446KB

MD5
e9a7c44d7bda10b5b7a132d46fcdaf35

SHA1
5217179f094c45ba660777cfa25c7eb00b5c8202

SHA256
35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1

SHA512
e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774

Download Submit
\??\c:\users\admin\appdata\local\temp\em000_64.dll
Filesize
36KB

MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
\??\c:\users\admin\appdata\local\temp\em001_64.dll
Filesize
378KB

MD5
7adcb76ec34d774d1435b477e8625c47

SHA1
ec4ba0ad028c45489608c6822f3cabb683a07064

SHA256
a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d

SHA512
c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4

Download Submit
\??\c:\users\admin\appdata\local\temp\em002_64.dll
Filesize
2.2MB

MD5
5913dc18fc2a5dd49ba064655ac75c24

SHA1
d941ea7f6a7aa6c8b7dbc65fa37b6bf41dcd9069

SHA256
090b958bd2806e2571198847fad60ba446282b783d2da44efe3a879d0507701f

SHA512
d71edd1d2a5fa643f22fe0947c5910cf6b796845f6a782dd8503907babce49055175010296fbd890ff9ce0b3dd5df7ebfe7b8fb079c0ae4b7e562099d6e84197

Download Submit
\??\c:\users\admin\appdata\local\temp\em003_64.dll
Filesize
1.3MB

MD5
ced50723c5ae960adfd3fc726b34cdb1

SHA1
962a477d168b786b3d1a301793ab91e1a850f376

SHA256
5a9dc132339862cc79f38c1b17db4c0fafa58eec396608ac1583784f1b3b6532

SHA512
ad70cac1f0a65362f4c2d1c221564c23fc2beecc9842aeb513a1448f2820d987e014af0557a30d50ae136d0bea83b8254ba871937576d3097fce567add578bee

Download Submit
\??\c:\users\admin\appdata\local\temp\em004_64.dll
Filesize
6.1MB

MD5
6e1f355a54cf57047647beb9f5aca079

SHA1
529f42911634143507f28d4ea0b6757d6f17af65

SHA256
10a6c06788b110c0bfd26603d1dc4e3aec48ba917d4d80dac9fb34f83808eee6

SHA512
5ca0bbd9d2337c2e0019969725e904c1ab829dde36d4b35235cc6175d86996dabd2542914d7be0378ed298b758c9e542e059107db8ab7e3de424ac48b8d3aa74

Download Submit
\??\c:\users\admin\appdata\local\temp\em005_64.dll
Filesize
576KB

MD5
169a2ef320119891cf3189aa3fd23b0e

SHA1
de51c936101ef79bbc0f1d3c800cf832d221eef8

SHA256
1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780

SHA512
7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca

Download Submit
\??\pipe\crashpad_2312_OPQDOURAWOVWFZMN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4288-135-0x0000000000000000-mapping.dmp

Download
memory/4288-156-0x0000027C60970000-0x0000027C609B0000-memory.dmp

Filesize
256KB

Download
memory/4288-157-0x0000027C60970000-0x0000027C609B0000-memory.dmp

Filesize
256KB

Download
memory/4556-132-0x0000000000000000-mapping.dmp

Download
memory/4572-151-0x0000000000000000-mapping.dmp

Download