b795f6727110bdfb6456916c9da0ac488c6bf270b13fbc2e692c9cd9e713d9b3

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Executes dropped EXE 19 IoCs

pid	Process
2224	neas.69c490efe43fbc122cad65049622efa0.exe
2540	GoogleUpdate.exe
2376	GoogleUpdate.exe
1532	GoogleUpdate.exe
2032	GoogleUpdateComRegisterShell64.exe
1616	GoogleUpdateComRegisterShell64.exe
1812	GoogleUpdateComRegisterShell64.exe
2952	icsys.icn.exe
908	GoogleUpdate.exe
3012	GoogleUpdate.exe
560	explorer.exe
2448	GoogleUpdate.exe
3040	spoolsv.exe
2008	svchost.exe
1652	spoolsv.exe
3008	googleearth-win-pro-7.3.6.9345-x64.exe
2908	GoogleCrashHandler.exe
2096	GoogleCrashHandler64.exe
1900	GoogleUpdate.exe

Loads dropped DLL 48 IoCs

pid	Process
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2224	neas.69c490efe43fbc122cad65049622efa0.exe
2540	GoogleUpdate.exe
2540	GoogleUpdate.exe
2540	GoogleUpdate.exe
2540	GoogleUpdate.exe
2376	GoogleUpdate.exe
2376	GoogleUpdate.exe
2376	GoogleUpdate.exe
2540	GoogleUpdate.exe
1532	GoogleUpdate.exe
1532	GoogleUpdate.exe
1532	GoogleUpdate.exe
2032	GoogleUpdateComRegisterShell64.exe
1532	GoogleUpdate.exe
1532	GoogleUpdate.exe
1616	GoogleUpdateComRegisterShell64.exe
1532	GoogleUpdate.exe
1532	GoogleUpdate.exe
1812	GoogleUpdateComRegisterShell64.exe
1532	GoogleUpdate.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2540	GoogleUpdate.exe
2540	GoogleUpdate.exe
2540	GoogleUpdate.exe
908	GoogleUpdate.exe
2540	GoogleUpdate.exe
3012	GoogleUpdate.exe
3012	GoogleUpdate.exe
3012	GoogleUpdate.exe
2952	icsys.icn.exe
2448	GoogleUpdate.exe
2448	GoogleUpdate.exe
2448	GoogleUpdate.exe
2448	GoogleUpdate.exe
3012	GoogleUpdate.exe
560	explorer.exe
3040	spoolsv.exe
2008	svchost.exe
2448	GoogleUpdate.exe
2468	msiexec.exe
2468	msiexec.exe
1284	Process not Found
1284	Process not Found
2448	GoogleUpdate.exe
2448	GoogleUpdate.exe
2448	GoogleUpdate.exe
1900	GoogleUpdate.exe

Registers COM server for autorun 1 TTPs 33 IoCs

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.152\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.152\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.152\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.152\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.152\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.152\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.152\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.152\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.152\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe

Adds Run key to start application 2 TTPs 4 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	2468	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Google Earth Pro\client\IGAttrs.dll	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\world	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\gdalvrt.xsd	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\swscale-5.dll	msiexec.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4B43.tmp\goopdateres_th.dll	neas.69c490efe43fbc122cad65049622efa0.exe
File created	C:\Program Files\Google\Google Earth Pro\client\Qt5Sql.dll	msiexec.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_kn.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_sw.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\IGNF	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\shaders\watersurface.glslesf	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\proj.dll	msiexec.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4B43.tmp\goopdateres_ru.dll	neas.69c490efe43fbc122cad65049622efa0.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\inspire_cp_CadastralZoning.gfs	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\webbrowser.rcc	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\lang\da.qm	msiexec.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_hi.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\ruian_vf_st_v1.gfs	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\alchemy\ogles20\libGLESv2.dll	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\icuuc54.dll	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\ITRF2008	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\flightsim\controller\logitech_extreme_3d.ini	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\lang\fa.qm	msiexec.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_ar.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_uk.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\flightsim\controller\speed_link_cougar_flightstick.ini	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\seed_2d.dgn	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\alchemy\ogles20\IGGfx.dll	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\esri	msiexec.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4B43.tmp\goopdateres_es-419.dll	neas.69c490efe43fbc122cad65049622efa0.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4B43.tmp\goopdateres_et.dll	neas.69c490efe43fbc122cad65049622efa0.exe
File created	C:\Program Files\Google\Google Earth Pro\client\plugins\imageformats\qico.dll	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\nad.lst	msiexec.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4B43.tmp\goopdateres_vi.dll	neas.69c490efe43fbc122cad65049622efa0.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdate.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\osmconf.ini	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\cursor_crosshair_inverse.png	msiexec.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4B43.tmp\goopdateres_hi.dll	neas.69c490efe43fbc122cad65049622efa0.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_iw.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Google Earth Pro\client\alchemy\ogl\IGSg.dll	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\shaders\stbranch.vs_2_0	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\gcs.csv	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\lang\pt-PT.qm	msiexec.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\header.dxf	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\avcodec-58.dll	msiexec.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_is.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_ja.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4B43.tmp\goopdateres_zh-CN.dll	neas.69c490efe43fbc122cad65049622efa0.exe
File created	C:\Program Files\Google\Google Earth Pro\client\shaders\stfrond.arbfp1	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\Qt5WebChannel.dll	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\vdv452.xml	msiexec.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4B43.tmp\goopdateres_is.dll	neas.69c490efe43fbc122cad65049622efa0.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_ko.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Google Earth Pro\client\lang\tr.qm	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\inspire_cp_CadastralParcel.gfs	msiexec.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_ca.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Google Earth Pro\client\shaders\stars.glslesv	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\IGUtils.dll	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\shaders\color.h	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\res\gdal\s57objectclasses.csv	msiexec.exe
File created	C:\Program Files\Google\Google Earth Pro\client\d3dcompiler_47.dll	msiexec.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.152\goopdateres_sk.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Google Earth Pro\client\plugins\platforms\qoffscreen.dll	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f770fad.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2468.tmp	msiexec.exe
File created	C:\Windows\Installer\f770faf.msi	msiexec.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Installer\f770faa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{F27DBA46-80E1-4858-9285-19198FFFBF3D}\MainIcon.ico	msiexec.exe
File created	C:\Windows\Installer\f770faa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{F27DBA46-80E1-4858-9285-19198FFFBF3D}\MainIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	NEAS.69c490efe43fbc122cad65049622efa0.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Installer\f770fad.ipi	msiexec.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
3028	schtasks.exe
2840	schtasks.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GoogleEarth.kmzfile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ = "IApp2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\ProgID\ = "GoogleUpdate.PolicyStatusMachineFallback.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ = "ICoCreateAsyncStatus"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ = "IGoogleUpdate"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoCreateAsync.1.0\ = "CoCreateAsync"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ = "IProcessLauncher"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ = "IPolicyStatusValue"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ = "ICredentialDialog"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LOCALSERVER32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\CLSID\ = "{534F5323-3569-4F42-919D-1E1CF93E5BF6}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\ = "{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods\ = "7"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32\ = "{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\VersionIndependentProgID\ = "GoogleUpdate.OnDemandCOMClassMachineFallback"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\64ABD72F1E08858429589191F8FFFBD3\ProductName = "Google Earth Pro"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\VersionIndependentProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachine\CLSID\ = "{521FDB42-7130-4806-822A-FC5163FAD983}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.152\\goopdate.dll,-3000"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32\ = "{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ = "IProcessLauncher2"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ProgID\ = "GoogleUpdate.CoreMachineClass.1"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CLSID\ = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0\ = "GoogleUpdate Update3Web"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods\ = "23"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine\CLSID\ = "{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\VersionIndependentProgID\ = "GoogleUpdate.OnDemandCOMClassSvc"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3900DE1E-5C69-4B8E-B45C-EAC7B693074F}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods\ = "5"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32\ = "{BABC0FE1-E9B9-49A3-BBE6-3F16B71DC052}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2540	GoogleUpdate.exe
2540	GoogleUpdate.exe
2540	GoogleUpdate.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
560	explorer.exe
2008	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	GoogleUpdate.exe
Token: SeDebugPrivilege	2540	GoogleUpdate.exe
Token: SeDebugPrivilege	2540	GoogleUpdate.exe
Token: SeShutdownPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeIncreaseQuotaPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeSecurityPrivilege	2468	msiexec.exe
Token: SeCreateTokenPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeLockMemoryPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeIncreaseQuotaPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeMachineAccountPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeTcbPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeSecurityPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeTakeOwnershipPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeLoadDriverPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeSystemProfilePrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeSystemtimePrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeProfSingleProcessPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeIncBasePriorityPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeCreatePagefilePrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeCreatePermanentPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeBackupPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeRestorePrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeShutdownPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeDebugPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeAuditPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeSystemEnvironmentPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeChangeNotifyPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeRemoteShutdownPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeUndockPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeSyncAgentPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeEnableDelegationPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeManageVolumePrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeImpersonatePrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeCreateGlobalPrivilege	3008	googleearth-win-pro-7.3.6.9345-x64.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2872	NEAS.69c490efe43fbc122cad65049622efa0.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
560	explorer.exe
560	explorer.exe
3040	spoolsv.exe
3040	spoolsv.exe
2008	svchost.exe
2008	svchost.exe
1652	spoolsv.exe
1652	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2224	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	28
PID 2872 wrote to memory of 2224	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	28
PID 2872 wrote to memory of 2224	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	28
PID 2872 wrote to memory of 2224	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	28
PID 2872 wrote to memory of 2224	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	28
PID 2872 wrote to memory of 2224	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	28
PID 2872 wrote to memory of 2224	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	28
PID 2224 wrote to memory of 2540	2224	neas.69c490efe43fbc122cad65049622efa0.exe	29
PID 2224 wrote to memory of 2540	2224	neas.69c490efe43fbc122cad65049622efa0.exe	29
PID 2224 wrote to memory of 2540	2224	neas.69c490efe43fbc122cad65049622efa0.exe	29
PID 2224 wrote to memory of 2540	2224	neas.69c490efe43fbc122cad65049622efa0.exe	29
PID 2224 wrote to memory of 2540	2224	neas.69c490efe43fbc122cad65049622efa0.exe	29
PID 2224 wrote to memory of 2540	2224	neas.69c490efe43fbc122cad65049622efa0.exe	29
PID 2224 wrote to memory of 2540	2224	neas.69c490efe43fbc122cad65049622efa0.exe	29
PID 2540 wrote to memory of 2376	2540	GoogleUpdate.exe	30
PID 2540 wrote to memory of 2376	2540	GoogleUpdate.exe	30
PID 2540 wrote to memory of 2376	2540	GoogleUpdate.exe	30
PID 2540 wrote to memory of 2376	2540	GoogleUpdate.exe	30
PID 2540 wrote to memory of 2376	2540	GoogleUpdate.exe	30
PID 2540 wrote to memory of 2376	2540	GoogleUpdate.exe	30
PID 2540 wrote to memory of 2376	2540	GoogleUpdate.exe	30
PID 2540 wrote to memory of 1532	2540	GoogleUpdate.exe	31
PID 2540 wrote to memory of 1532	2540	GoogleUpdate.exe	31
PID 2540 wrote to memory of 1532	2540	GoogleUpdate.exe	31
PID 2540 wrote to memory of 1532	2540	GoogleUpdate.exe	31
PID 2540 wrote to memory of 1532	2540	GoogleUpdate.exe	31
PID 2540 wrote to memory of 1532	2540	GoogleUpdate.exe	31
PID 2540 wrote to memory of 1532	2540	GoogleUpdate.exe	31
PID 1532 wrote to memory of 2032	1532	GoogleUpdate.exe	32
PID 1532 wrote to memory of 2032	1532	GoogleUpdate.exe	32
PID 1532 wrote to memory of 2032	1532	GoogleUpdate.exe	32
PID 1532 wrote to memory of 2032	1532	GoogleUpdate.exe	32
PID 1532 wrote to memory of 1616	1532	GoogleUpdate.exe	33
PID 1532 wrote to memory of 1616	1532	GoogleUpdate.exe	33
PID 1532 wrote to memory of 1616	1532	GoogleUpdate.exe	33
PID 1532 wrote to memory of 1616	1532	GoogleUpdate.exe	33
PID 1532 wrote to memory of 1812	1532	GoogleUpdate.exe	34
PID 1532 wrote to memory of 1812	1532	GoogleUpdate.exe	34
PID 1532 wrote to memory of 1812	1532	GoogleUpdate.exe	34
PID 1532 wrote to memory of 1812	1532	GoogleUpdate.exe	34
PID 2872 wrote to memory of 2952	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	35
PID 2872 wrote to memory of 2952	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	35
PID 2872 wrote to memory of 2952	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	35
PID 2872 wrote to memory of 2952	2872	NEAS.69c490efe43fbc122cad65049622efa0.exe	35
PID 2540 wrote to memory of 908	2540	GoogleUpdate.exe	36
PID 2540 wrote to memory of 908	2540	GoogleUpdate.exe	36
PID 2540 wrote to memory of 908	2540	GoogleUpdate.exe	36
PID 2540 wrote to memory of 908	2540	GoogleUpdate.exe	36
PID 2540 wrote to memory of 908	2540	GoogleUpdate.exe	36
PID 2540 wrote to memory of 908	2540	GoogleUpdate.exe	36
PID 2540 wrote to memory of 908	2540	GoogleUpdate.exe	36
PID 2540 wrote to memory of 3012	2540	GoogleUpdate.exe	37
PID 2540 wrote to memory of 3012	2540	GoogleUpdate.exe	37
PID 2540 wrote to memory of 3012	2540	GoogleUpdate.exe	37
PID 2540 wrote to memory of 3012	2540	GoogleUpdate.exe	37
PID 2540 wrote to memory of 3012	2540	GoogleUpdate.exe	37
PID 2540 wrote to memory of 3012	2540	GoogleUpdate.exe	37
PID 2540 wrote to memory of 3012	2540	GoogleUpdate.exe	37
PID 2952 wrote to memory of 560	2952	icsys.icn.exe	38
PID 2952 wrote to memory of 560	2952	icsys.icn.exe	38
PID 2952 wrote to memory of 560	2952	icsys.icn.exe	38
PID 2952 wrote to memory of 560	2952	icsys.icn.exe	38
PID 560 wrote to memory of 3040	560	explorer.exe	40
PID 560 wrote to memory of 3040	560	explorer.exe	40

C:\Users\Admin\AppData\Local\Temp\NEAS.69c490efe43fbc122cad65049622efa0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.69c490efe43fbc122cad65049622efa0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- \??\c:\users\admin\appdata\local\temp\neas.69c490efe43fbc122cad65049622efa0.exe
  c:\users\admin\appdata\local\temp\neas.69c490efe43fbc122cad65049622efa0.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Program Files (x86)\Google\Temp\GUM4B43.tmp\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Temp\GUM4B43.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={65E60E95-0DE9-43FF-9F3F-4F7D2DFF04B5}&iid={65E60E95-0DE9-43FF-9F3F-4F7D2DFF04B5}&lang=pt&browser=4&usagestats=1&appname=Google%20Earth%20Pro&needsadmin=True&brand=GGGE"
    3⤵
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:2376
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1532
    - - C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2032
    - - C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:1616
    - - C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:1812
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzg1RUJGQjQtRTFGOS00MTQ0LUIzQjAtMjRENTc3OUQ0QTM3fSIgdXNlcmlkPSJ7OEI3NERENTAtRjE5RS00NkFELTlDNjgtQjFDQjUxNTlBRDVCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezMwQjA3QUEyLTg2QUQtNDBDNC05NEMyLUU1Nzc3MUI4MkVGNH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4xNTIiIGxhbmc9InB0IiBicmFuZD0iR0dHRSIgY2xpZW50PSIiIGlpZD0iezY1RTYwRTk1LTBERTktNDNGRi05RjNGLTRGN0QyREZGMDRCNX0iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iOTc4MiIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:908
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={65E60E95-0DE9-43FF-9F3F-4F7D2DFF04B5}&iid={65E60E95-0DE9-43FF-9F3F-4F7D2DFF04B5}&lang=pt&browser=4&usagestats=1&appname=Google%20Earth%20Pro&needsadmin=True&brand=GGGE" /installsource taggedmi /sessionid "{C85EBFB4-E1F9-4144-B3B0-24D5779D4A37}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3012
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2952
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:560
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3040
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:2008
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:13 /f
        6⤵
        Creates scheduled task(s)
        
        PID:3028
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:15 /f
        6⤵
        Creates scheduled task(s)
        
        PID:2840
  - - C:\Windows\Explorer.exe
      C:\Windows\Explorer.exe
      4⤵
      PID:2100

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448
- C:\Program Files (x86)\Google\Update\Install\{6D2421A6-15A7-44C3-B37F-044E8A01498C}\googleearth-win-pro-7.3.6.9345-x64.exe
  "C:\Program Files (x86)\Google\Update\Install\{6D2421A6-15A7-44C3-B37F-044E8A01498C}\googleearth-win-pro-7.3.6.9345-x64.exe" REBOOT=ReallySuppress OMAHA=1 ALLUSERS=1 REINSTALLMODE=emus
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzg1RUJGQjQtRTFGOS00MTQ0LUIzQjAtMjRENTc3OUQ0QTM3fSIgdXNlcmlkPSJ7OEI3NERENTAtRjE5RS00NkFELTlDNjgtQjFDQjUxNTlBRDVCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0E3MkU4NzdFLTA5OTEtNDc2QS05M0M5LTkzNjYyOEYyNTE1Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NjVFNjBFOTUtMERFOS00M0ZGLTlGM0YtNEY3RDJERkYwNEI1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iNy4zLjYuOTM0NSIgbGFuZz0icHQiIGJyYW5kPSJHR0dFIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSIgaWlkPSJ7NjVFNjBFOTUtMERFOS00M0ZGLTlGM0YtNEY3RDJERkYwNEI1fSIgY29ob3J0PSIxOnlqOToiIGNvaG9ydG5hbWU9IkV4dGVybmFsIGluc3RhbGxzIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvRWFydGgvZGdnbzZkajNicWlidXFzZjI1cWJ0Mjc2ZTRfNy4zLjYuOTM0NS9nb29nbGVlYXJ0aC13aW4tcHJvLTcuMy42LjkzNDUteDY0LmV4ZSIgZG93bmxvYWRlZD0iNzA4MzI5MjAiIHRvdGFsPSI3MDgzMjkyMCIgZG93bmxvYWRfdGltZV9tcz0iNjUyMSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjI3ODE1IiBkb3dubG9hZF90aW1lX21zPSI3NzA2IiBkb3dubG9hZGVkPSI3MDgzMjkyMCIgdG90YWw9IjcwODMyOTIwIiBpbnN0YWxsX3RpbWVfbXM9IjY0OTExIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\system32\taskeng.exe
taskeng.exe {C366CBAF-B5E2-4C3D-8053-B32E77BE737E} S-1-5-21-3618187007-3650799920-3290345941-1000:BPDFUYWR\Admin:Interactive:[1]
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry