c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79

Analysis

max time kernel
103s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2023 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Windows10Upgrade9252.exe
Size

3.2MB
MD5

c0b25def4312fbddbcc4f01c6c0f5ba6
SHA1

8d16a183d61233e7d6b6af7b3cafc6645ac2acb1
SHA256

c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79
SHA512

8c67619747bb108dae5661688ec8fa4c62bc6ac38ee6ff14a4691aab04d7ddd870fee4262cb30624a6bd85ac1f7595af05311496b0336f979e7e5f797791bc0e
SSDEEP

98304:GgjXlctych4cCzJ8k2omX8sUf0ht5f/LyXtcH/:JjKtych9CzJqXM32jyX

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation	Windows10Upgrade9252.exe

Executes dropped EXE 1 IoCs

pid	Process
4148	Windows10UpgraderApp.exe

Loads dropped DLL 1 IoCs

pid	Process
4148	Windows10UpgraderApp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll	Windows10Upgrade9252.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10UpgraderApp.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css	Windows10Upgrade9252.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10Upgrade9252.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\base.js	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\ui-dark.css	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js	Windows10Upgrade9252.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\WinDlp.dll	Windows10Upgrade9252.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4928	4148	WerFault.exe	86

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133343505965980448"	chrome.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3824	chrome.exe
3824	chrome.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeBackupPrivilege	4068	Windows10Upgrade9252.exe
Token: SeRestorePrivilege	4068	Windows10Upgrade9252.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeDebugPrivilege	4596	taskmgr.exe
Token: SeSystemProfilePrivilege	4596	taskmgr.exe
Token: SeCreateGlobalPrivilege	4596	taskmgr.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: 33	4596	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4596	taskmgr.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4148	Windows10UpgraderApp.exe
4148	Windows10UpgraderApp.exe
4148	Windows10UpgraderApp.exe
4148	Windows10UpgraderApp.exe
4148	Windows10UpgraderApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 4148	4068	Windows10Upgrade9252.exe	86
PID 4068 wrote to memory of 4148	4068	Windows10Upgrade9252.exe	86
PID 4068 wrote to memory of 4148	4068	Windows10Upgrade9252.exe	86
PID 3824 wrote to memory of 460	3824	chrome.exe	104
PID 3824 wrote to memory of 460	3824	chrome.exe	104
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 1892	3824	chrome.exe	105
PID 3824 wrote to memory of 2676	3824	chrome.exe	107
PID 3824 wrote to memory of 2676	3824	chrome.exe	107
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106
PID 3824 wrote to memory of 1928	3824	chrome.exe	106

C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe
"C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
  "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 1920
    3⤵
    - Program crash
    PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4148 -ip 4148
1⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc2bb79758,0x7ffc2bb79768,0x7ffc2bb79778
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:2
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4716 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4868 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4752 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4876 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5332 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1864,i,14715249610429227045,9483232509387165810,131072 /prefetch:8
  2⤵
  PID:5400

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3256

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini

Filesize
27B

MD5
ca22263c7a6f965df18f5c601f5db7ce

SHA1
e4b1a401ed497523a583ae8613646b03778a33a6

SHA256
299fa3043627954c524b6171c26fcc3513790310aa2561e6f012eff15254381c

SHA512
3cd39b438f7cb34b38f32240b1ba6a5010f49e12123db770460cf74217bc6946e2032355376c203b68863ee85596d21aa7b2d77c94da48a54def111d147311f8

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\Downloader.dll

Filesize
197KB

MD5
5b62ad6ae42f32806062ad1bcb3e2de5

SHA1
8d4a543eac9643931fcb620cd588e2cc1067920a

SHA256
96f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3

SHA512
af5bdbc5019b56eb9a32b6d264388e309e36013d43dbe09c61224ba6fabf1ff905371bc5b6ddaa0d5bfedae99cc5a7051f13fbf26cc756793799e568094eabcf

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

Filesize
3.5MB

MD5
ab38a78503d8ad3ce7d69f937d71a99c

SHA1
00b6a6f09dd45e356ef9e2cacd554c728313fa99

SHA256
f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782

SHA512
fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

Filesize
3.5MB

MD5
ab38a78503d8ad3ce7d69f937d71a99c

SHA1
00b6a6f09dd45e356ef9e2cacd554c728313fa99

SHA256
f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782

SHA512
fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

Filesize
3.5MB

MD5
ab38a78503d8ad3ce7d69f937d71a99c

SHA1
00b6a6f09dd45e356ef9e2cacd554c728313fa99

SHA256
f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782

SHA512
fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll

Filesize
197KB

MD5
5b62ad6ae42f32806062ad1bcb3e2de5

SHA1
8d4a543eac9643931fcb620cd588e2cc1067920a

SHA256
96f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3

SHA512
af5bdbc5019b56eb9a32b6d264388e309e36013d43dbe09c61224ba6fabf1ff905371bc5b6ddaa0d5bfedae99cc5a7051f13fbf26cc756793799e568094eabcf

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA.css

Filesize
82B

MD5
b81d1e97c529ac3d7f5a699afce27080

SHA1
0a981264db289afd71695b4d6849672187e8120f

SHA256
35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225

SHA512
e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css

Filesize
5KB

MD5
7f5fcac447cc2150ac90020f8dc8c98b

SHA1
5710398d65fba59bd91d603fc340bf2a101df40a

SHA256
453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850

SHA512
b9fb315fdcf93d028423f49438b1eff40216b377d8c3bc866a20914c17e00bef58a18228bebb8b33c8a64fcaaa34bee84064bb24a525b4c9ac2f26e384edb1ff

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm

Filesize
60KB

MD5
b2a06af2867a2bb3d4b198a22f7936b3

SHA1
98a28e15abdd2d6989d667cc578bf6ab954c29f5

SHA256
40f468006ab37ef4fcc54c5ff25005644f15d696f1269f67b450c9e3ce5e8d23

SHA512
eefc295a7cd517c93bbeadee51ab778f371be8b21a92b0c06339da2e624abd19c34907e0a8965e6bfe81863752c56cc509fcf015a3ee986d208a5fc7cac8bfc5

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif

Filesize
16KB

MD5
1a276cb116bdece96adf8e32c4af4fee

SHA1
6bc30738fcd0c04370436f4d3340d460d25b788f

SHA256
9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618

SHA512
5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png

Filesize
2KB

MD5
afeed45df4d74d93c260a86e71e09102

SHA1
2cc520e3d23f6b371c288645649a482a5db7ccd9

SHA256
f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f

SHA512
778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png

Filesize
420B

MD5
0968430a52f9f877d83ef2b46b107631

SHA1
c1436477b4ee1ee0b0c81c9036eb228e4038b376

SHA256
b210f3b072c60c2feb959e56c529e24cec77c1fcf933dcadad1f491f974f5e96

SHA512
7a8a15524aecdb48753cc201c215df19bc79950373adc6dd4a8f641e3add53eba31d1309bf671e3b9e696616a3badce65839b211591a2eeebb9306390d81cfcf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
5713f81388e663c8a5f27decbdc2ed52

SHA1
cca4b6ed99a4a18d457812d5147d0c2aca76c284

SHA256
db0900f89cd97b8b5e593ad926c2ff7f3c221824f48cf929fecf192507f5a412

SHA512
a0ec9a2f7c744d76b455b65fc27308dd865fc236dbacd1d7d0ad54dbff7111a9af8102eaf4cee085fe14af0b0280292d9a301a09b4003806997ec242b2ce5597

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
a905310acf69852e2cda0b826e044ea1

SHA1
9c130ae6afe32c547d744dcba3dc784e1ab60d32

SHA256
d9001d6073e8bb14c56119afae931c2a907e3fcb23a64cd4f0d35e2978953b55

SHA512
91561c718c6775aafe9720beb1b779d89dda1e3ce8c0e862762f4482a0a62bd2a9b92f5eca3f9b33b57889c1b957a974d8f1ab8cc4b0ce513f9e28239f1460d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c8f2ec7a71baf69e370fe5597c9f6ea9

SHA1
2199fdb37bcaa6c4503c7803e78634165697e15c

SHA256
a35aa790b08cb162da297ef29f60400b1f06434dfbbdc4903a695e90b6205751

SHA512
b5b0df1c6be92a028058a56bed816def421422d592633668aa866500c6e89d18ea0b777cde17e3cea62cb75864f92058a87e318fc08a5420e3596cd6fde9ec8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2ca8ed52c91b54db895260296a5b53ca

SHA1
e765cb7faaa1e9a0268b32a737005dd0c48cfb5d

SHA256
aa7dbeed8d0f3d9621223b209a8ee10f02f48018007394e323554eb174992843

SHA512
4654be5ac3f590aba2fa866633f0921986f509a1d2015d9c9dac6a2c8e15caff14dd01eb66d78441ada66bab29bbd5ee92f0df7e2caf4276f5e2ec1c2df1c2fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
04fd900cb72d3c0d12882efbefac5f60

SHA1
b0c8ea3171f5a9527f9b5cb16469d41524b5a85a

SHA256
0bd35cddf3092186afc692899dceeb8c2422b79676ede694ec17c8a49996da1d

SHA512
9f73ad8856dcc28a1384da6948ce81a54080dcea2a212004b7ec40c68f820cb992e3a68cfe14a5b21359690f144f492db4aadaef0af2ac79a175c6c69c286644

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
176KB

MD5
b3d66c0c8bf981f0c8a484a98651ec4f

SHA1
03b15655552663a9ea93463ff245a15422f2e6ee

SHA256
7c21d873eb995103c6b11fe11515c3e12286844a8b7b5ae2f20e7017c965f61f

SHA512
47797a0e6b30bd98a316c6fa1745aa92e8287456112a28db57af8e4ebb8781dfeeed4dda291fde5c7421b01f60e9feae7b720a77922c5117d7fc74a059bfeec0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
176KB

MD5
efaf0c33bce5829a0317d544c63953ff

SHA1
44e9ebc8d5d93452882b2199378c6f66e64ec364

SHA256
ff360b673954e5c2dfcf341267ec84c558b444b2ec3ba3d4fb13d27fd40e1492

SHA512
c115fe2ac92f0ac339de8178cb2b018babb2a81bf9355373196f1cac3c36886ceed618803365af13292889b7c4e6addd85c86a9da0374430826e580b4ec5166f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU7BF6.tmp\appraiserxp.dll

Filesize
363KB

MD5
cbb270591c9a1bfb1b10559ab672f705

SHA1
fed0d59d60709b5b05b9d31030ea7a5422767a7e

SHA256
770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f

SHA512
67c4154d47981f22965966aa823dc0e05872b2f6d8fc7d80b4130f1cdb8bf9f326a20980e29c085e2940fc1f7b033b85d2eb192f5bda2da136364a842ea20f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU7BF6.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktop.css

Filesize
39KB

MD5
5ad8ceea06e280b9b42e1b8df4b8b407

SHA1
693ea7ac3f9fed186e0165e7667d2c41376c5d61

SHA256
03a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb

SHA512
1694fa3b9102771eef8a42b367d076c691b002de81eb4334ac6bd7befde747b168e7ed8f94f1c8f8877280f51c44adb69947fc1d899943d25b679a1be71dec84

Download Submit
memory/4596-302-0x0000026871490000-0x0000026871491000-memory.dmp

Filesize
4KB

Download
memory/4596-313-0x0000026871490000-0x0000026871491000-memory.dmp

Filesize
4KB

Download
memory/4596-312-0x0000026871490000-0x0000026871491000-memory.dmp

Filesize
4KB

Download
memory/4596-310-0x0000026871490000-0x0000026871491000-memory.dmp

Filesize
4KB

Download
memory/4596-311-0x0000026871490000-0x0000026871491000-memory.dmp

Filesize
4KB

Download
memory/4596-309-0x0000026871490000-0x0000026871491000-memory.dmp

Filesize
4KB

Download
memory/4596-308-0x0000026871490000-0x0000026871491000-memory.dmp

Filesize
4KB

Download
memory/4596-307-0x0000026871490000-0x0000026871491000-memory.dmp

Filesize
4KB

Download
memory/4596-303-0x0000026871490000-0x0000026871491000-memory.dmp

Filesize
4KB

Download
memory/4596-301-0x0000026871490000-0x0000026871491000-memory.dmp

Filesize
4KB

Download